Privacy Policy

1. Scope

This Privacy Policy explains how Eidara HealthCare Private Limited ("Eidara", "we", "us") handles personal data in connection with the Eidara application, website, and related services (the "Service"). It covers data about the people who use Eidara directly — clinic owners and staff — and the patient data that clinics process through Eidara.

It sits alongside our Terms of Service and our Security page, which describes where data lives and what we do not do with it.

2. The data we handle

We handle three broad categories of data:

• Account data — names, work email addresses, and login details of the clinic staff who use Eidara.
• Clinic operational data — appointments, payments, collection records, and utilisation figures that a clinic connects or enters.
• Patient data — information about a clinic's patients (such as appointment and billing records, and documents like X-rays or reports) that the clinic chooses to process through Eidara.

3. Controller and processor roles

For account data, Eidara acts as the data controller. For patient data, the clinic is the controller and Eidara acts as its processor — we handle patient data only on the clinic's documented instructions, to provide the Service. Clinics remain responsible for having a lawful basis to collect and share their patients' data with us.

4. How we use data

We use data to:

• Provide the Service — computing collection rates, no-show costs, utilisation, and reports.
• Operate and secure your account, and provide support when you contact us.
• Improve reliability and fix problems, using operational and diagnostic information.
• Meet legal, tax, and regulatory obligations that apply to us.

5. What we do not do

We do not sell patient data. We do not share it with advertisers. We do not use one customer's patient data to train models for another customer. Patient data exists in Eidara to run that clinic — nothing else.

6. Where data is stored

Clinic and patient data is stored in India. Patient documents such as X-rays, reports, and prescriptions are held in Cloudflare R2, not on exposed public storage. Our data handling is aligned to the Digital Personal Data Protection (DPDP) Act, 2023. Where a certification is in progress rather than held, we say so plainly on our Security page rather than implying more than is true.

7. Sub-processors

We use a small number of trusted infrastructure and service providers (for example, hosting and document storage) to run Eidara. These providers process data only to support the Service and are bound by confidentiality and data-protection obligations. We do not add sub-processors that would use your data for their own purposes.

8. Retention

We keep personal data for as long as your account is active and the Service is provided, and for a reasonable period afterwards to meet legal, accounting, and security obligations. On termination, you may request an export of your data within a reasonable window, after which we delete or anonymise it in line with these practices.

9. Your rights

Depending on the law that applies to you, you may have rights to access, correct, or delete personal data, to withdraw consent, and to raise a grievance about how your data is handled. Patients should direct requests about their own data to their clinic, which acts as the controller; we support clinics in responding to those requests.

To exercise a right relating to data for which Eidara is the controller, contact us via the contact page and we will respond within a reasonable time.

10. Cookies and analytics

Our website may use a minimal set of cookies and privacy-respecting analytics to keep the site working and understand aggregate usage. We do not use them to build advertising profiles of visitors.

11. Children's data

Eidara is a business tool for clinics and is not directed at children. Where a clinic processes a minor patient's data through Eidara, the clinic is responsible for obtaining any consent the law requires.

12. Changes to this policy

We may update this policy as the Service and the law evolve. When we make material changes, we update the date at the top of this page and, where appropriate, notify you. The current version always governs.

13. Contact and grievances

For any question about this policy, or to raise a grievance about how your data is handled, reach us through the contact page. We read every message and respond directly.