Privacy Policy

Information We Collect

We collect information that you provide directly to us, as well as information that is automatically collected when you use the Platform.

Information You Provide:

• Account Information: When you create an account, we collect your name, email address, password, and other contact information.
• Health Information: We collect health data, such as medical history, diagnoses, medications, allergies, and other relevant information that you or your authorized healthcare provider share with us. This data is securely stored and accessible only by authorized individuals with your consent.
• Billing Information: If you use our services that require payment, we may collect your billing information, such as credit card details. This information is securely processed through trusted payment gateways.

Information We Collect Automatically:

• Usage Data: We collect information about how you interact with the Platform, such as pages visited, features used, and time spent on the site. This data is used to improve our services and provide a better user experience.
• Device Information: We collect information about your device, such as operating system, device type, and unique device identifiers. This information is used to ensure compatibility and optimize the platform's performance.

How We Use Your Information

• Provide and Improve Services: We use your information to provide and personalize the services you request, including EHR access, health data interoperability, and predictive health tools.
• Communication: We use your information to communicate with you about our services, updates, and important information.
• Security and Compliance: We use your information to protect the security of our platform, detect and prevent fraud, and comply with applicable laws and regulations.

Sharing Your Information

We may share your information with third-party service providers who assist us in providing our services, such as payment processors, data analytics providers, and customer support providers. These providers are required to protect your information in accordance with our instructions and our Privacy Policy.

We may also disclose your information if required by law, regulation, or legal process, or if we believe that disclosure is necessary to protect the rights, property, or safety of Hlthtek.com, our users, or others.

Your Choices

• Account Information: You can review and update your account information at any time.
• Health Information: You can control who has access to your health information and how it is used.
• Marketing Communications: You can opt out of receiving marketing communications from us.
• Cookies and Tracking Technologies: You can adjust your browser settings to refuse cookies or other tracking technologies.

Data Retention

Retention Principle

HLTHTek collects and processes personal data, including sensitive personal and health data, only for as long as is necessary to fulfil the purpose for which it was collected, to comply with applicable legal or regulatory obligations, or to establish, exercise, or defend legal claims. This "storage limitation" principle is applied consistently across all HLTHTek products and services — including HTMATE (EHR/clinical workflows), HTLIFE (patient-facing m-health platform), HTBRIDGE (ABDM connectivity), and HTHRP (health repository) — irrespective of which product line a Data Principal (patient, provider, or platform user) interacts with. Once the applicable retention period expires and no overriding legal ground for continued retention exists, HLTHTek will delete, destroy, or irreversibly anonymise the relevant personal data in accordance with the Data Deletion section below.

Retention Periods by Data Category

The following indicative retention periods apply. Where a specific healthcare provider, hospital, or institutional client using HLTHTek's platforms has its own longer statutory or clinical-governance retention requirement, that longer period will prevail.

• Clinical and health records (EHR entries, consultation notes, prescriptions, diagnostic and lab reports, discharge summaries, and other health information generated or stored on HTMATE, HTLIFE, or HTHRP): retained for a minimum of three (3) years from the date of the last consultation or entry, consistent with the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, and, in alignment with ABDM's proposed health-data retention norms, for up to ten (10) years from the last clinical encounter unless a longer period is mandated by the treating facility's policy or applicable law.
• Records relating to minors: retained until the minor attains the age of eighteen (18) years, or for ten (10) years from the last clinical encounter, whichever is later.
• Medico-legal records, birth and death registers, immunisation records, and clinical trial data: retained on a permanent or extended basis, or for the specific statutory period prescribed under applicable law, consistent with ABDM guidance for these categories.
• Account, profile, and identity data (including ABHA-linked identifiers, KYC/demographic details, and registration information): retained for the duration of the active account relationship, and thereafter for the period specified for the relevant class of Data Fiduciary/purpose under the DPDP Rules, 2025 (Rule 8 read with Schedule III), subject to a minimum forty-eight (48) hours' prior notice to the user before any retention-expiry erasure (see "Notice Before Retention-Based Erasure" below).
• Consent artefacts (records of consent granted, modified, or withdrawn — including consents managed through ABDM Consent Managers and in-app consent logs): retained for as long as necessary to demonstrate compliance with consent obligations, generally co-terminous with the retention period of the underlying health record to which the consent relates.
• Billing, invoicing, and financial transaction records: retained for the periods prescribed under the Income Tax Act, 1961, applicable GST legislation, and other financial/statutory regulations (typically six (6) to eight (8) years from the end of the relevant financial year).
• System, access, security, and audit logs (including consent logs, authentication, and access records): retained for a minimum of one (1) year from the date of the relevant activity, in line with Rule 8(3) read with Schedule VII of the DPDP Rules, 2025, or for a longer period where necessary for security monitoring, fraud prevention, or an ongoing investigation.
• Marketing and communication preferences: retained until the user withdraws consent or closes their account, whichever occurs first.

Grounds for Extended Retention

HLTHTek may retain personal data beyond the periods above where necessary to: (a) comply with a legal, regulatory, or court/tribunal obligation; (b) respond to an ongoing grievance, dispute, audit, or litigation; (c) prevent fraud, misuse, or a security incident; or (d) meet a contractual obligation owed to a hospital, clinic, or other institutional client operating on HLTHTek's platforms. Data retained on these grounds is restricted to the specific purpose for which it is retained and is not used for any other purpose.

