HomeopathyUpchar AI

1. INTRODUCTION AND SCOPE

This Privacy Policy ("Policy") governs the collection, storage, processing, and transfer of information by HOMEOPATHYUPCHAR NEXTGEN E-CLINIC SOLUTIONS PRIVATE LIMITED ("the Company", "Data Fiduciary", "we", "us", or "our"). This Policy applies to all users including medical practitioners, clinics, and students ("User", "Data Principal") accessing the HomeopathyUpchar AI platform ("Platform").

We operate as a Data Fiduciary under the Digital Personal Data Protection Act (DPDP Act), 2023. By accessing the Platform, you provide your free, specific, informed, and unconditional consent to the processing of your data as described herein.

2. DEFINITIONS

3. DATA WE COLLECT

3.1 User Registration Data (Direct Collection)

We collect essential professional identifiers to verify practitioner credentials:

• Full Name and Professional Title
• Contact Information (Mobile number and verified Email)
• Clinical Credentials (Registration Number, Specialization, Clinic Address)
• Payment Information (Processed via PCI-DSS compliant third-party gateways)

3.2 Clinical Assistant Data (Indirect/Derivative)

The Platform processes clinical parameters entered by the User. We strictly follow a Privacy-by-Design approach:

3.3 Automated Tracking & Third-Party Disclosure

To optimize service delivery and marketing, we use:

• Cookies & Identifiers: IP addresses, browser types, and device IDs.
• Meta Conversions API (CAPI): We may share hashed User identifiers (e.g., hashed email/phone) with Meta Platforms, Inc. to measure advertising effectiveness and perform retargeting. This data is cryptographically hashed before transmission.

4. PURPOSE OF PROCESSING

Data is processed for the following specified, lawful purposes:

• Execution of the User Agreement and provision of AI clinical assistance.
• Verification of professional medical status to prevent unauthorized access.
• Optimization of AI LLM (Large Language Model) outputs through anonymized feedback loops.
• Compliance with legal obligations under the Information Technology Act, 2000.

5. CLINICAL SAFETY & AI ROLE

6. DATA PRINCIPAL RIGHTS (DPDP ACT 2023)

As a Data Principal, you are entitled to the following rights:

• Right to Access: Summary of personal data being processed and the entities with whom it is shared.
• Right to Correction & Erasure: Correction of misleading or inaccurate data and erasure of data no longer necessary for the purpose.
• Right to Withdraw Consent: You may withdraw consent at any time; however, this may result in the termination of Platform access.
• Right to Grievance Redressal: Access to a formal mechanism for resolving concerns.

7. DATA RETENTION & SECURITY

We retain your data only for the duration required to fulfill the purposes of processing. Following account termination, data is either deleted or irreversibly anonymized within 180 days, unless required otherwise by law.

We employ industry-standard AES-256 encryption for data at rest and TLS 1.3 for data in transit.