Privacy Policy

1. Introduction

Welcome to Carex Healthcare ("Carex Healthcare", "we", "our", or "us").

This Privacy Policy explains how we collect, use, process, store, disclose, and protect personal information when you use our Patient Management System mobile application ("App") available on Android and iOS devices.

The App is designed to support healthcare-related activities, including patient registration, appointment management, doctor/patient interactions, medical information management, notifications, and related healthcare administrative services.

By accessing or using the App, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

Depending on how you use the App, we may collect the following categories of information.

a. Account and Authentication Information

The App may not provide public self-registration. Users may be provided with authorized credentials by ZYRON HEALTHCARE PRIVATE LIMITED or an authorized healthcare organization.

We may collect:

• Name
• Mobile number
• Email address
• User ID
• Login/authentication information
• User role, such as patient, doctor, staff, or administrator
• Organization/clinic information

We do not intend to collect or store your password in plain-text form.

b. Patient Information

When the App is used for patient management, we may collect information necessary to provide healthcare and administrative services, including:

• Patient name
• Date of birth or age
• Gender
• Mobile number
• Email address
• Residential/city information
• Emergency contact information
• Patient identification/reference number
• Appointment information
• Doctor/healthcare provider information

c. Health and Medical Information

Depending on the features enabled by the healthcare provider, the App may process information relating to a patient's health and healthcare services, such as:

• Medical history
• Symptoms and complaints
• Diagnosis information
• Prescriptions
• Treatment information
• Allergies
• Laboratory/test information
• Vital signs
• Clinical notes
• Medical reports
• Follow-up information
• Other information entered by an authorized healthcare professional

Health and medical information is treated as sensitive personal information and is processed only for legitimate healthcare, administrative, legal, or other permitted purposes.

d. Appointment and Communication Information

We may collect information relating to:

• Appointment dates and times
• Appointment status
• Doctor/clinic details
• Consultation-related information
• Messages or communications submitted through the App
• Notification preferences

e. Device and Technical Information

When you use the App, certain technical information may be processed, including:

• Device type
• Operating system
• App version
• Device identifiers
• IP address
• Firebase Cloud Messaging (FCM) device token
• Crash and diagnostic information
• Application performance information

This information may be used to maintain security, improve performance, and deliver notifications.

f. Information You Provide to Us

We may also process any information that you voluntarily submit through forms, support requests, feedback, or other App features.

3. How We Use Personal Information

We may use personal information for the following purposes:

• To create and manage user accounts
• To authenticate authorized users
• To manage patients and healthcare providers
• To schedule and manage appointments
• To maintain patient healthcare records
• To support consultations and healthcare services
• To provide prescriptions, reports, and treatment-related information
• To send appointment reminders and service notifications
• To communicate important healthcare or administrative information
• To maintain and improve the App
• To detect and prevent unauthorized access, fraud, misuse, or security incidents
• To maintain audit and activity logs
• To comply with applicable legal and regulatory obligations
• To respond to user requests and support queries

We will not use personal information for purposes that are incompatible with the purpose for which it was collected, except where permitted or required by applicable law.

4. Consent and Lawful Processing

Where required under applicable law, we will obtain appropriate consent before processing personal information.

Users may have the right to withdraw consent for processing activities based on consent. Withdrawal of consent may affect our ability to provide certain App features or services where such processing is necessary.

Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

5. Healthcare Information

Healthcare and medical information requires additional protection.

Access to patient information within the App may be restricted according to the user's role and authorization.

For example:

• Patients may access information associated with their account.
• Doctors may access patient information required for authorized healthcare services.
• Staff may access information necessary for their assigned administrative responsibilities.
• Administrators may have access based on their assigned permissions.

Users must not access, copy, disclose, or use patient information beyond their authorized responsibilities.

6. Data Sharing and Disclosure

We do not sell or rent personal information.

Personal information may be disclosed only where necessary and permitted, including:

• To authorized healthcare professionals
• To authorized healthcare organizations or clinics
• To service providers supporting the operation of the App
• To technology, hosting, communication, notification, or infrastructure providers
• Where necessary to provide requested healthcare or administrative services
• Where required by applicable law, court order, government authority, or regulatory requirement
• Where necessary to protect the security, rights, or safety of users or the organization

Third-party service providers are expected to process information only for authorized purposes and subject to appropriate contractual or security safeguards.

