CUROVANA / LEGAL
Curovana Clinic privacy notice
Clinic, staff and patient information in the Clinic product, including WhatsApp messages.
Last updated ·
Who we are and what this covers
Curovana Clinic is clinic management software operated by CUROVANA TECHNOLOGIES PRIVATE LIMITED. Clinics use it at clinic.curovana.com to manage patients, appointments, prescriptions, bills and communication with their patients.
This notice covers the Clinic product, including messages a clinic sends to its patients on WhatsApp through it. The public company website is covered by the separate website privacy notice, and Curovana Simulation by its own notice.
CUROVANA TECHNOLOGIES PRIVATE LIMITEDF NO 105 GHS 4, SEC 21 D, Faridabad NIT, Faridabad, Faridabad-121001, Haryana, Indiasupport@curovana.comThe clinic’s role and ours
A clinic decides which patient information to record and how to use it. For patient information, the clinic is responsible for it (the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023). Curovana processes it on the clinic’s behalf, as its Data Processor, only to provide the Clinic product to that clinic.
For clinic staff accounts and our business relationship with a clinic, Curovana is responsible for the information.
If you are a patient, contact your clinic first about your records so it can verify and handle your request. You can also contact Curovana for help directing it. Please do not include medical records in an initial email.
Information in the Clinic product
- Patient information recorded by a clinic
- Identity and contact details such as name, age or date of birth, sex, mobile number and address; appointments and visits; clinical notes, prescriptions and documents; bills and payments; and communication with the patient. What is recorded depends on the clinic’s configuration and use.
- Clinic staff accounts
- Name, work email, role, clinic and location, and sign-in details. Passwords are stored only as salted hashes. Security logs record sign-ins, sessions and an audit trail of sensitive actions.
- Patient communication
- Messages a clinic sends to patients, including WhatsApp messages and their delivery status. Where a clinic enables them, website enquiry forms and voice-assistant call recordings and transcripts.
Why we use this information
- To provide the Clinic product to the clinic: records, scheduling, prescriptions, billing, and communication the clinic starts.
- To keep it secure: authentication, access control, audit logs, abuse prevention and backups.
- To support the clinic and fix problems it reports.
- To meet applicable legal obligations.
We do not sell personal information. We do not use patient information for advertising, and we never use patient information to train AI models. We use patient information only to provide the Clinic product to the clinic responsible for it.
WhatsApp messages
Clinics can use Curovana Clinic to send WhatsApp messages to their patients, for example appointment information, reminders, health camp or vaccination drive announcements, documents and images. Messages are delivered through the WhatsApp Business Platform (Cloud API) operated by Meta Platforms, Inc. and its affiliates (“Meta”).
- Who sends the message
- The clinic, from the clinic’s own WhatsApp Business number. Curovana provides the software that sends it on the clinic’s instruction.
- Information shared with Meta
- The patient’s mobile number, the message content (text and any attached image, video or document), and the clinic’s WhatsApp account identifiers. These are needed to deliver the message.
- Information received from Meta
- Message identifiers and delivery status (sent, delivered, read or failed) and error codes. Where a clinic connects its existing WhatsApp Business app, also the account information needed to keep that connection working.
- Meta’s processing
- Meta processes this information to deliver messages under its own terms, including the WhatsApp Business Policy and WhatsApp Privacy Policy, and may process it outside India.
- Permission and stopping messages
- Clinics must have a patient’s permission before messaging them on WhatsApp, as WhatsApp’s policies require. A patient can stop messages by telling the clinic, or by blocking or reporting the clinic’s number in WhatsApp.
We use WhatsApp information only to send the clinic’s messages and show the clinic their delivery status.
Service providers
- Hosting and storage. Amazon Web Services hosts the Clinic product, its database, file storage, backups, logs and email delivery (Amazon SES), in the Mumbai (ap-south-1) region in India.
- WhatsApp delivery. Meta, as described above.
- Email delivery. Resend sends account emails such as invitations and password resets. See Resend’s privacy policy.
- Voice assistant. Sarvam AI handles calls and transcripts for clinics that enable the voice assistant.
Information may also need to be disclosed to comply with a binding legal requirement or to establish, exercise or defend legal rights, subject to applicable law.
Where information is stored
Clinic product information is hosted in India (AWS Mumbai). Some providers, including Meta for WhatsApp delivery, may process limited information outside India to provide their service.
Clinics using the Curovana Windows edition keep their information on the clinic’s own computer, and Curovana does not host it. WhatsApp messaging is not available in the Windows edition.
Retention and security
- Clinic and patient records are kept while the clinic uses Curovana, or as the clinic instructs. When a clinic leaves, we delete or return its information within 90 days unless the law requires us to keep it longer.
- Communication media, such as call recordings and enquiry attachments, are deleted automatically after 30 days.
- WhatsApp message records and delivery status are kept with the patient’s record for as long as the clinic keeps that record.
- Security and audit logs are kept for one year.
We use encryption in transit and at rest, role-based access, salted password hashing, session controls, audit logs and encrypted backups. No internet service is risk-free. If a personal data breach occurs, we will notify the affected clinic and authorities as applicable law requires.
Your choices, requests and deletion
- Patients. Ask your clinic to access, correct or delete your records, or to stop messaging you. To stop WhatsApp messages straight away, you can also block the clinic’s number in WhatsApp.
- Clinic staff and clinics. Email support@curovana.com from your registered email with “Privacy request” in the subject. We will verify the request and respond within 30 days, except where the law requires us to keep information.
- Disconnecting WhatsApp. A clinic administrator can disconnect the clinic’s WhatsApp account from Curovana at any time. After that we stop sending messages and stop receiving information from Meta for that clinic.
Depending on applicable law, you may also have rights to a summary of your information, to correction and erasure, to withdraw consent, to nominate someone to act for you, and to complain to the Data Protection Board of India. Withdrawing consent does not make earlier lawful processing unlawful.
Clinics may record information about patients under 18 with the consent of a parent or lawful guardian. Curovana processes it only for the clinic and never for tracking, behavioural monitoring or targeted advertising.
Contact and changes
For privacy questions, requests or grievances, contact the company using the details below.
CUROVANA TECHNOLOGIES PRIVATE LIMITEDF NO 105 GHS 4, SEC 21 D, Faridabad NIT, Faridabad, Faridabad-121001, Haryana, Indiasupport@curovana.comChanges to this notice will be shown by a revised date, and clinic administrators will be told about important changes. A future change is not, by itself, permission for a new use of information already collected.