Legal

    Your Privacy, Protected

    We handle patient data with the same care you do. Here's exactly what we collect, how we protect it, and what rights you have.

    Who We Are
    • Vaidya OS is run by Gaurav Kumar as a sole proprietorship, registered in India as a micro enterprise under the name Vaidya OS (Udyam Registration No. UDYAM-UP-28-0129366), based in Noida, Uttar Pradesh.
    • For any privacy question or request, email gaurav@vaidyaos.in.
    What We Collect
    • Account information: your name, email address and mobile number, used to create your Vaidya OS account.
    • Clinic information: your clinic name and branding details you configure in settings.
    • Patient records: names, ages, contact numbers, diagnoses, prescriptions, visit history, and follow-up notes that you enter into the system.
    • Usage data: basic analytics such as login timestamps and feature usage to help us improve the product. This data is never linked to patient records.
    How It's Stored & Protected
    • All data is stored on Supabase, a secure cloud database platform. Data is encrypted in transit (TLS) and at rest (AES-256).
    • Row-level security (RLS) is enforced at the database level, so your data is completely isolated from other clinics. Other clinics can never access your patient records.
    • Automatic backups are taken daily. Your data is never stored on our local servers.
    Who Can Access Your Data
    • Only you and the staff logins you create can view and manage your patient records.
    • Vaidya OS staff do not look at your patient records, except when you ask us to, for example to move your existing records in or to fix a problem you report.
    • No third-party analytics, advertising, or tracking tools have access to patient data.
    What We Don't Do
    • We do not sell, rent, or trade your data. Ever.
    • We do not use patient data for advertising or profiling.
    • We do not share data with anyone except the service providers listed below, and only to provide the service.
    Service Providers We Use
    • To run Vaidya OS we use a small number of service providers. They process data only on our instructions and only to deliver the service.
    • Cloud hosting and database: our main database is hosted in India (Mumbai).
    • Payments: for your subscription. They receive your payment details, never patient data.
    • WhatsApp messaging: through a Meta-approved WhatsApp Business partner, for the reminders and messages you switch on. They receive the patient's name, phone number and the message.
    • Email delivery: for account emails and the notifications you turn on.
    • AI services: for features such as the WhatsApp assistant, which reads a patient's message in order to reply.
    • Voice AI: for the optional voice-guided setup when you first create your clinic. It processes what you say during setup.
    • Product analytics: to understand how doctors use the app, for example which screens are opened. Session recording is off.
    • Error monitoring: to find and fix crashes. Any screen captures it takes have all text and inputs masked.
    • We share only what each provider needs, and each is bound by confidentiality and data-protection terms. Some of these providers may process data outside India, as the DPDP Act allows. We never sell data or share it for advertising.
    • For the current list of providers, email gaurav@vaidyaos.in.
    Data Retention & Deletion
    • If your plan ends, your account is paused, not deleted. All your data remains intact and accessible when you pick a plan again.
    • You can request permanent deletion of your account and all associated data at any time by emailing us. We will complete the deletion within 30 days.
    • We retain only the minimum data required for legal and accounting purposes (subscription records) after account deletion.
    DPDP Act 2023
    • Vaidya OS is built to meet the requirements of India's Digital Personal Data Protection (DPDP) Act 2023.
    • The lawful basis for processing your data is your explicit consent given at account signup.
    • For your own account data (name, email, phone and subscription), Vaidya OS is the Data Fiduciary and is responsible for processing it lawfully, fairly and transparently.
    • For your patients' data, your clinic is the Data Fiduciary. Vaidya OS processes that data only on your behalf, to provide the service.
    • You have the right to access, correct, and erase your personal data at any time by contacting us.
    Cookies
    • Vaidya OS uses only essential session cookies required for authentication. These are deleted when you log out.
    • We use the Meta (Facebook) Pixel to measure the effectiveness of our advertising campaigns. This sets a cookie that tracks ad conversions. No personal health data is shared with Meta.

    Privacy Questions?

    For any privacy-related questions, data deletion requests, or to exercise your rights under the DPDP Act 2023, contact us directly. We respond within 2 business days.

    gaurav@vaidyaos.in

    Last updated: 9 October 2026 · Vaidya OS