HealthFlow ("HealthFlow", "we", "us", or "our") provides software that helps diagnostic centres, clinics and pharmacies run their operations, generate reports and communicate results, bills and reminders to their patients, including over WhatsApp. This Privacy Policy explains what information we handle, why, and the choices and rights available to you.
For most patient information, HealthFlow acts as a data processor on behalf of the diagnostic centre or clinic you are a customer of (the "Clinic"), which is the data controller of that information. Where we determine the purposes and means of processing ourselves, such as for our own accounts, billing and product operation, we act as a data controller. This policy should be read together with the privacy notice of the Clinic that serves you.
01 Who this policy covers
This policy applies to:
- Clinic staff and administrators who hold HealthFlow accounts and use the software to run their centre.
- Patients of a Clinic whose information is processed in HealthFlow so the Clinic can prepare reports and communicate with them, including via WhatsApp.
- Visitors to our website and anyone who contacts us.
It applies to our web application, associated backend services, and the messages we send on a Clinic's behalf through the WhatsApp Business Platform.
02 Information we collect
Provided by the Clinic and its staff
- Account information — staff name, role, email address, phone number, and login credentials.
- Clinic profile — business name, address, branch details, logo and branding.
Patient information (processed on behalf of the Clinic)
- Identity & contact — patient name, phone number, age, sex, and referral details.
- Health information — tests ordered, results, reports, and related clinical notes entered by the Clinic. This is sensitive personal data and we handle it accordingly.
- Billing information — invoices, amounts, discounts and payment status. We do not store full card or bank credentials; payments, where applicable, are handled by the Clinic or a payment provider.
Messaging & delivery data
- WhatsApp / message metadata — the recipient phone number, message template used, and delivery status (sent, delivered, read, failed) for reports, bills and reminders.
Collected automatically
- Technical & usage data — IP address, device and browser type, timestamps, and audit logs of actions taken in the app, used for security, troubleshooting and abuse prevention.
- Essential cookies — used to keep you signed in and secure your session. We do not use advertising cookies.
03 How we use information
- To provide and operate the HealthFlow software for the Clinic.
- To generate and deliver reports, bills, receipts and reminders to patients, including over WhatsApp, at the Clinic's instruction.
- To authenticate users, maintain audit trails and secure accounts.
- To provide support, fix problems and improve reliability and performance.
- To communicate service and account notices to Clinic staff.
- To comply with legal obligations and enforce our terms.
04 WhatsApp & messaging
HealthFlow uses the WhatsApp Business Platform, provided by Meta Platforms, Inc. ("Meta"), to deliver reports, bills and reminders from a Clinic to its patients. When a message is sent:
- The recipient's phone number and the message content are transmitted to WhatsApp for delivery, in line with WhatsApp's own terms and privacy practices.
- Messages are sent only for the transactional and service purposes the patient would expect from their Clinic (for example, "your report is ready"), using approved message templates.
- We retain delivery status so the Clinic can confirm a patient received their report or bill.
Your use of WhatsApp is also governed by the WhatsApp Privacy Policy and the WhatsApp Business Messaging Policy. HealthFlow's use of information received from Meta APIs adheres to Meta's Platform Terms and Developer Policies, and such information is used only to provide the features described in this policy.
05 Legal bases for processing
Depending on the information and applicable law, we and the Clinic rely on one or more of the following:
- Contract — to provide the service the Clinic and its patients have requested.
- Consent — for example, where a patient consents to receive results over WhatsApp. Consent can be withdrawn at any time.
- Legitimate interests — to secure our systems, prevent abuse and improve the service, balanced against your rights.
- Legal obligation — where retention or disclosure is required by law.
We process information consistent with India's Digital Personal Data Protection Act, 2023 and, where applicable, other data-protection laws.
07 Sub-processors
We rely on a small set of trusted providers to deliver HealthFlow:
| Provider | Purpose |
|---|---|
| Meta Platforms (WhatsApp Business Platform) | Delivery of report, bill and reminder messages to patients |
| Cloud hosting & database provider | Application hosting, database and backups |
| Object storage / CDN provider | Storage and delivery of report files and logos |
| Email delivery provider | Transactional and account emails |
Sub-processors act on our instructions and are bound to protect the information they handle. This list may change as our infrastructure evolves; the current list is available on request.
08 Data retention
- Patient records and reports are retained for as long as the Clinic maintains its account and requires them, and as necessary to meet medical record-keeping and legal obligations. The Clinic controls this retention.
- Message delivery metadata is retained to evidence delivery and support the Clinic.
- Account and technical logs are retained for a limited period for security and troubleshooting.
When a Clinic closes its account, we delete or return its data within a reasonable period, except where retention is required by law.
09 Security
We use technical and organisational safeguards appropriate to the sensitivity of the data, including:
- Encryption of data in transit (HTTPS/TLS).
- Access controls, role-based permissions and per-Clinic data isolation.
- Audit logging of sensitive actions.
- Regular backups and restricted administrative access.
No system is perfectly secure, but we work continuously to protect your information and will notify affected parties and authorities of a significant breach as required by law.
10 Your rights
Subject to applicable law, you may have the right to:
- Access the personal information held about you.
- Request correction of inaccurate information.
- Request deletion of your information.
- Withdraw consent, including for WhatsApp messages.
- Object to or restrict certain processing, and lodge a complaint with a data-protection authority.
Because HealthFlow processes most patient information on behalf of the Clinic, please direct patient requests to your Clinic first; we will assist the Clinic in fulfilling them. You may also contact us directly using the details below and we will route your request appropriately.
11 Data deletion
To request deletion of your personal information, or the deletion of information sent through WhatsApp:
- Patients — contact the Clinic that serves you, or email us at privacy@healthflow.in with the phone number or name used, and we will coordinate deletion with your Clinic.
- Clinic accounts — email privacy@healthflow.in from your registered address to request deletion of your account and associated data.
We will confirm and action verified deletion requests within a reasonable period, except where we are required to retain certain information by law.
12 Children's data
HealthFlow is used by healthcare providers and may include information about patients of any age, including minors, entered by the Clinic for legitimate medical purposes. HealthFlow is not directed to children as independent users, and we do not knowingly create accounts for children. Information about minor patients is handled with the same care as other sensitive health data.
13 International transfers
HealthFlow is operated from India and our infrastructure is primarily located to serve our customers. Some sub-processors, including Meta, may process limited information in other countries. Where information is transferred across borders, we take steps to ensure it remains protected in line with applicable law.
14 Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify Clinics. Continued use of HealthFlow after changes take effect constitutes acceptance of the updated policy.
15 Contact us
For any question about this policy, your information, or to exercise your rights, contact: