Privacy Policy

1. Who This Policy Applies To

This policy applies to:

• Clinic Accounts — the healthcare practice that subscribes to GeoHealth
• Users — doctors, staff, and administrators who access GeoHealth on behalf of a Clinic
• Visitors — individuals who visit our website at geohealth.in

Patient data entered into GeoHealth by a Clinic's staff is processed by Zevaras on behalf of that Clinic. The Clinic is the Data Fiduciary for patient data under the DPDP Act.

2. Information We Collect

2.1 Clinic and User Information

• Clinic name, address, and contact details
• User names, roles, and mobile numbers (used for OTP authentication)
• Subscription and billing information
• Login activity and session logs

2.2 Patient Data (entered by Clinic staff)

• Name, date of birth, gender, mobile number, address
• Medical history, vitals, complaints, diagnoses
• Prescriptions, investigations, and clinical notes
• Billing records and visit history
• ABHA (Ayushman Bharat Health Account) number, where provided

2.3 Usage Data

• Pages accessed, features used, and time spent in the application
• Browser type, device type, and IP address
• Error logs and performance data

3. How We Use Information

3.1 To Provide the Service

We use Clinic and User information to create and manage accounts, authenticate users, process subscriptions, and provide customer support.

3.2 Patient Data

Patient data is used solely to provide GeoHealth's clinic management features as directed by the Clinic. We do not use patient data for advertising, analytics, research, or any purpose other than operating the service for the Clinic.

3.3 Service Improvement

Aggregated, anonymised usage data may be used to improve GeoHealth's features and performance. This data cannot identify individual clinics, users, or patients.

4. Data Storage and Security

All data is stored on secure cloud infrastructure (Google Cloud Platform) with servers located in India. We implement the following security measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• OTP-based authentication — no passwords stored
• Role-based access controls limiting data access to authorised Users
• Regular security reviews and vulnerability assessments
• Audit logs of all data access and modifications

In the event of a data breach affecting personal data, we will notify affected Clinics and relevant authorities in accordance with the DPDP Act.

5. Data Sharing

We do not share personal data with third parties except in the following circumstances:

• Service providers — infrastructure providers (Google Cloud), authentication services (Firebase), and communication services, bound by data processing agreements
• Legal requirements — where required by law, court order, or a government authority in India
• Clinic-directed sharing — where the Clinic instructs us to share data (e.g., future integrations with labs or pharmacies)
• Business transfer — in the event of a merger or acquisition, with appropriate data protection obligations

6. Data Retention

We retain Clinic and User data for the duration of the subscription and for up to 3 years thereafter for legal and audit purposes.

Patient data is retained as long as the Clinic's account is active. Upon account termination, the Clinic may export all patient data within 30 days. After this period, patient data will be deleted from our systems within 90 days, except where retention is required by law.

7. Your Rights (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, individuals have the following rights regarding their personal data:

• Right to access — request a summary of personal data held
• Right to correction — request correction of inaccurate data
• Right to erasure — request deletion of data where no longer necessary
• Right to grievance redressal — raise concerns about data processing

Clinic Users should contact their Clinic administrator for requests relating to patient records. For requests relating to your own User account data, contact us at aravind.ragavendran@zevaras.in. We will respond within 30 days.

8. Cookies and Tracking

GeoHealth uses session cookies strictly necessary to keep Users logged in. We do not use advertising cookies or third-party tracking pixels. Visitors to our marketing website may encounter Google Fonts requests; no personal data is shared with Google in this process.

9. Children's Data

GeoHealth is a professional healthcare platform intended for use by licensed healthcare providers. If patient records include minors, the Clinic is responsible for ensuring appropriate consent has been obtained from the parent or guardian in accordance with applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify Clinics of material changes with at least 30 days' advance notice via email or in-app notification. The effective date at the top of this page reflects the most recent revision.

11. Contact and Grievance Officer

For privacy-related questions, concerns, or to exercise your rights under the DPDP Act, please contact:

Grievance Officer
Zevaras Private Limited
12H, Ramaniyam Pushkar Phase 2 / Block 2
Kalaignar Karunanidhi Salai, Sholinganallur
Chennai, Tamil Nadu — 600119
Email: aravind.ragavendran@zevaras.in
Phone: +91 91500 26728

We will acknowledge your request within 72 hours and resolve it within 30 days.