Privacy Policy

Effective Date: 17th August 2026 | Last Updated: 17th August 2026

This Privacy Policy explains how SGV VENTURES PRIVATE LIMITED ("Company", "we", "us", or "our") collects, processes, stores, and safeguards personal data and health-related information across the SwasthyaLink website (swasthyalink.co.in), web application (app.swasthyalink.co.in), mobile Progressive Web App (PWA), and associated APIs.

1. Legal Entity & Regulatory Scope

SwasthyaLink is owned and operated by SGV VENTURES PRIVATE LIMITED, a company incorporated under Indian law. We operate as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and comply with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules). Where health-record interoperability is enabled, we align with the Ayushman Bharat Digital Mission (ABDM) framework.

2. Categories of Data We Process

Depending on your role, we process the following categories:

Account & Identity Data: full name, verified mobile number, email address, and Google OAuth profile identifier.
Patient Health Data: date of birth, gender, blood group, emergency contact, uploaded medical histories, prescription scans, clinical notes, and medication information.
ABDM Identifiers: Ayushman Bharat Health Account (ABHA) number and ABHA address, processed strictly under explicit user authorization. We do not store raw Aadhaar numbers.
Doctor (RMP) Professional Data: medical qualifications, NMC/State Medical Council registration details, and verification status.
Pharmacy & Diagnostic Entity Data: entity name, licence details, contact person, and registration information.
Transaction & Prescription Data: prescription release requests, pharmacy quotations, dispensing and delivery records.
Communication & Chat Data: in-app message transcripts between patients, doctors, and pharmacists.
Community: feature suggestions you submit (role + text).

3. Purpose of Data Processing

Facilitating clinical encounters, teleconsultations, and AI-assisted note generation.
Verifying practitioner and pharmacy statutory registrations.
Broadcasting patient-released prescriptions to nearby licensed pharmacies for quotation.
Sending transactional notifications (appointments, prescription updates, OTP authentication).

4. Legal Grounds & Consent Under DPDP Act, 2023

Processing is grounded primarily on your explicit, informed consent (Section 5, DPDP Act 2023) and contractual necessity to deliver healthcare services. You may withdraw consent at any time via your in-app profile settings. Where you link your ABHA account, consent is captured at the point of linking.

5. Data Sharing & Disclosures

We do not sell or monetize your personal or health data. Data is shared only in these scenarios:

Care Delivery: sharing clinical information with your chosen doctor, pharmacy, or diagnostic center.
ABDM (when enabled): health-record exchange occurs under the ABDM framework with your explicit consent. Current status: ABDM integration is in sandbox/evaluation mode; production exchange is pending NHA approval.
Infrastructure Sub-Processors: hosting, transactional email/SMS, and AI processing under enterprise data-handling terms.
Legal Mandates: where disclosure is required by a court of competent jurisdiction or statutory authority.

6. AI Processing & No-Training Guarantee

SwasthyaLink uses enterprise AI services (such as Google Cloud Vertex AI) for document understanding, clinical-note assistance, and patient guidance. All AI processing is subject to enterprise privacy safeguards:

      🔒 No-Model-Retraining Guarantee: Your medical documents, queries, and clinical notes are never used to train or fine-tune general AI models. Data is processed under enterprise terms that do not use your health data for model training.
    

7. Data Residency & Technical Security Safeguards

Indian Infrastructure: personal data and health records are hosted on servers located in India (DomainRacer hosting platform), in alignment with the DPDP Act, 2023 data-localization intent.
Encryption: data is encrypted in transit using HTTPS/TLS, and at rest using the standard encryption provided by our hosting platform.
Access Controls: role-based access controls limit health-data access to authorized roles relevant to care delivery.

8. Data Retention & Erasure

Clinical & Prescription Records: retained for the period required by applicable law (medical records are commonly retained for a minimum of three (3) years).
Account Deletion: upon a verified deletion request, non-essential personal data is erased; clinical records subject to statutory retention are archived and restricted from active processing.

9. Rights of Data Principals (Section 6, DPDP Act 2023)

Right to Access a summary of your data and with whom it has been shared.
Right to Correction of inaccurate or incomplete information.
Right to Erasure of data no longer necessary.
Right to Grievance Redressal regarding privacy concerns.
Right to Nominate a person to exercise your rights in case of death or incapacity.

10. Protection of Children's Data (Section 9)

SwasthyaLink does not knowingly process minors' (under 18) personal data without verifiable parental or guardian consent. We do not engage in behavioral tracking or targeted advertising directed at minors.

11. Cookies & Storage

We use essential session storage and a signed, HTTP-only cookie (for community upvote anti-abuse). We do not use third-party advertising or cross-site tracking cookies.

12. Data Protection Desk & Grievance Officer

For questions, to exercise your DPDP rights, or to raise a privacy concern:

Data Protection & Grievance Desk
Company: SGV VENTURES PRIVATE LIMITED
Data Privacy / Grievance: privacy@swasthyalink.co.in · grievance@swasthyalink.co.in
General Inquiries: care@swasthyalink.co.in
If unresolved within the prescribed timeline, you may escalate to the Data Protection Board of India (DPB).

← Back to SwasthyaLink Home