Sehatify Privacy Policy

Effective date: 26 October 2026

This Privacy Policy explains how Sehatify Technologies Private Limited (“Sehatify”, “we”, “us”) collects, uses, shares and protects personal data when you use our website sehatify.in, our web application and mobile apps, and related services (together, the “Services”). We publish it under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the Digital Personal Data Protection Act, 2023 and the rules made under it (“DPDP Act”).

1. Who we are

Sehatify Technologies Private Limited is a company incorporated in India. Sehatify provides cloud software that diagnostic and pathology laboratories use to register patients, manage tests and billing, create and deliver reports, and run their lab.

2. Our two roles, and which one applies to you

Where we decide how your data is used. If you visit our website, register your lab or ask for a demo, use a Sehatify account as a lab owner or staff member, use the doctor portal, pay us, or contact us, Sehatify is the Data Fiduciary for your personal data and this Policy governs how we handle it.
Where we process data for a lab. Labs use Sehatify to record their patients’ details, test orders, results and reports. For that data the lab is the Data Fiduciary: it decides why the data is collected and how it is used, and it is responsible for obtaining patients’ consent. Sehatify is the lab’s Data Processor and handles that data only on the lab’s instructions and under our agreement with the lab.
If you are a patient, please contact the lab that tested you about your reports or personal data.

3. What we collect

What we hold depends on how you use Sehatify:

Registration and enquiries: lab or clinic name, contact person, phone number, email, city, approximate daily report volume, previous software used, and anything you write in the form or tell our team.
Account and login: name, role, the mobile number or email used to receive one-time passwords (OTPs), access permissions, and records of logins and actions taken in the account (the Activity Tracker).
Lab business details: lab address, registration details, GSTIN, letterhead and logo, names, qualifications, registration numbers and signatures of the lab’s signatories, rate lists, staff, and referring doctors and partner labs.
Billing and payments: plan, invoices, payment status and transaction references. Card, UPI and bank details are entered on our payment gateway’s pages; we never receive or store full card numbers.
Doctor portal: referring doctors’ name, phone number, medical registration number and clinic details, and the reports they view.
Patient data (processed for labs): patient name, age, sex, phone number, address, referring doctor, samples, tests ordered, results, reports and bills. Health information is sensitive personal data under the SPDI Rules and is handled with the safeguards in section 7.
Device and usage data: IP address, browser and device type, pages visited, error logs, and — for the analyzer connector installed on a lab’s computer — machine identifiers and connection logs.
Communications: calls, emails, WhatsApp messages and support requests between you and us.

We do not collect Aadhaar numbers or biometric data, unless a lab chooses to record them for its own work; in that case the lab is responsible for obtaining any consent required. We do not ask for bank account numbers to use the Services.

4. Why we use it

To run the Services: create and secure accounts, send login OTPs, run lab workflows, receive results from connected analyzers, produce PDF reports, deliver reports to patients and doctors as each lab instructs, and send lab owners their daily business summary.
To bill you: manage subscriptions, issue GST invoices, send payment links and reminders, and restrict accounts to read-only when payment is overdue.
To support you: onboarding, training, troubleshooting and answering requests.
To keep you informed: OTPs, security alerts, service notices and payment reminders. With your consent, we may also send lab owners news about Sehatify; you can opt out at any time. We never use patient data for marketing.
To improve the Services: using aggregated, de-identified statistics that cannot identify any person.
To stay secure and lawful: prevent fraud and misuse, keep audit logs, meet tax and record-keeping duties, and respond to lawful requests from authorities.

We rely on your consent, which you can withdraw at any time (withdrawal does not affect processing already done, but we may then be unable to provide some Services), and on the other lawful grounds the DPDP Act allows, such as complying with the law. For patient data, the lab is responsible for having a lawful basis and obtaining any consent required.

We do not sell or rent personal data. We share it only in these cases:

Within the lab’s account: data a lab enters is visible to that lab and the users it authorises. When a lab sends samples to another lab through Sehatify, the details needed for that test are shared with the receiving lab.
With doctors and patients, as the lab decides: for example, reports shared with referring doctors on the doctor portal, or delivered to patients on WhatsApp.
With our service providers: companies that host our systems, deliver messages (WhatsApp Business, SMS, email), process payments, and help us provide support. They act only on our instructions and are bound by contract to protect the data.
WhatsApp delivery: reports are sent from Sehatify’s WhatsApp Business number on the lab’s behalf. WhatsApp is operated by Meta, and its own terms and privacy policy apply to messages you receive there.
For legal reasons: to comply with law, a court order or a lawful request from a government authority, or to protect the rights, property or safety of Sehatify, our users or others.
On a business transfer: if Sehatify is merged, acquired or sells its assets, personal data may move to the new owner, which must continue to protect it as this Policy describes. We will tell you before that happens where the law requires.

6. Where your data is stored

We store personal data, including patient data, primarily on servers in India. Reports sent on WhatsApp pass through the systems of Meta, which operates WhatsApp. Some of our service providers, such as website hosting and email tools, may handle limited data outside India. We use such transfers only where Indian law permits them, and under contracts that protect the data.

7. How we protect it

We follow reasonable security practices under the SPDI Rules and the DPDP Act, including:

encryption of data in transit and at rest;
strict separation of each lab’s data from every other lab’s;
OTP-based login and role-based access within each lab account;
logs of access and activity, kept for at least one year;
daily encrypted backups;
access by our own staff limited to what their job needs, under confidentiality obligations;
monitoring and periodic security testing.

No system is completely secure. If you suspect a problem, write to us at once at support@sehatify.in. If a personal data breach occurs, we will inform the affected lab without delay and notify the Data Protection Board of India, CERT-In and affected individuals as the law requires.

8. How long we keep it

Account and lab business data: for as long as the subscription is active. After an account closes, we delete or anonymise it once it is no longer needed for the purposes in this Policy, unless the law requires us to keep it.
Overdue accounts: existing records stay viewable and printable while an account is read-only for non-payment.
Patient records: kept as the lab instructs, consistent with the medical-record rules that apply to the lab.
Invoices, tax and accounting records: 8 years, as Indian law requires.
Security logs: at least one year.
Website enquiries that don’t become customers: as long as we need them to follow up with you.

9. Children

The Services are meant for labs and healthcare professionals and are not intended for use by anyone under 18. Labs may hold children’s health data to provide them healthcare; the lab is responsible for any consent the law requires from a parent or lawful guardian.

10. Your rights

For personal data Sehatify controls, you can ask us to:

tell you what personal data we hold about you and how we use it;
correct, complete or update it;
erase it, unless the law requires us to keep it;
stop processing based on your consent, by withdrawing it;
let a person you nominate exercise these rights if you die or become incapable.

Write to the Grievance Officer below from the phone number or email linked to your account; we may need to verify your identity. We will respond within a reasonable period. If you are not satisfied, you may complain to the Data Protection Board of India. Patients should send requests about their test data to their lab (see section 2).

11. Grievance Officer

You can reach our Grievance Officer at:

Email: support@sehatify.in
Phone: +91-9211662999

12. Cookies

Our website and app use only the cookies and browser storage needed to keep you logged in, remember your settings and keep the Services secure. We do not use advertising or analytics trackers. You can block cookies in your browser, but you will not be able to log in to the app without them.

13. Changes to this Policy

We may update this Policy as the Services or the law change. We will post the new version here with a new effective date, and tell account holders about significant changes through the app, email or WhatsApp.

Contact: support@sehatify.in · +91-9211662999