Privacy Policy

Hospitrends HMIS ("we", "us", or "our") operates a complete Hospital Management Information System accessible via web and desktop application (collectively, the "Service"). We are committed to protecting your personal and health information with the highest standards of security and transparency. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the rights you have over your information. By using our Service, you agree to the practices described in this policy.

Data we collect

Account & identity data

• Full name, email address, and phone number
• Date of birth and gender (used for health personalisation)
• Profile photo (optional)
• Billing name and address for subscription management

Health & medical data

• Symptoms, conditions, diagnoses, and medications voluntarily logged
• Vital signs, lab results, and reports uploaded
• Health goals, activity logs, and clinical observations
• Data imported from connected diagnostic devices or third-party health apps with your consent

Usage & technical data

• IP address, browser type, and device identifiers
• Pages visited, features used, and session duration
• Crash reports and performance diagnostics
• Cookies and similar tracking technologies (see our Cookie Policy)

Payment data

• Subscription plan and billing cycle
• Payment is processed by Razorpay / Stripe — we do not store full card details
• Transaction history and invoice records

How we use your data

• To provide, operate, and improve the Hospitrends HMIS platform and its features
• To personalise health insights, reminders, and clinical recommendations
• To process subscription payments and manage your account
• To send transactional emails (receipts, security alerts, service updates)
• To send marketing communications with your explicit consent — you can opt out at any time
• To comply with applicable Indian healthcare regulations, including the Digital Personal Data Protection Act, 2023 (DPDP Act)
• To detect, investigate, and prevent fraudulent or unauthorised activity
• To conduct anonymised, aggregate research for product improvement

Who we share data with

Service providers: We share data with trusted vendors who help us operate the Service — including cloud infrastructure (AWS / Google Cloud), payment processors, email providers, and analytics platforms. These vendors are bound by data processing agreements and may not use your data for their own purposes.

Healthcare professionals: If you choose to share your health record with a doctor or care team through our platform, that data is shared only with your explicit action and consent.

Legal obligations: We may disclose data if required by law, court order, or a valid regulatory request from Indian authorities.

Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you via email and/or a prominent notice before your data is transferred and becomes subject to a different privacy policy.

Data retention

We retain your personal data for as long as your account is active or as required by law. Specifically:

• Account data is retained for the duration of your subscription plus 90 days after deletion
• Health records are retained for a minimum of 3 years post-deletion to comply with applicable medical record retention laws, unless you request otherwise
• Payment records are retained for 7 years for tax and audit compliance
• Anonymised, aggregated data may be retained indefinitely for research purposes

Your rights

Under the DPDP Act, 2023 and applicable laws, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to correction — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data, subject to legal obligations
• Right to data portability — request your health data in a machine-readable format
• Right to withdraw consent — withdraw consent for health data processing at any time
• Right to grievance redressal — raise a complaint with our Data Protection Officer

To exercise any right, contact us at Info@softsysworld.com. We will respond within 30 days.

Security

We implement industry-standard technical and organisational measures to protect your data, including AES-256 encryption at rest, TLS 1.3 in transit, regular third-party security audits, multi-factor authentication, and role-based access controls. No system is perfectly secure — if you believe your account has been compromised, contact security@hospitrendshmis.in immediately.

Cookies

We use essential cookies to operate the Service and optional analytics cookies to understand usage patterns. You can manage cookie preferences in your account settings or via your browser. Disabling non-essential cookies will not affect core functionality.

Children's privacy

Our Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact Info@softsysworld.com and we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notification at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

Contact & grievance officer

© 2026 Hospitrends HMIS. All rights reserved. NABH-ready & compliant with Indian healthcare data laws.