Privacy Policy

Careitwell (operated by AshaCareWell, also referred to as “AshaCareWell,” “we,” “us,” or “our”) is a cloud-based Hospital Management System (“Platform”) that helps healthcare providers manage patient records, appointments, billing, pharmacy, laboratory, and other operational workflows.

This Privacy Policy applies to all users of our Platform, including hospital administrators, medical staff, patients, and visitors to our website www.ashacarewell.com (collectively, “Services”). By using our Services, you agree to the practices described in this policy.

This policy is prepared in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and applicable healthcare data protection guidelines.

Under the DPDP Act 2023, we act as a Data Fiduciary for the personal data we collect and process.

We collect the following categories of personal data depending on your role and interactions with the Platform:

3.1 Account & Identity Data

• Full name, email address, phone number
• Professional credentials (for healthcare staff)
• Google account information (if you use Google Sign-In)
• Login credentials (hashed passwords, session tokens)

3.2 Patient Health Data (Sensitive Personal Data)

• Medical records, diagnoses, prescriptions, and treatment plans
• Lab results, imaging reports, and clinical notes
• Allergy information and medication history
• Date of birth, gender, blood group
• Insurance and billing information
• Emergency contact details

3.3 Hospital & Organizational Data

• Hospital name, registration number, and configuration
• Department, ward, and room information
• Staff role assignments and access permissions

3.4 Technical & Usage Data

• IP address, browser type, device information
• Login timestamps and session activity
• Feature usage analytics (via Vercel Analytics)
• Error logs and performance metrics

We process personal data for the following lawful purposes under the DPDP Act:

Under the DPDP Act 2023, we rely on the following lawful bases:

• Consent (Section 6): For collecting and processing your personal data when you register, use our Services, or enable Google Sign-In. You may withdraw consent at any time by contacting us.
• Legitimate Uses (Section 7): For processing data necessary for medical treatment or health services, performance of a contract (SaaS subscription), and compliance with applicable Indian law.
• Medical Emergency: Processing data where it is necessary to respond to a medical emergency involving a threat to the life of a Data Principal.

Our Platform offers Google Sign-In as an optional authentication method. When you choose to sign in with Google, we receive:

• Your Google account email address
• Your name (first name and last name)
• Your Google account identifier

We use this information solely for authentication and account creation. We do not access your Google Drive, Gmail, Google Calendar, contacts, or any other Google services. We do not store your Google password. Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

We implement industry-standard security measures to protect your data:

We do not sell, rent, or trade your personal data. We share data only in these circumstances:

• Subscribing Hospitals:Patient health data is shared with the hospital that manages the patient's care. Each hospital operates as a separate tenant with isolated data access.
• Infrastructure Providers: Vercel (frontend hosting), Render (backend hosting), and Aiven (database hosting) process data on our behalf under strict data processing agreements.
• Google: Only for authentication via Google Sign-In (as described in Section 6). No health data is shared with Google.
• Legal Requirements: When required by Indian law, court order, or regulatory authority.

We do not transfer personal data outside of India except through our cloud infrastructure providers, which maintain servers and data processing in compliance with applicable cross-border data transfer provisions of the DPDP Act.

• Patient Health Records:Retained as long as required by applicable Indian healthcare regulations and the subscribing hospital's retention policy (typically a minimum of 3 years after the last date of treatment, as per MCI guidelines).
• User Account Data: Retained while your account is active. Upon account deletion or hospital subscription termination, data is deleted or anonymized within 90 days, unless retention is required by law.
• Audit Logs: Retained for a minimum of 1 year for security and compliance purposes.
• Analytics Data: Aggregated and anonymized analytics data may be retained indefinitely as it cannot identify individuals.

As a Data Principal under the DPDP Act 2023, you have the following rights:

To exercise any of these rights, please contact us at privacy@ashacarewell.com.

Our Platform may process health data of minors (children under 18) as part of hospital patient management. Such data is processed only with the consent of the parent or lawful guardian, in compliance with Section 9 of the DPDP Act. We do not knowingly collect personal data from children for marketing purposes or behavioral tracking.

We use the following cookies and similar technologies:

• Essential Cookies: Session cookies required for authentication and security (NextAuth session token). These cannot be disabled.
• Analytics: Vercel Analytics and Speed Insights for aggregated performance monitoring. No personal health data is included in analytics.

We do not use advertising cookies, behavioral tracking, or retargeting technologies.

In the event of a personal data breach, we will:

• Notify the Data Protection Board of India as required under the DPDP Act.
• Notify affected Data Principals (users) without unreasonable delay.
• Take immediate steps to contain and remediate the breach.
• Maintain a breach register documenting all incidents and corrective actions.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy.
• Provide notice through our Platform or via email for significant changes.
• Obtain fresh consent where required by the DPDP Act.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India as established under the DPDP Act 2023.