Privacy Policy
Effective Date: September 2026 | Platform: AyurHealthPlus
Who Operates AyurHealthPlus
AyurHealthPlus is a healthcare software platform for Ayurvedic and clinical practice management. At this stage, the service is operated prior to formal incorporation of a separate company/legal entity. The legal/operator information published on this page will be updated when the business is formally registered.
Important Distinction: Account Data vs. Patient Clinical Records
AyurHealthPlus strictly distinguishes between two categories of information:
- 1. Doctor / Clinic Account Information: Registration, profile, and billing information provided by practitioners (such as doctor name, medical qualification, registration number, phone number, login credentials, and payment receipts).
- 2. Patient Clinical / Medical Information: Health records, patient demographics, clinical symptoms, Ashtavidha Pariksha findings, diagnoses, prescriptions, treatment notes, and consultation histories entered by the attending doctor or clinic.
Doctors and clinics are solely responsible for the clinical information they enter and their lawful use of the platform. AyurHealthPlus does not own patient medical records.
1. Categories of Information Collected
We collect and process only the information necessary to provide clinic management, multi-lingual voice documentation, and electronic medical record services:
A. Doctor & Clinic Account Information
- Doctor Name, Qualification (e.g., BAMS, MD)
- Medical Registration Number
- Clinic Name & Practice Details
- Mobile Number, Email Address, Username
- Cryptographically hashed passwords (bcrypt)
- Subscription plan ID & payment transaction references
B. Patient Clinical Records (Entered by Clinic)
- Patient Name, Age, Gender, Phone, Address
- Chief Complaints & Medical History
- Ayurvedic Nadi, Mala, Mutra, Jihva (Ashtavidha Pariksha)
- Dosha, Dushya, Agni, Koshtha classifications
- Prescriptions, Anupana, Pathya/Apathya diet rules
- Panchakarma therapy sessions & appointment tokens
- Encrypted base64 document attachments / lab reports
2. Voice AI Processing & Third-Party Service Providers
AyurHealthPlus integrates external service providers to enable technical functionality. Transmitted data is strictly limited to the operational requirement:
| Provider | Functional Purpose | Data Transmitted | Operational Note |
|---|---|---|---|
| Razorpay | Subscription & Plan Checkout | Order amount, Doctor contact (mobile/email) | Payment gateway. Card and banking credentials never touch AyurHealthPlus servers. |
| Sarvam AI | Indic Speech-to-Text (Marathi, Hindi voice dictation) | Audio buffer during voice dictation | Audio transmitted via encrypted API for real-time speech transcription. |
| Groq Cloud | Speech transcription, clinical summary extraction & vision OCR | Audio recordings, consultation transcripts, prescription photos | Encrypted API calls used strictly for real-time inference and transcript generation. |
| Resend | Transactional OTP & verification emails | Doctor email address & 6-digit verification code | Transactional email delivery only. No medical records sent via Resend. |
| Google OAuth | Optional Doctor Sign-In with Google | Google account email & name token | Used strictly for verifying doctor authentication. |
| Google Analytics | Website visit statistics (public pages only) | Pages visited, approximate location, device and browser, and actions such as "Start trial" clicks | Only after the visitor accepts analytics cookies. Never runs inside the doctor app, and never receives patient, doctor or clinic records. |
3. Security & Access Safeguards
- Encryption at Rest: Case records and clinical data payloads are encrypted using AES-256-GCM prior to database persistence.
- Encryption in Transit: Communication between client browsers and servers is transmitted over HTTPS using TLS encryption.
- Multi-Tenant Isolation: Database access queries are strictly scoped by clinic owner IDs (
user_id = req.user.ownerId) to prevent cross-clinic access. - Role-Based Staff Access Control: Clinic owners can assign specific roles (Doctor, Receptionist, Therapist, Pharmacist) to restrict staff visibility into clinical vs. non-clinical operational data.
- Password Security: Passwords are cryptographically salted and hashed using bcrypt; plain-text passwords are never stored.
4. Data Retention
We retain account and clinical information for as long as necessary to provide the Service and for applicable operational, contractual, legal, regulatory, professional, security, and accounting purposes. Retention periods may vary depending on the type of information and applicable requirements. Where information is no longer required, we will take reasonable steps to delete or securely dispose of it, subject to applicable retention obligations.
5. Account & Data Deletion
Users may request deletion of their account and associated information by contacting the AyurHealthPlus support team. We may need to verify account ownership before processing a request. Some information may need to be retained where required or permitted by applicable law, regulation, professional obligations, security requirements, dispute resolution, accounting requirements, or other legitimate purposes. Where deletion is permitted, we will take reasonable steps to delete or securely dispose of the relevant information.
Within the clinical interface, doctors also have the ability to purge individual patient case files and consult histories directly.
6. Contact & Inquiries
For privacy inquiries, account questions, or data deletion requests, contact the support team:
Email: support@ayurhealthplus.in · Phone: +91 72768 90399