The short version: Your clinic owns its data. We store it in India, encrypt it in transit, back it up daily, never sell it, and let you export or delete it at any time. We only process patient data on your instructions, to run the software you asked for.
Contents
01Who we are
SevaSangraha ("SevaSangraha", "we", "us") provides clinic management software to clinics and independently practicing doctors in India. We are based in Udaipur, Rajasthan. You can reach us any time at hello@sevasangrah.in or on WhatsApp at +91 93732 46319.
02Data roles — who is responsible for what
There are two kinds of data in SevaSangraha, and different responsibilities attach to each:
- Account data (your clinic name, your login email, your doctors) — we are the data fiduciary for this and this policy governs it directly.
- Patient data (the records your clinic enters — names, contact details, visits, prescriptions, payments) — your clinic is the data fiduciary; we are your data processor. We hold and process this data only to provide the service and only on your instructions. Your clinic is responsible for obtaining any patient consent required by law.
03What we collect
You give us
- Account: clinic name, address, phone, your name and email, chosen password (stored only as a one-way hash — we never see it).
- Branding you upload: clinic logo.
- Patient records your staff enter: patient name, age, gender, phone, address, guardian name, and optional fields such as email, ABHA ID, Aadhaar, medical history, allergies, prescriptions, and billing/payment entries.
We collect automatically
- Basic technical logs (IP address, browser, timestamps) needed to run and secure the service.
- An authentication token stored in your browser to keep you logged in.
We do not use advertising trackers or sell any data.
04How we use it
- To run the software: registration, queue, prescriptions, billing, reports.
- To put your clinic's branding on your prescriptions and receipts.
- To send you service messages — account setup, password reset, trial reminders, and (if you enable it) patient WhatsApp messages you trigger.
- To secure the service, prevent abuse, back up data, and provide support.
Our legal basis is performance of our contract with you (the Terms of Service) and our legitimate interest in keeping the service secure and reliable.
05Patient data — how we handle it
Your patients' data is isolated to your clinic's own account. Our staff do not access it except when you ask us to for support, or where strictly necessary to operate or fix the service. We do not use patient data to train any model, and we do not share it with other clinics. You remain responsible, as the treating establishment, for the accuracy of clinical records and for compliance with medical record-keeping and consent laws that apply to your practice.
06Who we share with (sub-processors)
We do not sell data. We share the minimum necessary with a small set of service providers who help us run SevaSangraha:
- Oracle Cloud Infrastructure (Mumbai, India) — hosting and storage of the application and database.
- ZeptoMail (Zoho) — sending transactional email (welcome, password reset, reminders).
- BhashSMS / WhatsApp Business — only when you choose to send a patient a message.
- Razorpay — payment processing when you subscribe (they handle card/UPI details directly; we do not store them).
We may also disclose data if required by law, or to protect the rights and safety of users and the public.
07Where it's stored & how it's secured
- India-resident: your data is hosted on Oracle Cloud in Mumbai, India.
- Encryption in transit: all traffic uses HTTPS/TLS.
- Isolation: each clinic's data is separated by account; access is controlled by role (admin, reception, doctor).
- Backups: the database is backed up daily.
- Access control: passwords are stored only as salted one-way hashes; administrative access is limited and logged.
No system is perfectly secure, but we take reasonable, industry-standard measures appropriate to the sensitivity of health data.
08Retention & deletion
- We keep your data for as long as your account is active.
- After cancellation, your data is preserved for 30 days so you can reactivate or export, and is then deleted from active systems.
- You can request a full export of your data at any time.
- Backups are rotated on a rolling schedule and expire automatically.
09Your rights
Under India's Digital Personal Data Protection Act, 2023, you may request access to, correction of, or deletion of your personal data, and you may withdraw consent where processing is based on it. For account data, write to us at hello@sevasangrah.in. For patient data, the request should come from the clinic that owns it (the data fiduciary), and we will help that clinic fulfil it.
10Cookies & local storage
We use only what's needed to run the app — chiefly an authentication token kept in your browser's local storage so you stay logged in. We do not use third-party advertising or cross-site tracking cookies. If we ever add analytics, we will update this policy and, where required, ask for consent.
11Grievance officer
If you have a concern about how your data is handled, contact our grievance officer at hello@sevasangrah.in (subject line: "Privacy — Grievance"). We aim to acknowledge within 72 hours and resolve within the timelines required by applicable law.
12Changes & contact
We may update this policy as the service evolves or the law changes. Material changes will be notified by email or in-app. Continued use after an update means you accept the revised policy. Questions? hello@sevasangrah.in.