How personal data is looked after.

1Who is responsible for what

Your patients' data is your healthcare facility's. Your healthcare facility decides what to record about its patients and why, so under India's Digital Personal Data Protection Act, 2023 your healthcare facility is the data fiduciary for it. CuroCompass is the data processor: we store and handle that data only to run CuroCompass for you, and only as the product is built to.

For the details of your own account (your business, your logins and how they are used), CuroCompass is responsible, and this half says what we do with them.

2What we keep about your healthcare facility

• Your business. Its name, address, phone number, GSTIN, kind of practice, logo, letterhead and colours, and how you set it up: booking sessions, the survey, perks, the price list, the medicine and test lists, the roster.
• Your logins. For the owner and managers: name, email address, role and a password. For staff: name, phone number, role, department and a password, and their duty roster, attendance and pay as your healthcare facility records them. Passwords are stored only in a scrambled form (a hash) that cannot be turned back into the password.
• How CuroCompass is used. When each login signs in and which dashboards are opened, so you and we can see whether the product is being used. Actions at the front desk are recorded by what was done and to which record, never with a patient's name or number.
• Notifications. If you turn on alerts in a browser, that browser's push address, so we can send them to it.

3What we hold for you about your patients

Only what your healthcare facility and your patients put in. Depending on which parts of CuroCompass you use:

• The patient record. Name, phone number, email if given, registration number, age or date of birth, sex, a "care of" name and relation, address, preferred language and referring doctor. Whether the patient accepted the privacy policy or was registered at your counter, whether they may be contacted about their visits, and whether they asked to stop, each with its date.
• Visits and money. Bookings and walk-ins, with the answers to your booking form's options; bills, payments you recorded at the counter and credit notes.
• Feedback. Survey answers, memberships, perks used and referrals.
• Medical records. Consultations, vitals, prescriptions, allergies and conditions, lab orders and results, and test readings, written by your staff.

Pharmacy stock, the roster and pay records are your business's own data and name no patient.

4What stays your job

As the data fiduciary, some things only your healthcare facility can do. CuroCompass is built to make each of them easy.

• Telling patients. The patients' half of this policy is the notice your patients accept on your booking link and your feedback survey, and it is what a registration at your counter is made under. Keep it where a patient can find it, for example with a line at the counter pointing to curocompass.com/privacy.
• Contact that stays about care. A patient who accepts the policy on your booking link or survey agrees that you may contact them about their visits and follow-ups, and so does a patient registered at your counter. That covers reminders, follow-ups, reports that are ready and checking in when they are due back. It does not cover offers or promotions, and your call list only ever holds patients who may be contacted.
• Acting on a patient's request. To stop contacting somebody, press Stop contacting on their record. It stays off, even if they fill in a form again. To correct their address, age and the like, use the Details tab on their record; for a name or a phone number, write to us. To erase somebody, write to us and we carry it out.
• The right login for each person. Give every member of staff their own login with the role that fits their job, and move people to Past staff when they leave.
• Keeping records. How long medical and financial records must be kept is set by law and your profession, not by CuroCompass. When a patient is erased, their bills and medical records are kept with their name and number taken off.

5The AI

CuroCompass uses an AI model (Claude, made by Anthropic) for three jobs: reading the written answers to your feedback survey to find what patients are happy and unhappy about, putting your call list in order, and writing a short summary at the top of a patient's record.

• For feedback it is sent the survey answers. It is never sent a name, phone number or email from the patient record.
• For the call list and the summary it is sent counts and bands (how many visits, how long since the last one), never who the patient is.
• If a patient writes about their health in a feedback answer, the AI marks it and it is removed before the answer is kept for you to read.
• Medical records are never sent to any AI: not in a prompt, not summarised, not anonymised. There is no setting that changes this.

6Other companies involved

A few companies do part of the work, each for one job and each only with what that job needs:

Anthropic

The AI model above. Survey answers and anonymous counts only.

Resend

Sends the code that confirms the email address you sign up with.

Google

Finds your business listing when you sign up, to fill in your name, address and opening hours. Only what you type in the search box is sent. Your hours are a starting point you can change, and they are never read again.

Browser push services

Deliver alerts to the browsers you turned them on in. The message is encrypted on the way, so the service cannot read it.

CuroCompass's servers and its database are in India. The companies above are based outside India, and each receives only what is listed beside it. Fonts and everything else the pages need are served from our own servers, so a visit to a CuroCompass page is not reported to anybody else.

7How it is protected

• Every page and every request travels over an encrypted connection.
• Passwords and patients' PINs are stored only as hashes. A member account stores a keyed hash of the phone number, never the number.
• Each healthcare facility's data is kept apart. A login sees its own healthcare facility and nothing else.
• Each role sees its own job. The front desk sees that a consultation happened, never what is in it. A pharmacist reads the medicines, never the notes.
• Every time somebody opens a medical record it is logged, and the owner can read the log.
• No name or phone number is ever put in a web address, where it could end up in a browser history or a server log.
• The database is backed up every night and before every update, and each backup is deleted after 14 days.

