Privacy Policy

1. Who We Are

ShylCare is a cloud-based Electronic Medical Records (EMR) and Hospital Management platform developed and operated by Shylzora Technologies, based in 3rd Floor, 301, Ackruti Star, Central Road, Marol MIDC, Near Marol Telephone Exchange, Andheri (E), Mumbai – 400093.

For the purposes of the Digital Personal Data Protection Act, 2023 (DPDPA), Shylzora Technologies is a Data Processor when processing patient health data on behalf of a healthcare facility (the Data Fiduciary). We are a Data Fiduciary in our own right when processing the personal data of website visitors, trial users, and staff who register directly with us.

2. Data We Collect

a) Data you or your facility provides

• Account registration: Name, designation, email address, phone number, hospital or clinic name, address, GST number, and subscription plan details.
• Patient records (entered by healthcare facility staff): Patient name, date of birth, gender, UHID, contact details, medical history, diagnoses (ICD codes), prescriptions, lab and radiology orders and results, vital signs, allergies, surgical and hospitalisation history, discharge summaries, and billing information including insurance and government scheme details.
• Consultation audio and transcripts: If a doctor enables the optional "AI Scribe" feature during your visit, your consultation is recorded and transcribed to help draft clinical notes. This is enabled per-visit by the treating doctor, who is responsible for informing you and obtaining your consent before recording.
• External health records (ABDM): With your explicit approval — given directly through the government ABHA mobile app, not through ShylCare — a treating doctor may retrieve your prior health records from other healthcare providers via India's Ayushman Bharat Digital Mission (ABDM) health data exchange.
• Ratings & feedback: Star ratings and written comments you submit about hospitals and doctors through the patient app.
• Payment information: For subscription billing and patient-app payments — GST invoice details, payment reference numbers. We do not store full card numbers; payment transactions are processed through trusted payment gateways.
• Support communications: Messages sent via WhatsApp support, in-app chat, or email for support requests.
• Demo and enquiry forms: Name, hospital name, phone, email, and city provided when booking a demo or contacting us.

b) Data from the ShylCare Patient App specifically

• Location: With your permission, your device's GPS location, used only to show nearby hospitals and branches. You can deny or revoke this permission at any time in your device settings; the app falls back to name-based search.
• Camera and photos: Used only when you choose to upload a profile photo or a document (e.g. an insurance card or referral letter).
• Push notification token: A device identifier issued by Google (Firebase Cloud Messaging) used to deliver appointment reminders and other notifications to your device.
• Wearable and fitness data (Health Connect): If you choose to connect a fitness tracker or wearable (e.g. Fitbit, Samsung Health, Garmin) via Google Health Connect, we read daily aggregates you explicitly authorise — such as step count, resting heart rate, sleep duration, and weight — to show trends and flag irregularities worth discussing with your doctor. This is entirely opt-in, per data type, and only ever tied to your own account — never to a family member profile you manage. You can disconnect this at any time in your device's Health Connect settings.

c) Data collected automatically

• Usage logs: Pages visited, features used, timestamps, session duration, and actions performed within the platform (for security auditing and product improvement).
• Device and browser information: IP address, browser type and version, operating system, screen resolution, and referring URL.
• Error and crash reports: Anonymised diagnostic data to help us identify and fix bugs.

d) Data from third parties

If you sign in using Google (for the ShylCare patient app), we receive your name and email address from Google, subject to Google's privacy policy. We do not receive or store your Google password.

3. How We Use Your Data

We use the data collected for the following purposes:

We do not use patient health data for advertising, profiling, or any commercial purpose beyond operating the platform on behalf of the healthcare facility.

4. Sharing & Sub-processors

We do not sell your personal data. We share data only with trusted service providers ("sub-processors") necessary to deliver the platform:

Number masking for pharmacy/lab orders: When a partner pharmacy, lab, or delivery staff member needs to reach you about an order, calls are routed through an IVR masking number rather than your real mobile number. Your actual number is never disclosed to the partner or delivery staff — only your delivery address and order details are shared, as needed to fulfil the order.

Cross-border transfer (AI features): When an authorised user or patient invokes an AI-assisted feature — AI discharge summary, AI prescription assistance, AI Scribe transcription, patient report explanations, symptom triage, or wearable-data insights — the limited clinical text (or, for AI Scribe, audio/transcript) involved is sent to Anthropic, Google (Gemini API), or Deepgram solely to generate the requested output. None of these providers store the data beyond processing the individual request. Each transfer occurs only when the relevant feature has been opted into — by a healthcare facility, or by you directly for patient-app-only features. We maintain data processing terms with each provider.

Infrastructure note: The ShylCare API server runs on a DigitalOcean Droplet in Bangalore. Patient records are stored in MongoDB Atlas (Mumbai). Uploaded files and generated PDFs are stored on Amazon S3 (Mumbai). Apps are served via Google Firebase Hosting/Cloud Messaging. All data storage locations are within India except for the opt-in AI providers above (Anthropic, Google Gemini API, Deepgram — USA) and WhatsApp message delivery (Meta — global). Health records retrieved via ABDM stay within India, routed through the government's own ABDM Gateway infrastructure.