Backups and Anonymised Data

Where personal data is deleted from live production systems, residual copies may continue to exist for a limited period in encrypted, access-restricted backups; these are not used for routine processing and are purged or overwritten in the ordinary course of the applicable backup rotation cycle. Data that has been irreversibly anonymised or aggregated so that it can no longer identify a Data Principal is not personal data and may be retained without reference to the periods above, including for research, quality-improvement, and public-health reporting purposes.

Periodic Review

HLTHTek reviews its data retention schedule periodically, and whenever there is a material change in applicable law (including amendments to the DPDP Act/Rules or ABDM policy) or in HLTHTek's product offerings, to ensure retention periods remain accurate, necessary, and proportionate.

Data Deletion

Right to Erasure

Consistent with the rights available to Data Principals under the DPDP Act, 2023, users of any HLTHTek product may request erasure of their personal data at any time by contacting HLTHTek through the channels specified in this Privacy Policy or the relevant product's in-app support/settings. This right applies equally to patients, healthcare providers, and other end users, regardless of which HLTHTek product line collected the data.

When Deletion Occurs

HLTHTek deletes or anonymises personal data when any of the following occurs, subject to the retention grounds described in the Data Retention section:

• The purpose for which the data was collected has been fulfilled and no further processing is required;
• The Data Principal withdraws consent and no other lawful basis or legal retention obligation applies;
• The Data Principal submits a verified deletion request;
• The applicable retention period has expired and the account/data has been inactive for the corresponding period specified under the DPDP Rules, 2025.

Notice Before Retention-Based Erasure

Where personal data is due to be erased solely because a Data Principal has not engaged with the relevant HLTHTek product to fulfil the specified purpose or exercise their rights within the applicable timeframe, HLTHTek will provide at least forty-eight (48) hours' prior notice (via SMS, email, and/or in-app notification, as applicable) before such erasure, giving the Data Principal the opportunity to log in, respond, or otherwise indicate continued interest in retaining the data.

Exceptions to Deletion

HLTHTek, or the healthcare provider/institution operating on an HLTHTek product, may decline or defer a deletion request, in whole or in part, where retention is required to: comply with a legal or regulatory obligation (including medical-records and ABDM retention norms and tax/financial-record laws); establish, exercise, or defend a legal claim; investigate fraud or a security incident; or fulfil a public-health or medico-legal reporting obligation. In such cases, HLTHTek will restrict further processing of the data (or anonymise it where feasible) and will complete deletion once the mandatory retention period expires or the applicable ground no longer applies. The Data Principal will be informed of the basis for any such exception.

Method of Deletion

Deletion is carried out through secure, irreversible removal or anonymisation of the personal data from active production systems and application databases across the relevant HLTHTek product(s). Any residual copies held in encrypted backups are purged or overwritten during the next applicable backup rotation cycle, and are not accessible for ordinary processing in the interim.

Deceased Users

A legal heir, nominee, or authorised representative of a deceased Data Principal may request deletion of the deceased person's personal data, or may exercise other applicable rights in relation to that data, in the manner specified in this Privacy Policy, subject always to the medico-legal and statutory record-retention obligations described in the Data Retention section.

Data Processors, Sub-Processors, and ABDM Ecosystem Entities

Where personal data has been shared with HLTHTek's data processors, sub-processors, or with third parties through the ABDM ecosystem (including Health Information Providers, Health Information Users, Health Information Exchanges, and ABDM Consent Managers), HLTHTek will instruct such parties to correspondingly delete or anonymise the relevant data in accordance with the applicable data-sharing agreement and consent artefact, except to the extent those parties have an independent legal obligation to retain it.

Timelines for Acting on Requests

HLTHTek acknowledges a verified deletion request within a reasonable period and completes deletion (or communicates the applicable exception above) within a reasonable period thereafter, in accordance with the timelines specified in this Privacy Policy or as required under the DPDP Act and Rules. Deletion requests are verified to confirm the identity of the requester before action is taken, in order to protect against unauthorised or fraudulent deletion requests.

Confirmation

Upon completion of a deletion request (or applicable anonymisation), HLTHTek provides written confirmation to the Data Principal, including where relevant a summary of any data retained under an exception described above and the basis for such retention.

Grievances

A Data Principal who is dissatisfied with the handling of a data retention or deletion request may raise a grievance with HLTHTek's Chief Strategy Officer / Grievance Officer / Data Protection Officer at contactus@hlthtek.com, as identified in this Privacy Policy, and thereafter, if unresolved, with the Data Protection Board of India in accordance with the DPDP Act, 2023.

Security

We take reasonable measures to protect your information from unauthorized access, disclosure, alteration, or destruction. However, no website or internet transmission is completely secure, and we cannot guarantee the security of your information.

Children's Privacy

The Platform is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under the age of 13.

Changes to this Policy

We may update this Policy from time to time. We will post any changes on the Platform and will indicate the date the Policy was last updated. You are responsible for reviewing the Policy periodically.

Contact Us

If you have any questions about this Policy, please contact us at contactus@hlthtek.com.

By accessing and using the Hlthtek.com platform, you agree to this Privacy Policy. This Privacy Policy is intended to be read in conjunction with our Terms and Conditions.