Privacy policy

Medistyr is software that clinics and hospitals use to run appointments, consultations, billing and staff payroll. This policy explains what data the software holds, who controls it, and your rights under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Who is responsible for your data

• Your clinic is the Data Fiduciary. The clinic decides what patient information to record and why, collects your consent at registration, and answers requests about your records.
• Medistyr is the Data Processor. We store and process data only to provide the software to the clinic, under the clinic's instructions. We do not sell data, show advertising, or use patient records for any other purpose.

What is stored

• Patients: name, phone, age or date of birth, gender, address, emergency contact, ABHA number if given, visits, vitals, diagnoses, prescriptions, tests ordered, bills and payments, and the consent recorded at registration.
• Clinic staff: name, email, phone, role, schedule, and salary details entered by the clinic.
• Security records: who opened or changed a record and when (an audit trail), and sign-in events.

How it is protected

• Each clinic's data is kept separate by rules enforced inside the database, not just in the app.
• Staff see only what their role needs. For example, front-desk and accounts staff cannot open consultation notes or prescriptions.
• All traffic is encrypted (HTTPS), data is encrypted at rest, and sign-in is protected against automated attacks.
• Finished consultations, prescriptions and bills are locked. Any later change keeps the earlier version and the reason.

Where it is stored and who helps us run the service

• Database and sign-in: Supabase, hosted in Singapore.
• Web hosting: Vercel.
• WhatsApp messages, only when the clinic turns them on and the patient has agreed: Meta Platforms.
• Email: Hostinger.
• Bot protection on sign-in: hCaptcha.

These providers process data only to run the service and are bound by their own security and confidentiality terms.

How long it is kept

Medical and billing records are kept for as long as the law requires clinics to keep them, and at least three years from the last visit. Tax records are kept for at least eight years. When a clinic stops using Medistyr, it can export its data, after which it is deleted except where the law requires us to keep it.

Your rights

Under the DPDP Act you can ask your clinic to:

• give you a summary or a copy of the information held about you;
• correct or complete it;
• erase it, where the law does not require it to be kept;
• withdraw consent for optional uses, such as WhatsApp reminders;
• name someone to exercise these rights for you if you cannot.

Please contact your clinic first. If you cannot reach them, or your concern is about Medistyr itself, write to our grievance contact at support@medistyr.in. We reply within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

Children

A child's records are created by the clinic with the consent of a parent or guardian.

Changes

If this policy changes, we will update this page and the date at the top.