Privacy Policy

This policy explains how Shiv Shakti Trading (proprietor: Deepak Narendra Agrawal) (“HealthRich”, “we”, “us”) handles personal data when you use the HealthRich clinic software at https://app.healthrich.in, our website https://healthrich.in, and the messages clinics send through HealthRich. It is written to meet the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and its rules.

1. Our role

• Patient data in a clinic’s account. The clinic (doctor or hospital) decides why and how patient data is used. The clinic is the Data Fiduciary; HealthRich is a Data Processor that processes this data only on the clinic’s instructions and to provide the service. Patients should contact their clinic first about their records; we help the clinic respond.
• Our own customers and visitors. For clinic staff accounts, website visitors and people who request a demo, HealthRich is the Data Fiduciary.

2. What we collect

Who	Data	Why
Clinic staff (users)	Name, email, mobile, role, clinic, sign-in and device details, activity logs	To create accounts, sign in, secure access and support you
Patients (entered by the clinic)	Name, mobile, age or date of birth, gender, address, visits, complaints, diagnoses, prescriptions, vitals, photos and reports the clinic uploads, bills and payments, appointments, consent records	To run the clinic’s work: queue, records, prescriptions, billing, pharmacy, reminders
Demo requests and enquiries	Name, mobile, email, clinic name, city, specialty, number of doctors, current software, message, the page and campaign you came from	To contact you and arrange a demo
Website visitors	IP address, browser and basic request logs; on healthrich.in, Google Analytics cookies and the pages you visit	Security, to keep the site working, and to see which pages lead to demo requests

We do not ask for or store card or bank details. Payments made through payment links are handled by the payment provider.

Signing in with Google

Clinic staff can choose Continue with Google to sign in to the HealthRich app. We ask Google only for the basic sign-in permissions (openid, email, profile), so Google shares your name, email address and profile picture with us, and nothing else.

• We use your Google email address only to find the staff account your clinic admin already created for that address, and to sign you in. If no HealthRich account uses that email, we refuse the sign-in and do not create an account.
• We do not read your Gmail, Drive, Contacts, Calendar or any other Google data, and we never post to your Google account.
• We do not use Google account data for advertising or marketing, we do not sell it, and we share it only with Supabase, which runs our sign-in (section 5).
• We keep it with your staff account for as long as that account is active, like your other account details (section 8).
• Google sign-in is optional: you can always sign in with your password or an email code instead, and you can remove HealthRich’s access at any time in your Google Account, under Security, in your connections to third-party apps and services.

3. How we use data

• To provide, operate, secure and support HealthRich for the clinic.
• To send the messages a clinic asks us to send on its behalf, such as appointment confirmations and reminders, queue tokens, prescription and bill links, follow-up reminders and payment links (see our Messaging Policy).
• To bill our customers, keep tax records and meet legal obligations.
• To answer demo requests and support questions.
• To detect and prevent fraud, abuse and security incidents.

4. What we never do

• We do not sell, rent or license personal data, including de-identified or aggregated patient data.
• We do not show advertisements inside HealthRich and do not share data with pharmaceutical or marketing companies.
• We do not use patient data to market our own products or to train AI models offered to others.
• Our features that analyse clinic data run on that clinic’s own data. No patient data is sent to an outside AI service unless the clinic switches such a feature on after we have told it what is sent and where.

5. Who we share data with

Only service providers that help us run HealthRich, under contracts that limit them to that purpose, and only the data they need:

Provider	What it does	Data involved
Supabase (Amazon Web Services, Mumbai region)	Database, sign-in, file storage	All clinic records
Vercel	Serves the app and website pages	Request logs; no patient records are stored there
Meta Platforms (WhatsApp Business Platform)	Delivers WhatsApp messages	Recipient mobile number, message content
MSG91 (Walkover Web Solutions)	Delivers SMS through DLT-registered headers	Recipient mobile number, message content
Resend	Delivers email	Recipient email address, message content
Razorpay	Payment links, where a clinic uses them	Amount, payer contact details
Google (Sign in with Google), only if you choose it	Confirms who you are when you sign in with your Google account	Google learns that you signed in to HealthRich; we receive your name, email address and profile picture
Google Analytics	Counts visits to our website and demo requests	Pages visited, browser, approximate location and an analytics cookie ID; never your demo-form details or any app or patient data
Cloudflare (Turnstile), when enabled	Bot check on public forms, on top of our own per-IP and per-phone limits	Browser signals for the check, only once it is switched on

We may also disclose data when required by law, a court order or a government authority, or to protect the rights, safety or property of patients, clinics or HealthRich.

6. Where data is stored

Clinic records are stored in India (AWS Mumbai region). Message delivery providers such as Meta may process the recipient’s number and message outside India only to deliver that message, as permitted under the DPDP Act.

7. How we protect data

• Encryption in transit (HTTPS/TLS) and at rest.
• Each clinic’s data is isolated from every other clinic at the database level (row-level security).
• Role-based access inside a clinic: reception, doctors, pharmacy and owners see only what their role allows.
• Audit logs of changes to bills and key records.
• PIN lock and automatic locking in the phone app.
• HealthRich staff access a clinic’s data only to provide support the clinic asked for, or to keep the service secure.

If we become aware of a personal data breach, we will inform the affected clinic and, where the law requires, the Data Protection Board of India and affected individuals, without undue delay.

8. How long we keep data

• Clinic and patient records: for as long as the clinic’s account is active. When a clinic leaves, we provide an export on request and delete its data within 30 days of the request, except records we must keep by law (for example, our own tax invoices).
• Demo requests: up to 24 months after the last contact, unless you ask us to delete them sooner.
• Security logs: up to 12 months.

9. Your rights

Under the DPDP Act you may ask to access a summary of your data, correct or update it, erase it, withdraw consent, nominate someone to act for you, and raise a grievance. Patients should send these requests to their clinic; clinic users and demo requesters can write to support@healthrich.in. We may need to verify your identity. Withdrawing consent does not affect processing already done, and a clinic may need to keep some medical records as required by law.

10. Children

Clinics may keep records of patients under 18. The clinic is responsible for obtaining a parent’s or guardian’s consent where the law requires it. HealthRich does not knowingly collect children’s data for any other purpose.

11. Cookies

The app uses only essential storage needed to keep you signed in and remember settings on your device. The app has no analytics, advertising or cross-site tracking cookies.

Our website (healthrich.in) uses Google Analytics, which sets first-party cookies (_ga) to count visits and see which pages lead to demo requests. We have turned off Google signals and ad personalisation, and we do not send Google your demo-form details. You can block these cookies in your browser settings or with Google’s opt-out add-on.

12. Grievance Officer

Deepak Narendra Agrawal, Shiv Shakti Trading (proprietor: Deepak Narendra Agrawal), Plot No. 09, 80 Feet Road, Near Canosa High School, Dhule, Maharashtra 424001, India. Email: support@healthrich.in. We acknowledge grievances within 24 hours and aim to resolve them within 15 days. If you are not satisfied, you may approach the Data Protection Board of India.

13. Changes

We will post any changes here and update the date above. If a change materially affects how clinic data is used, we will tell clinic admins before it takes effect.