7. Third-Party Services

The App may use third-party technologies and service providers to provide functionality, security, hosting, analytics, notifications, or other services.

For example, we may use Google Firebase, including Firebase Cloud Messaging (FCM), to deliver push notifications.

Third-party providers may process certain technical information according to their own privacy policies and applicable terms.

Where applicable, users should also review the privacy policies of relevant third-party service providers.

8. Push Notifications

The App may send push notifications relating to:

• Appointment reminders
• Appointment status
• Healthcare service updates
• Important account notifications
• Administrative communications

Push notifications may use a device-specific notification token.

Users may manage notification permissions through their device settings. Disabling notifications may prevent certain alerts from being delivered.

9. Data Security

We implement reasonable technical and organizational security measures designed to protect personal information against:

• Unauthorized access
• Unauthorized disclosure
• Accidental loss
• Alteration
• Destruction
• Misuse

Security measures may include:

• Encryption of data during transmission
• Secure authentication mechanisms
• Role-based access control
• Access restrictions
• Secure server infrastructure
• Logging and monitoring
• Regular security assessments where appropriate
• Backup and recovery mechanisms

However, no electronic system or method of transmission can be guaranteed to be completely secure.

10. Access Control and Confidentiality

Access to patient and healthcare information is provided based on authorization and role.

We expect healthcare professionals, employees, contractors, and service providers with access to personal information to maintain appropriate confidentiality and use the information only for authorized purposes.

Users are responsible for keeping their authentication credentials and devices secure and must immediately report suspected unauthorized access.

11. Data Retention

We retain personal information only for as long as reasonably necessary to:

• Provide healthcare and App services
• Maintain healthcare and administrative records
• Meet contractual obligations
• Resolve disputes
• Maintain security and audit records
• Comply with applicable legal, regulatory, accounting, or reporting requirements

Different categories of information may have different retention periods depending on their purpose and applicable legal requirements.

When information is no longer required, we will take reasonable steps to securely delete, anonymize, or otherwise dispose of it, subject to applicable legal retention requirements.

12. Data Storage and Processing

Personal information may be stored and processed on secure servers and infrastructure operated by us or our authorized service providers.

Where personal information is transferred or processed outside India, such transfer will be carried out in accordance with applicable Indian data protection and other applicable legal requirements.

13. User Rights

Subject to applicable law and verification requirements, users may have rights relating to their personal information, including:

• Right to access information held about them
• Right to request correction of inaccurate information
• Right to request deletion where legally applicable
• Right to withdraw consent where processing is based on consent
• Right to raise a grievance regarding processing of personal information
• Right to obtain information about the processing of their personal information

Requests may be subject to legal, security, medical-record, or other applicable limitations.

14. Correction and Updating of Information

Users should ensure that information provided to the App is accurate and up to date.

If you identify inaccurate or incomplete information, you may contact us or the authorized healthcare organization responsible for the relevant record.

We may require reasonable verification before making changes to personal information.

15. Data Breach and Security Incidents

If we become aware of a personal data breach affecting personal information, we will take appropriate steps to:

• Investigate and contain the incident
• Assess the impact
• Take corrective and preventive measures
• Notify affected parties or authorities where required by applicable law

16. Children's Privacy

The App may be used to manage healthcare information relating to children where such use is part of legitimate healthcare services.

Where personal information of a child is processed, appropriate consent, authorization, and safeguards will be applied as required under applicable law.

The App is not intended to enable children to independently create accounts or provide personal information without appropriate authorization.

17. Cookies and Similar Technologies

The mobile application may use device identifiers, SDKs, local storage, or similar technologies necessary for authentication, security, functionality, diagnostics, notifications, and application performance.

Where analytics or similar technologies are used, they will be implemented in accordance with applicable privacy requirements.

18. Grievance Redressal

If you have any questions, concerns, complaints, or requests relating to your personal information or this Privacy Policy, you may contact our designated privacy/grievance contact.

We will make reasonable efforts to address privacy-related concerns within the timelines prescribed by applicable law.

19. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in:

• The App
• Our services
• Data processing practices
• Applicable laws and regulations
• Security requirements

When changes are made, we will update the "Last Updated" date.

Where required, we may provide additional notice or obtain consent before implementing material changes.

20. Contact Us

If you have questions about this Privacy Policy or our handling of personal information, please contact: