Last updated: 3 November 2026 (template)
Privacy policy
This template describes how a healthcare practice using Zygnora may collect, use, store and share personal data when providing care and running the practice.
1. Who we are
Replace this with the legal name of the practice (clinic / hospital), registered address, and a contact for privacy requests (email and postal address). Zygnora Technologies is the software provider; it is not a substitute for naming the practice as the data fiduciary.
2. Data we collect
- Identity and contact details (name, phone, email, address, date of birth, family links).
- Clinical and administrative records (appointments, MRD numbers, prescriptions, lab results, admissions, bills).
- Communications metadata (WhatsApp / SMS / email delivery status, AI receptionist call logs where enabled).
- Account and security data (sign-in events, role, device/session identifiers).
- Optional recordings only when you give separate, explicit consent.
3. Purposes
Providing healthcare and related services; booking and reminders; billing and tax compliance; security and fraud prevention; legal obligations; and improving service quality where you have consented.
4. Retention (overview)
Medical records are retained as required by clinical and legal obligations (often many years). Messaging and recording artefacts may use shorter windows (for example 90 days) unless a longer period is required. Exact periods are published in the in-app retention policy summary and must be confirmed with your counsel.
5. Your rights
Under the DPDP Act you may request access, correction, erasure (where applicable), and withdraw consent for processing that relies on consent. Medical record erasure is reviewed manually against retention and legal holds — it is never an automatic wipe. Use the in-app privacy request tools or contact the practice privacy email.
6. Sharing
Data may be shared with treating clinicians on the practice, authorised staff, payment and messaging providers you configure, and regulators when required by law. We do not sell personal data.
7. Security
Access is role-scoped; sensitive documents use private storage and signed URLs; platform secrets are encrypted at rest. No system is perfectly secure — report suspected incidents promptly.
8. Grievance
Replace with the practice’s grievance officer name, contact, and response timelines. You may also approach the Data Protection Board of India as provided by law.
9. Changes
Material changes will be posted on this page with an updated date. Continued use after notice may constitute acceptance where permitted by law.