We may disclose personal data if required by law, court order, or a regulatory authority in India. We will notify you of such requests where legally permitted to do so.

5. Patient Data

Patient health data entered into ShylCare by a healthcare facility is among the most sensitive personal data we process. We handle it with the following commitments:

• Ownership: The healthcare facility owns all patient data it enters. We act solely as a processor on its instructions.
• Purpose limitation: We process patient data only to provide the platform to the facility — never for advertising, research (beyond anonymised, aggregated product analytics), or any other commercial use.
• Isolation: Each facility's data is held in a separate Tenant with strict access controls; no facility can access another's patient records.
• Staff access: ShylCare engineers and support staff access patient data only when strictly required to investigate a support issue, and only with the minimum necessary access. Such access is logged.
• Consent responsibility: The healthcare facility is responsible for obtaining valid consent from patients for the collection and processing of their health data and for operating in compliance with applicable healthcare regulations.

Patients who wish to access, correct, or delete their health records should contact the healthcare facility that collected the data. We will assist the facility in fulfilling such requests upon its instruction.

Data you generate directly through the patient app — location used for hospital search, wearable/fitness data connected via Health Connect, ratings and feedback you submit — is different: you control it directly. You can disconnect Health Connect, deny location access, or request deletion of this data at any time by contacting us at the email in Section 13, without needing to go through a healthcare facility.

6. Cookies

This website and the ShylCare platform use cookies and similar technologies for the following purposes:

• Essential cookies: Required for the platform to function — e.g., authentication session tokens and CSRF protection. These cannot be disabled.
• Preference cookies: Remember your language or UI preferences (if applicable).
• Analytics cookies: Help us understand how pages are used (e.g., page load times, errors). We use anonymised, aggregated analytics only. We do not use third-party advertising cookies.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in to the platform. This website does not serve third-party advertising or social media tracking cookies.

7. Data Localisation

All patient and facility data is stored on servers physically located in India: the API server on DigitalOcean (Bangalore), the database on MongoDB Atlas (Mumbai), and uploaded files on Amazon S3 (Mumbai). Apps are served via Google Firebase. We do not transfer patient health data outside India except as described in Section 4 (Anthropic, Google Gemini API, Deepgram — AI features only, opt-in; and Meta, for WhatsApp message delivery). Health records exchanged via ABDM (Section 2) are routed entirely within India's government health data infrastructure.

This is consistent with our commitment to comply with Indian data localisation requirements for sensitive personal data, including health data.

8. Data Retention

• Active subscription: Patient records and facility data are retained for the duration of the subscription.
• Post-termination: After a subscription ends, data is retained for 30 days during which the facility may request a data export. Production data is then deleted within 60 days; backup copies within 90 days.
• Legal retention: We may retain certain data (e.g., billing records) for periods required by Indian tax law (typically 8 years) or other regulatory obligations.
• Website enquiry data: Retained for up to 2 years or until you request deletion.
• Audit logs: Retained for 2 years for security and compliance purposes.

9. Security

We implement industry-standard technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access control with least-privilege principles
• Passwords hashed using bcrypt; no plaintext storage
• JWT-based authentication with short-lived tokens and rotation
• Comprehensive audit logging of all data access and modifications
• Automated daily backups with 30-day retention and point-in-time recovery
• Multi-factor authentication for administrative access
• Regular vulnerability assessments and security patching

No system is completely secure. In the event of a data breach, we will notify affected healthcare facilities within 72 hours and cooperate with them in meeting regulatory notification obligations under the DPDPA.

10. Your Rights Under the DPDPA

Under the Digital Personal Data Protection Act, 2023, you (as a Data Principal) have the following rights in respect of your personal data:

• Right of access: Request a summary of the personal data we hold about you and the purposes for which it is processed.
• Right of correction and erasure: Request correction of inaccurate or outdated personal data, or erasure of personal data where the purpose for which it was collected no longer exists and there is no legal obligation to retain it.
• Right to grievance redressal: Have your grievances addressed in a timely manner.
• Right to nominate: Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Right to withdraw consent: Where processing is based on your consent, withdraw that consent at any time (this does not affect the lawfulness of prior processing).

For patients: To exercise your rights over your health records held in ShylCare, please contact the hospital or clinic that registered you — they are the Data Fiduciary responsible for your health data.

For website visitors, staff accounts, and demo enquiries: Contact us directly at the email below. We will respond within 30 days.

11. Children's Data

ShylCare processes health records of patients of all ages as part of its healthcare management function. Children are registered in the platform by a healthcare facility on behalf of their parent or legal guardian, who is responsible for providing consent.

This website is not directed at children. We do not knowingly collect personal data directly from children under 18 through this website. If you believe a child has submitted personal data to us directly via this website without parental consent, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or the Platform. Material changes will be communicated to healthcare facilities via email at least 30 days before taking effect.

The "Last updated" date at the top of this page indicates when the current version was published. Continued use of the Platform after the effective date of changes constitutes acceptance of the updated policy.

13. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection contact:

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India once it is constituted and operational under the DPDPA.