Privacy Policy

• Your account and the demo. For the details you give us yourself (demo form, signup, staff invites), we decide how they are used, so we are responsible for them (the "Data Fiduciary").
• Patient records. Records a clinic enters about its patients belong to that clinic. The clinic is the Data Fiduciary; we process them only to run AyCare for the clinic (a "Data Processor"), as set out in the data processing terms in our Terms of Service. If you are a patient, please contact your clinic first about your records; we will help the clinic answer you.

When you try the demo:

• your name, mobile number, clinic name and type of practice;
• how you reached us (the referring website and any campaign tags in the link);
• a one-way scrambled form of your network (IP) address, used only to limit how many demos one network can open; we remove it after 2 days;
• an anonymous sign-in for each device you open the demo on.

When you sign up or join a clinic: your name, email address, mobile number and password (stored only in scrambled form by our sign-in provider), and for the clinic its name, type, address, GSTIN, registration numbers, logo, documents you upload and the plan you choose. We also record when you accepted this policy and the Terms, and which version.

When a clinic uses AyCare: everything its staff enter, including patients' names, contact details, date of birth and gender; health records such as case sheets, vitals, Prakriti, diagnoses, allergies, test results, prescriptions, therapies and inpatient stays; and bills, payments, stock and accounts. Every change is recorded in an audit log showing who changed what and when.

Technical data: sign-in cookies that keep you logged in (needed for the service to work), and the request logs our hosting providers keep to run and protect their systems. We do not use advertising or analytics trackers, and we do not sell personal data.

• to run your demo clinic or your clinic's account, and the features your plan includes;
• to verify a new clinic, contact you about activation and payment, and send account emails such as sign-up confirmation and password reset;
• to follow up on a demo you opened, by phone, email or WhatsApp; tell us any time if you would rather we did not;
• to keep AyCare secure, prevent abuse, fix problems and answer support requests;
• to meet legal duties, such as keeping tax records.

We do not use patient records for our own purposes, such as marketing or building products for others.

A patient has one record across AyCare. When a clinic registers a patient with the same mobile number, name and date of birth as an existing record, AyCare uses that record instead of creating a second one. The patient's allergies, chronic conditions, regular medications and Prakriti are then visible to every clinic that treats them, so that a doctor can see, for example, a known drug allergy. Prakriti entries made at another clinic do not show that doctor's name.

Everything else stays with the clinic that recorded it: visits, case sheets, prescriptions, test results, therapies, inpatient stays, bills and payments. A clinic with several branches sees its patients across all of its own branches.

We use these service providers to run AyCare. They act on our instructions only:

• Supabase: database, sign-in and file storage. Your data and files are stored in Supabase's Mumbai, India region.
• Vercel: hosts the website and app pages. Pages may be delivered from servers outside India; the data you see on them comes from the Mumbai database.
• Hostinger: sends our account emails from contact@paperbird.in.

We share personal data with others only when the law requires it (for example, a lawful order from a court or government authority), or to protect people's safety or our legal rights. If Ebnone Technologies LLP is merged or sold, data would pass to the new owner under this same policy, and we would tell clinics first.

• Demo clinics, with the sample data and anything you entered in them, are deleted 7 days after they open. The anonymous device sign-ins are deleted with them.
• The details from the demo form (name, mobile, clinic name) are kept as a sales enquiry until you ask us to delete them.
• A clinic's data is kept while its subscription is active. If the subscription lapses, the clinic can still view and print its records but cannot add or change them, until it renews.
• We work for the clinic, so we never delete a clinic's records on our own. Patient records are medical records the clinic must keep, and they stay available to the clinic even after its account ends. The clinic can ask us for a full copy at any time. We delete clinic records only on the clinic owner's written instruction, and only where the law allows the clinic to delete them.

• All traffic is encrypted (HTTPS), and data is encrypted at rest by our database provider.
• Each staff member sees only the pages their role allows, and the database itself refuses requests from outside the clinic.
• Uploaded files are stored privately and opened only through short-lived links.
• The audit log records every change to clinic records.
• Only a small number of our staff can reach production systems, and only to run and support the service.

If a breach affects personal data, we will tell the affected clinics without delay, so that they and we can inform the Data Protection Board of India and the people affected, as the law requires.

You can ask us for a summary of the personal data we hold about you, ask us to correct or complete it, ask us to delete it, withdraw your consent, or nominate someone to act for you if you die or cannot act yourself. Withdrawing consent does not affect anything done before it, and we may need to close an account if we can no longer process the data it needs.

For patient records, the clinic decides. Send your request to the clinic; if you write to us, we will pass it on to the clinic and help it respond.

We reply within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

AyCare accounts are for adults (18 or over). Clinics may record children as patients; the clinic is responsible for having a parent's or guardian's consent to do so.

When we change this policy we update the version and date at the top of this page. The demo, signup and invite forms show the current version and record which one you accepted. For important changes we will also email clinic owners before the change takes effect.

For any question, request or complaint about privacy, contact our Grievance Officer:

• Email: contact@paperbird.in
• Grievance Officer: Muhammed Naseeb S
• Registered office: Ebnone Technologies LLP, Perumpuzha P.O., Kollam, Kerala 691504
• Thiruvananthapuram office: Ebnone Technologies LLP, Chadiyara, Poojapura P.O., Thiruvananthapuram, Kerala 695012