Policy v1.0
Patient Privacy, Data Use & Rights
Audience: patients whose personal information or healthcare records are processed through participating clinics that use OrvexaTech Clinic OS.
Clinic OS is a multi-tenant clinic platform. Each clinic’s patient records stay in that clinic’s workspace. Platform administrators monitor operational and retention counts — not patient names, notes, or clinical content.
1. Data covered
Through participating clinics, Clinic OS may process identity and contact details, appointments, visits, clinical notes, diagnoses, prescriptions, reports, billing information, uploaded documents, and relevant security records.
2. Purposes
- Provide clinic and healthcare-management services.
- Maintain accurate clinical and operational records.
- Support appointments, OPD, prescriptions, pharmacy, and billing.
- Protect service security and integrity.
- Meet applicable legal and recordkeeping obligations.
- Use information for other purposes only with an appropriate lawful basis and transparent notice.
3. Minimization and confidentiality
We design for collecting only information reasonably necessary for the stated purpose. Patient information is not public. Access is role-based, purpose-limited, and logged inside each clinic workspace.
4. Sharing
Patient information is not disclosed to unrelated parties merely for convenience. Sharing should rely on a lawful basis, consent where required, contractual processing, or another applicable legal basis.
5. Patient rights
Subject to applicable law, patients may:
- Request information about personal data and how it is processed.
- Request correction of inaccurate information.
- Request deletion or erasure where legally available and subject to mandatory retention.
- Raise a privacy or data-protection grievance.
- Exercise additional rights where they apply (including GDPR rights where GDPR applies).
India’s DPDP Act provides Data Principal rights including access to information, correction/erasure, and grievance redressal. GDPR provides additional rights where it applies. Rights requests are handled through the treating clinic; OrvexaTech platform ops work with counts and retention controls, not patient content.
6. Security
- Encryption in transit and appropriate encryption at rest.
- Tenant isolation between clinics.
- Role-based access for clinic staff.
- Audit logging of sensitive actions.
- Secure authentication.
- Rate limiting and abuse protection.
- Private document storage for clinic uploads.
- Security testing and monitoring.
7. Incidents
Security incidents are handled through containment, evidence preservation, impact assessment, remediation, documentation, and legally required notification.
8. Children
Where children’s data is processed, clinics and Clinic OS apply the additional safeguards and consent or parental-responsibility requirements required by applicable law.
9. International benchmark
Clinic OS uses GDPR and ISO/IEC 27001 / 27701 principles as strong privacy and security benchmarks. These standards do not replace Indian law or clinic-specific legal obligations.
How to exercise rights
Contact the clinic where you received care. They control day-to-day access to your records in their Clinic OS workspace. For platform-level privacy questions about OrvexaTech Clinic OS as a service, hospitals may reach OrvexaTech through their application or account contact channels.
Information you give us on this website
This section covers people who visit orvexatech.in or apply for Clinic OS on behalf of a clinic, rather than patients.
- The application form collects the clinic’s name, type, location and region; the admin’s name, email and phone; a password for the clinic admin login; expected users and doctors; services needed; registration, certificate and issuing-authority details; and anything you add in the notes field.
- We use this to review the application, confirm the clinic’s registration, contact you about it, and create your clinic workspace if approved. The password becomes your admin login and is not used for anything else.
- Your browser stores your cookie choice and, after applying, your application tracking details so you can check your status.
- Our hosting and security provider processes technical data such as IP addresses to deliver the site and protect it from abuse. We use Google Analytics to understand how the site is used; it sets analytics cookies only if you accept optional cookies, and otherwise runs without cookies.
To ask about, correct or delete information from an application, email sales@orvexatech.in.
This page summarizes Clinic OS Patient Privacy, Data Use & Rights Policy v1.0 for public transparency. It is not legal advice. Clinics remain responsible for their own notices and consent practices under applicable law.