1. Who we are and what this policy covers

Panch Care ("PanchCare", "we") provides clinic management software used by doctors, clinics and hospitals in India. This policy explains how we handle personal data under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it.

We play two different roles, and which one applies decides who you should contact:

• We are the Data Fiduciary for: people who visit our website or send us an enquiry or request, and the clinic owners and staff who hold PanchCare accounts.
• We are a Data Processor for patient records. A clinic that uses PanchCare decides why and how its patients' data is processed, and is the Data Fiduciary for it. We process that data only on the clinic's instructions, to run the software for the clinic.

2. If you are a patient

Your clinic is responsible for your records. To see, correct or erase your information, withdraw consent, or raise a complaint about how it is used, contact your clinic, or use the Privacy page in the PanchCare patient portal if your clinic has given you access. Your clinic's own privacy notice applies to your records.

If you are unsure which clinic holds your data, or your clinic does not respond, you can tell us through Data Controls and we will pass your request to the clinic.

3. Personal data we collect

• Website enquiries and demo requests: your name, email address, mobile number, the type of practice you run, your message and the language of the page you used.
• Data requests made through Data Controls: your name, email address, optional mobile number, the kind of request and what you tell us about it.
• Clinic accounts: name, email address, mobile number, the clinic you belong to and your role. Your password is stored only as a one-way hash, never in readable form.
• Security records for accounts: sign-in times, IP addresses, failed sign-in attempts and an audit trail of actions taken in the software.
• Subscription billing for clinics: the plan chosen, invoices and payment status. If you pay online, you enter payment details with our payment provider; we receive a confirmation, not your card number.
• Website technical data: your language preference is remembered in a cookie so the site opens in English or Hindi. We do not use advertising or third-party analytics cookies on this website.

4. Why we use it

We process personal data with your consent, or for a legitimate use allowed by section 7 of the DPDP Act — for example when you give us information voluntarily for a specific purpose, or when the law requires us to keep it. We use it only to:

• answer your enquiry, arrange a demo and follow up about it;
• act on a data request or grievance you send us, and keep a record that we did;
• provide, secure and support clinic accounts, including the audit records that protect patient information;
• bill clinics for their subscription; and
• meet our legal obligations.

5. How we handle patient data for clinics

• We process it only to provide the software to the clinic, and only as the clinic instructs.
• Each clinic's data is kept separate from every other clinic's at the database level.
• We do not sell patient data, use it for advertising, or send it to external AI services.
• When our team needs to work inside a clinic's account to provide support, they sign in as one of its users for a stated reason and a limited time, and the session is recorded in the clinic's audit trail and ours.

6. Who we share it with

We do not sell personal data. We share it only with service providers that help us run PanchCare, and each receives only what its task needs:

• cloud hosting and storage providers;
• email delivery providers;
• SMS and WhatsApp delivery providers, when a clinic turns these messages on;
• payment providers, for subscription payments.

7. Where your data is processed

Our service providers may process data in India or in other countries. We transfer personal data outside India only where the DPDP Act permits it, and never to a country the Central Government has restricted under section 16 of the Act.

8. How long we keep it

• Enquiries: for as long as we need them to respond and follow up with you, after which they are erased, unless you become a customer.
• Clinic accounts: for as long as the account is active, and security and audit records for as long as the law requires.
• Data requests: we keep a record of each request and how it was answered, as evidence that your rights were honoured.
• Patient records: the clinic decides how long these are kept, in line with the laws on medical records that apply to it.

9. How we protect it

We use technical and organisational safeguards to protect personal data, including encryption in transit, encryption of sensitive fields at rest, per-clinic isolation, role-based access and audit logging. Our Security page describes what is in place today.

10. Your rights

Where we are the Data Fiduciary for your data, you can:

• get a summary of your personal data we process and of whom we have shared it with;
• ask us to correct, complete, update or erase it — we will keep only what the law requires us to keep;
• withdraw your consent at any time, as easily as you gave it;
• raise a grievance and have it answered; and
• nominate another person to exercise your rights if you die or cannot act.

11. How to use your rights

Use the form on our Data Controls page, or email support@panchcare.com. To protect you, we will confirm your identity before we share, change or erase anything — usually by replying to the email address we already hold for you — and we may ask for more information.

We will acknowledge your request and respond within the time limits set by the DPDP Act and its rules. If we cannot do all of what you ask, for example because the law requires us to keep a record, we will tell you why.

Withdrawing consent does not affect processing that happened before you withdrew it. If you withdraw consent we need to answer an enquiry, we will stop following it up.

12. Children

Our website and accounts are meant for adults and healthcare professionals. We do not knowingly collect children's personal data through this website. Clinics that record a child's information as a patient are responsible, as Data Fiduciary, for obtaining the consent of a parent or lawful guardian.

13. If something goes wrong

If a personal data breach affects data we are responsible for, we will inform the people affected and the Data Protection Board of India as the DPDP Rules require. If it affects data we process for a clinic, we will tell that clinic without delay so it can meet its own duties.

14. Changes to this policy

We will update this policy when our practices change. The date at the top shows when it last changed. If a change affects how we use data you gave us with consent, we will ask for your consent again where required.

15. Contact and grievances

For questions about this policy or to raise a grievance, write to support@panchcare.com or use Data Controls.

If you are not satisfied with our response to a grievance, you can complain to the Data Protection Board of India.