Privacy Policy

1. Data we collect

Account data: name, email, phone, organisation, and role.

Clinical data (healthcare): patient records, appointment history, prescriptions, and consultation notes entered by clinics using the Service. This data is owned by the clinic ("Customer Data") and processed on their behalf.

Usage data: log entries, device type, IP address, timestamps, and feature interactions.

Communications: SMS OTP codes and push notifications for appointment reminders and prescription delivery.

2. How we use it

• To provide the Service (authentication, core functionality).
• To support our customers (troubleshooting, account management).
• To improve the Service via aggregate analytics — never tied back to identifiable users in marketing materials.
• To meet legal obligations.

We do not sell personal data. We do not use Customer Data to train third-party AI models without explicit written consent.

3. How we share it

• Sub-processors: a current list lives at atrivextech.com.
• Legal: when required by law, with notice to the customer where we are permitted to give it.
• Business transfers: in the event of a merger or acquisition, with notice.

4. Healthcare data (HIPAA)

DoctorLync is a healthcare application. Clinical data (Protected Health Information / PHI) is handled under a Business Associate Agreement (BAA) with each clinic. PHI is encrypted in transit (TLS 1.2+) and at rest. Access is role-based and every PHI read is audit-logged. Backup retention is a minimum of 30 days; healthcare records are retained for 6 years in line with US healthcare record-retention norms.

5. International transfers

Customer data is stored in the region selected at signup. Cross-region transfers use Standard Contractual Clauses (SCCs) or equivalent.

6. Retention

• Active accounts: data is kept as long as the account is active.
• Closed accounts: Customer Data is deleted within 30 days of account closure, except where law requires longer retention.
• Backups: rotated within 30 days.

7. Your rights

You can:

• Access your data (export from Settings → Account, or email support@atrivextech.com).
• Correct your data (Settings → Account).
• Delete your account (Settings → Account → Delete Account).
• Object to processing or restrict processing (email support@atrivextech.com).
• Lodge a complaint with your local data-protection authority.

We respond within 30 days.

8. Security

We use TLS 1.2+ in transit, encryption at rest, role-based access controls, MFA for admin roles, audit logging, and regular security reviews. Report vulnerabilities to support@atrivextech.com.

9. Children

The Service is not directed at children under 13 (or 16 in the EU). Patients under 18 are managed through a clinic account held by an adult healthcare provider.

10. Changes

We will notify customers of material changes by email and via an in-app notice at least 30 days before they take effect.

11. Contact

support@atrivextech.com
Atrivex Technology Private Limited