Carexa Health Systems Pvt Ltd ("Carexa", "we") builds hospital management and electronic health record software. This notice explains what personal data we handle, why, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
There are two very different kinds of data in our world, and we treat them differently:
- Website and customer-account data — information you give us when you visit this site, book a demo or sign a contract. For this data, Carexa is the Data Fiduciary.
- Patient and clinical data — records that hospitals and clinics store in Carexa. For this data, the hospital is the Data Fiduciary and Carexa acts as its Data Processor, handling the data only on the hospital's documented instructions.
1. What we collect
- Demo and contact requests: name, role, hospital name, city, work email, phone number, hospital size and anything you write in the message box.
- Live chat and support: the name, work email and phone number (optional) you give when you start a chat, the messages you send, and the page you were on. The chat window stores a small identifier in your browser so your conversation continues if you come back.
- Newsletter: your email address.
- Job applications: your name, email, phone number, city, LinkedIn profile, CV and the note you send, and the role you applied for.
- Customer accounts: staff names, work emails, roles and sign-in activity needed to run the service and keep it secure.
- Website usage: standard logs on our web servers (IP address, browser, pages requested, time), used to keep the site secure and running.
- Analytics: we count visits with Umami, an analytics tool we run on our own servers. It sets no cookies and does not store your IP address; it records the page, the site that referred you, your browser and device type, and your country. We use no advertising or third-party tracking cookies. If we ever add analytics that need cookies, we will ask first.
- Where it is kept: demo requests, newsletter sign-ups and chat conversations are stored on servers we operate in Oracle Cloud’s Mumbai region, in India. Demo requests, people who chat with us and job applications (with CVs) are also recorded in our customer-relationship (CRM) system, which runs on the same servers.
2. Why we use it
- To respond to your demo request and follow up about Carexa.
- To answer your chat messages and support requests, and to keep a record of them so we can help you next time.
- To provide, secure, support and bill for the service under our contract with your organisation.
- To send the newsletter you subscribed to. You can unsubscribe at any time.
- To consider you for roles at Carexa when you apply, and to contact you about them. We keep general applications so we can come back to you when a role fits; you can ask us to delete yours at any time.
- To meet legal obligations, such as tax and accounting records.
We do not sell personal data, and we do not use patient data for advertising.
3. Patient data held for hospitals
When a hospital uses Carexa, its patients' data is processed only to provide the service to that hospital. Each hospital's data is isolated in its own tenant, encrypted in transit and at rest, and every clinical write is recorded in an append-only audit log. ABHA-linked sharing through the Ayushman Bharat Digital Mission happens only with the patient's consent, captured through the ABDM consent flow.
If you are a patient and want to access, correct or erase your records, please contact the hospital or clinic that treated you. We will help them respond to your request.
4. Who we share it with
We run this website, its forms, live chat, analytics and CRM on our own servers, hosted by Oracle Cloud Infrastructure in Mumbai, India. Emails sent to @carexaos.com addresses pass through Namecheap, our domain provider. For the Carexa service itself we use a small number of service providers (sub-processors), such as cloud hosting, email delivery and payment processing. They may use the data only to provide their service to us. [Link to the current sub-processor list.]
We may also disclose data where Indian law requires it, for example in response to a valid order from a court or government authority.
5. Where it is stored and for how long
Customer and patient data is hosted in India, in data centres in Mumbai. We keep website and demo-request data for as long as needed to respond to you and for [retention period] afterwards. Patient data is retained according to the hospital's instructions and applicable medical-records rules, and is returned or deleted when the contract ends.
6. Your rights under the DPDP Act
For personal data where Carexa is the Data Fiduciary, you can:
- ask for a summary of the personal data we hold about you and how we use it;
- ask us to correct, complete, update or erase it;
- withdraw consent you have given, as easily as you gave it;
- nominate another person to exercise your rights if you die or become unable to;
- raise a grievance with us and, if you are not satisfied with our response, complain to the Data Protection Board of India.
7. Grievance Officer
[Name], Grievance Officer
Carexa Health Systems Pvt Ltd, HSR Layout, Bengaluru, Karnataka, India
Email: [grievance email address]
We will acknowledge your request promptly and respond within the time required by law.
8. Security
We protect data with encryption (TLS in transit, AES-256 at rest), role-based access control, multi-factor authentication and continuous audit logging. See our Security page for details. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.
9. Changes to this notice
We will post any changes on this page and update the date at the top. For significant changes we will notify customers by email.