Privacy policy
1. Who we are
Vitalis is an electronic medical records service for clinics, operated by Mahima Kollebailu Raghavendra, Care Speciality Clinic, Above Sakhi Gynocare, 23rd Main, 7th Cross, HSR Layout, Bengaluru, Karnataka 560102, India. Each doctor who registers an account runs their own independent clinic data space and acts as the data fiduciary for their patients' data. We process that data for the doctor, to provide the service, and do not use it for our own purposes.
2. What data we hold
- Doctor and clinic: name, email, phone, clinic name and address, registration number, and the verification document you upload.
- Patients: name, date of birth, sex, phone, address, blood group, parent or guardian name for children, and the consent record.
- Health records: visits, diagnoses, prescriptions, vaccinations, growth, pregnancy and fertility records, lab reports and information patients enter in the pre-visit form.
- Billing: invoices and payments recorded by the clinic. For subscriptions, our payment partner Cashfree handles card, UPI and bank details. We never see or store those details.
- Technical: a sign-in session, and a copy of records stored in your browser so pages open quickly.
3. Why we use it
Only to provide outpatient record keeping: storing records, producing prescriptions and bills, scheduling, and sending links that the doctor chooses to share. We do not sell data, show advertising, or use health data to train AI models.
4. Consent
Patient data is entered on the basis of the patient's consent (or a parent or guardian's consent for a child), recorded by the doctor with a date. A patient can withdraw consent, and the doctor's record shows it.
5. Who else handles data
- Supabase: database, sign-in and file storage.
- Google: only if you choose “Continue with Google” to sign in. Google tells us your name and email address; we do not get access to your Gmail, Drive or contacts.
- Netlify: hosting of the website.
- Cashfree: subscription payments.
- Zoho Mail: our support email.
Data is encrypted in transit (HTTPS). Only the doctor's account and the reception logins the doctor creates can see a clinic's records. Passwords are stored hashed.
6. Your rights
As a data principal (or the guardian of a child) you can ask to access your data, correct it, erase it, withdraw consent, or raise a grievance. Email support@vitalisemr.com. We respond within 48 hours. Requests about a patient's record are also handled with the treating doctor, who holds that record. Our Data Protection Officer is named in section 10.
7. How long we keep it
Medical records are retained for a minimum of 7 years from the date of the last visit, as required by Indian medical regulations. A request to erase data is subject to this statutory retention period. When an account is deleted, its data is removed within 30 days. Activity logs are kept for one year. Backups are kept for a limited period for recovery.
8. Cookies and tracking
We do not use tracking, advertising or analytics cookies. The sign-in session and the local copy of records are stored in your browser only to make the service work, and are cleared when you sign out.
9. Children
Records about children are entered by a doctor with a parent or guardian's consent. We do not offer the service to children directly.
10. Data Protection Officer and grievance officer
Data Protection Officer and Grievance Officer: Dr. Shruthi Rai, shruthi.rai@gmail.com. For all data requests (access, correction, erasure, consent withdrawal, grievances) you can email her directly or write to support@vitalisemr.com. We aim to respond within 48 hours.
Operator: Mahima Kollebailu Raghavendra, Care Speciality Clinic, Above Sakhi Gynocare, 23rd Main, 7th Cross, HSR Layout, Bengaluru, Karnataka 560102, India. Phone +91 99804 78898.
11. Changes
We will post any change to this policy here with its date, and tell clinics in the app or by email if the change is material.