Privacy policy

1. Who is responsible for your data

MEDHAS is operated by LiveSloka International Private Limited (CIN U80902TG2021PTC156732), registered office Plot No 56, H.No 2-158, Kesava Reddy Nagar Colony, Meerpet, Hyderabad, Telangana 500097, India.

There are two distinct roles, and the difference matters:

• Patient data. The clinic is the Data Fiduciary. It decides what is collected and why, and it is responsible for obtaining patient consent. We are its Data Processor— we act on the clinic’s instructions and do not use patient data for our own purposes.
• Clinic and account data. For the practitioner and staff details, billing information and usage data that we need to run our own business, we are the Data Fiduciary.

We handle personal data in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 together with the Reasonable Security Practices Rules, 2011, under which health records and medical history are sensitive personal data or information and attract the higher standard of care we apply to them.

2. What we collect

From clinics and practitioners

• Name, mobile number, email and role.
• Clinic name, address, registration details and branch structure.
• Login credentials, stored only as a salted hash — we never store your password.
• Subscription and billing records, including invoices and payment status.

Patient data entered by the clinic

• Identity and demographics: name, age, sex, contact details.
• Clinical records: complaints, history, examination findings, diagnoses, prescriptions, procedure and Panchakarma notes, diet plans, admission and discharge records.
• Laboratory reports and documents uploaded to a patient’s file.
• Billing, payment and inventory records tied to the patient’s care.

Collected automatically

• Technical logs: IP address, browser and device type, pages accessed and timestamps — used for security, debugging and abuse prevention.
• Analytics, only if you accept analytics cookies. See section 8.

We do not buy personal data from data brokers, and we do not collect anything from anyone who is not either our customer or a patient of our customer.

3. Why we process it

• To provide the platform: storing records, generating prescriptions and bills.
• To produce the trends, outcome analytics and research outputs the clinic has subscribed to, computed over that clinic’s own data.
• To authenticate users, keep workspaces separate, and detect abuse.
• To bill you and to keep the accounting records the law requires.
• To provide support when you contact us, and to send service notices.
• To improve the platform, using aggregated and de-identified information only.

We do not use patient data to train AI models of our own, and we do not use it for advertising or profiling of any kind.

4. Who we share it with

We do not sell personal data. We share it only with the service providers below, each under a contract that limits them to processing it for us, and only to the extent the service requires.

AI features, specifically

When a user asks the clinical assistant a question, requests a charting summary, or runs an AI-assisted research output, the relevant text is sent to a third-party AI provider (OpenAI or Anthropic) to generate the response. That text can include clinical content. It is sent over an encrypted connection, is not used by those providers to train their models under the API terms we operate on, and is not retained by us beyond the record the feature produces. If a clinic would rather this never happen, it should not subscribe to the AI plan and should not use the assistant.

Payments, specifically

Subscription payments are processed by Razorpay, an RBI-authorised payment aggregator. Card numbers, CVVs, UPI PINs and net-banking credentials are entered on Razorpay’s systems and never reach ours. We store only what we need to identify a payment: the amount, the date, a transaction reference and the last four digits of the instrument.

Other disclosures

We may disclose data if required by a valid legal order, to enforce our terms, or to protect against imminent harm — and to a successor entity if the business is transferred, in which case this policy continues to apply.

5. Where data is stored

Records are stored on managed cloud infrastructure. Some of our processors operate outside India; where that happens, transfers are made under contractual safeguards and only to countries not restricted under the DPDP Act. We will publish an update here if our storage location changes materially.

6. How long we keep it

• While you subscribe, clinical records are kept so the clinic can use them — health records are often required to be retained for years, and we do not delete them on our own initiative.
• After termination, data remains available for export for 30 days, then is deleted or irreversibly anonymised.
• Financial records are kept for eight years, as Indian tax and company law require.
• Security logs are kept for up to 12 months.

7. How we protect it

• All traffic is encrypted in transit with TLS.
• Passwords are stored only as salted hashes and cannot be recovered by us.
• Every query is scoped to a clinic, so one workspace cannot read another’s records. Within a clinic, access follows the role assigned to each user.
• Our staff access production data only when needed to provide support or fix a fault, and such access is logged.
• Analytics events are stripped of names, phone numbers, emails and clinical text.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires.

8. Cookies and analytics

• Necessary cookies keep you signed in and protect the session. The platform cannot work without them, so they are always set.
• Analytics cookies(Google Analytics) are set only if you accept them in the banner shown on your first visit. Reject, and no analytics tag loads and no analytics events are sent. You can change your mind by clearing this site’s data in your browser, which brings the banner back.

We never send names, phone numbers, email addresses, or any clinical content to analytics.

9. Your rights

Under the DPDP Act, 2023 you can ask us to:

• tell you what personal data of yours we hold and how it is processed;
• correct or complete anything inaccurate;
• erase data we no longer need for the purpose it was collected;
• withdraw a consent you gave — the platform may stop working for you if the consent was necessary to provide it;
• nominate someone to exercise these rights if you die or become incapacitated.

Patients: your records belong to the clinic treating you. Please ask your clinic first — it controls the record and can act immediately. If the clinic does not respond, write to us and we will help it act on your request.

Write to [email protected]. We may need to verify your identity before acting, and we respond within 30 days.

10. Children

MEDHAS accounts are for adults. Clinics do record paediatric patients; that data is entered by the clinic under the consent of a parent or guardian, which the clinic is responsible for obtaining, and we process it as we do any other patient record.

11. Grievance officer

If you are unhappy with how we have handled your data, contact our grievance officer:

Name

K.C. Ram Kishore

Designation

Grievance Officer, LiveSloka International Private Limited

Email

[email protected]

Address

Plot No 56, H.No 2-158, Kesava Reddy Nagar Colony, Meerpet, Hyderabad, Telangana 500097, India

We acknowledge within 48 hours and resolve within 30 days. If you are still not satisfied, you may complain to the Data Protection Board of India.

12. Changes

We will post any update here and change the date at the top. For material changes we will notify you by email or in-app notice before they take effect. Related pages: terms & conditions, cancellation & refunds.