Privacy Policy

1. Introduction

Aartas Care Private Limited ("we," "us," or "our") operates HiGalen, an AI-powered Electronic Medical Records platform. We are committed to protecting the privacy and security of your personal information and the health data of your patients. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform.

2. Information We Collect

We collect the following categories of information:

2.1 Account & Professional Information

• Full name, professional title, and medical registration number
• Email address, phone number, and clinic/hospital details
• Account credentials and authentication data

2.2 Patient Health Information

• Patient names, contact details, and demographic information
• Medical history, diagnoses, prescriptions, and clinical notes
• Lab reports, imaging data, and other health records uploaded to the platform
• Appointment history and visit records

2.3 Communication Data

• WhatsApp conversations between doctors and patients (via our integration)
• Email communications managed through the platform
• Internal team chat messages

2.4 Usage & Technical Data

• Log data, IP addresses, browser type, and device identifiers
• Feature usage patterns and interaction analytics
• Crash reports and performance metrics

3. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve the HiGalen platform and its features
• Power AI-assisted prescription generation and clinical decision support
• Facilitate patient-doctor communication via WhatsApp and email integrations
• Send appointment reminders and follow-up notifications to patients
• Generate analytics, reports, and insights for your clinic management
• Provide technical support and respond to your inquiries
• Comply with legal and regulatory obligations
• Train and improve our AI models (on anonymised and aggregated data only)

4. Data Sharing & Disclosure

We do not sell your personal data or patient health information. We may share data in the following circumstances:

4.1 Healthcare Providers

Where required for continuity of patient care and with appropriate patient consent, we may share health records with other authorised healthcare providers on the platform.

4.2 Authorised Third-Party Service Providers

We work with trusted service providers (cloud hosting, analytics, communications) who process data on our behalf under strict data processing agreements. These include:

• Cloud infrastructure providers (data centres located in India)
• WhatsApp Business API providers
• Payment processors
• Email delivery services

4.3 Legal Requirements

We may disclose information if required to do so by law, a court order, or a government authority, or if we believe disclosure is necessary to protect our rights, the safety of users, or to comply with a legal obligation.

5. Data Security

We implement industry-standard security measures to protect your data, including:

• AES-256 encryption for data at rest
• TLS 1.2+ encryption for data in transit
• Role-based access controls and multi-factor authentication
• Regular security audits and penetration testing
• HIPAA and GDPR-compliant data handling practices
• Data stored on servers located in India

Despite our best efforts, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal data and patient health information for as long as your account is active or as needed to provide services. Medical records are retained in accordance with applicable Indian health regulations (typically 3–7 years from the date of the last visit, or as mandated by law).

Upon account termination, we will delete or anonymise your data within 90 days, except where we are required by law to retain it longer.

7. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data (subject to legal retention obligations)
• Portability: Request export of your data in a machine-readable format
• Objection: Object to processing of your data for certain purposes
• Withdrawal of consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact our Data Protection Officer at info@higalen.com.

8. Cookies & Tracking

We use cookies and similar tracking technologies to enhance your experience on the HiGalen platform. Types of cookies we use include:

• Essential cookies: Required for the platform to function correctly
• Analytics cookies: Help us understand how users interact with the platform
• Preference cookies: Remember your settings and preferences

You can control cookie settings through your browser. Disabling essential cookies may affect platform functionality.

9. Children's Privacy

HiGalen is intended for use by licensed healthcare professionals. We do not knowingly collect personal information from individuals under 12 years of age. If you become aware that a child has provided us with personal information, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by updating the "Last Updated" date and, where appropriate, by sending an email notification. We encourage you to review this policy periodically.

11. Contact Us

For questions, concerns, or to exercise your data rights, contact us: