How We Look After Your Data
HealthGridERP is used by hospitals and clinics to run their day, which means information about their teams and their patients passes through us. This page explains, in plain language, what we hold, why we hold it, and how far it travels.
1. What We Collect
We sell hospital management software to organisations, not to individuals. Almost everything we hold arrives because a hospital signed up for the platform and then used it. We split that into two very different buckets.
Details about the hospital and its people
- Facility name, registration particulars and the address you operate from.
- Names, work email addresses and mobile numbers of the admins, doctors and staff you invite.
- Subscription plan, invoices and the payment details tied to your account.
- Technical logs — sign-in times, IP addresses and audit trails of who changed what.
Patient records you enter into the system
- Demographics, visit history, appointments, clinical notes, prescriptions, lab and pharmacy entries, bills and receipts — all created by your own team.
- Contact numbers, including a WhatsApp number where the patient has agreed to be messaged there.
- For this bucket we are only the data processor. The hospital stays the data controller: it decides what goes in, who may see it, and when it comes out. We act on your instructions, not on our own initiative.
We do not buy patient lists, we do not scrape them, and we never enrich your records with data bought from anyone else.
2. Why We Use It
Every use below exists to keep your workspace running. There is no secondary purpose hiding behind them.
- Creating and running your tenant, so your data stays walled off from every other hospital on the platform.
- Charging your subscription, raising invoices and chasing failed payments.
- Answering support tickets, fixing faults and shipping updates to the product.
- Delivering the messages your staff trigger — appointment confirmations, reminders and prescription links.
- Watching infrastructure health, spotting abuse and keeping the service up.
- What we never do: sell your data, hand it to advertisers, or feed patient health information into marketing, profiling or model training.
3. WhatsApp Messaging
Hospitals on our higher plans connect their own WhatsApp Business number and let patients book appointments in a chat, then receive their prescription or receipt as a private link. Because this involves a third party — Meta — it deserves its own section rather than a footnote.
- Booking a slot. A patient messages the hospital's own number and our assistant walks them through department, doctor, date and time. To do that we briefly hold their WhatsApp number, their replies, and — for someone new — the name, gender and age they type in. The appointment that comes out is created by the same engine your receptionist uses.
- Half-finished conversations. A booking in progress is kept for roughly fifteen minutes so an interrupted patient can pick up where they left off. After that the session is wiped automatically, because the slots it was holding are no longer real.
- Prescriptions and receipts. When a consultation ends, the doctor can send the patient a message containing a private, expiring link. The document itself sits on our page, not in the chat — the message says only that it is ready. The link stops working after 30 days.
- Why a link and not the text. A WhatsApp message body is stored by Meta, copied into the patient's phone backups and shown on their lock screen. Keeping diagnosis, medicines and billing lines behind a link keeps them out of all three.
- Consent first. Clinical documents go out only to patients whose record carries an explicit WhatsApp consent flag. Without it, the send is refused outright rather than quietly downgraded.
Meta's role
Messages travel over the WhatsApp Cloud API, so Meta Platforms handles the phone number and message content in transit and under its own terms and privacy policy. We pass Meta the minimum needed to deliver a message. Anything a patient sends back reaches us through a signed webhook that we verify before acting on it.
Opting out
A patient can stop the conversation at any point with a cancel word, or ask the hospital's front desk to withdraw WhatsApp consent — which switches off future clinical messages immediately. Opting out of WhatsApp never affects care, and never blocks booking at the counter or over the phone.
5. Security & HIPAA Compliance
Healthcare data is worth more to attackers than most data, so we treat it that way.
- AES-256 encryption for stored data and TLS for everything crossing the wire.
- Role-based permissions plus strict tenant isolation, so one hospital can never read another's records.
- Credentials and API keys held encrypted, never in plain configuration.
- Independent security reviews and penetration tests on a regular cycle.
- Business Associate Agreements signed with covered entities that require one under HIPAA.
- A breach playbook that notifies affected hospitals without delay, so you can meet your own reporting duties.
No system is beyond reach. If you spot a weakness in ours, write to us at the address below and we will look at it the same day.
6. How Long We Keep It
- Live hospital and patient records stay for as long as your subscription runs.
- Cancel, and you get a window to export everything. Ninety days later it is permanently erased from our systems and backups.
- Unfinished WhatsApp booking conversations expire within minutes and are purged on a schedule.
- Prescription and receipt share links go dead after 30 days, whether or not they were opened.
- Invoices and tax records are kept for as long as Indian accounting law requires, even after an account closes.
7. Your Choices
Hospitals can reach us directly. Patients should approach the hospital that treats them, since it holds the record and we may not act on patient data without its instruction — but we will always help the hospital respond quickly.
- See it. Ask for a copy of what we hold about you or your organisation.
- Fix it. Have anything inaccurate corrected.
- Take it. Export your records in a machine-readable format at any time.
- Erase it. Ask for deletion, subject to the retention periods above.
- Say no. Withdraw WhatsApp or marketing consent without giving a reason.
We answer requests within 30 days, and we do not charge for them.
9. Updates to This Page
As the product grows, this policy will too. Small clarifications appear here with a new date at the top. Anything that materially changes how we handle your data is emailed to account admins before it takes effect, so nobody is surprised by a silent edit.
10. Reach Our Privacy Team
Questions about this policy, a data request, or a Business Associate Agreement to sign — all of it lands with the same team.