8Our team's access

Our team opens a healthcare facility's account only to support it or to keep CuroCompass running. Every search for a patient, every patient record opened and every change is written to an audit log that cannot be edited. When one of us signs in as your healthcare facility to help you, a red banner says so on every page, with our name on it, for as long as we are there.

Our team has no clinical role and cannot be given one, so we cannot read a consultation, a prescription or a lab report. We see how many there are.

9What we never do

• Sell or rent anybody's data, or use your patients' data to advertise anything.
• Contact your patients. CuroCompass sends patients no SMS, no email and makes no calls. Only your healthcare facility contacts its patients.
• Show one healthcare facility's records to another. The one place they meet is a patient's own member page, behind their PIN, where they see the memberships each healthcare facility holds for them.
• Take payments or store card numbers. Money taken at your counter is recorded as a note of what arrived.
• Send medical records to an AI.
• Make a Google review a condition of anything. Every patient sees the same optional link, whatever they answered, and nothing is given for a review.

10If something goes wrong, and if you leave

If we learn that your data has been accessed by somebody who should not have it, we tell you without delay, with what we know, so you can meet your own duties to your patients and to the Data Protection Board of India.

Before you leave, the owner can download the patient list from the Patients page. When you ask us to close your account, we delete your healthcare facility's data from CuroCompass, and the last copies leave our backups within 14 days.

1Who looks after your data

Your clinic or hospital. It decides what is kept about you and why, and it is responsible for it. CuroCompass is the software it uses, and handles your data only for your healthcare facility.

So questions and requests go to your healthcare facility. You can also write to us at [email protected] and we will pass them on.

2When you register at the counter

When you give your name, phone number and details at the counter to be seen, the healthcare facility records them in CuroCompass to look after your visit: your registration, your token, your bill and your doctor's records. You do not need to tick anything for this. You gave the details for that visit, and they are used for it.

The healthcare facility may also contact you about your visits and follow-ups (section 4). If you do not want that, tell the healthcare facility.

3When you book online or fill in a feedback survey

These forms ask you to tick I accept the privacy policy and the healthcare facility can contact me about my visits and follow-ups, with the healthcare facility's own name in it. Ticking it means you agree that the healthcare facility keeps what that form collects, and may contact you about your visits (section 4):

• On a booking: your name, phone number and the options you pick on the form, such as which service the visit is for. They are kept for your appointment.
• On a feedback survey: your phone number, your name if you give it, and your answers. Finishing the survey makes you a member of the healthcare facility, with the perks it offers.

4Being contacted

When you tick the box on a booking or a survey, or register at the counter, your healthcare facility may call or message you about your visits and follow-ups: a reminder about an appointment, a follow-up the doctor asked for, a report that is ready, or a check when you are due back.

To stop, tell your healthcare facility. They switch it off on your record, and from then on you are not on their list of people to call. It stays off, even if you book or fill in a survey again. CuroCompass itself never contacts you: no SMS, no email, no calls from us.

5What is kept about you, and where

• Your details. Name, phone number, email if you give one, a registration number, age or date of birth, sex, the name of the person you came with and how they are related to you (never their phone number), address, language and the doctor who sent you.
• Your visits. Bookings and their reference, bills and payments, your membership and the perks you used, and your feedback answers.
• Your medical records, if your healthcare facility keeps them in CuroCompass: consultations, vitals, prescriptions, allergies and conditions, lab reports and test readings. Your healthcare facility keeps these because it is treating you, under the rules for medical records, and not because of the tick on a form.

All of it is stored on servers in India. Your written feedback answers are also sent to the AI described in section 7, which is run outside India, without your name, phone number or email.

6Who can see it

Only the people at your healthcare facility whose job needs it. Your doctor reads your medical records; the front desk sees that you had a consultation, never what was said in it; the pharmacist reads your prescription and allergies, never the doctor's notes. Every time somebody opens one of your medical records, it is logged.

Another healthcare facility cannot see your records at yours. CuroCompass staff can open a healthcare facility's account only to support it, every look at a patient record is logged, and they cannot read medical records at all.

7Your feedback and the AI

Your healthcare facility uses an AI model (Claude, made by Anthropic) to read feedback and find what patients are happy or unhappy about. It is sent your answers, never your name, phone number or email. If you write about your health in a feedback answer, that part is removed before your answer is kept. Your medical records are never sent to any AI.

Your healthcare facility sees your feedback with your name on it, so it can put things right. Leaving a Google review afterwards is up to you, and nothing you get depends on it.

8Your member page

At app.curocompass.com/m you can type your phone number and a 4-digit PIN to see your memberships, perks and bookings at every healthcare facility that uses CuroCompass. The first time, you choose the PIN. CuroCompass keeps that account (your PIN, and a name and email if you add them) so the page can show you your own details. Nothing about your health is shown there.

Forgot your PIN? Ask your healthcare facility to reset it, and choose a new one next time. Nobody at the healthcare facility ever sees your PIN.

9What you can ask for

You can ask your healthcare facility, at any time:

• To see what it holds about you.
• To correct a detail that is wrong.
• To stop contacting you.
• To delete your details. Your name and phone number are then removed from the healthcare facility's records. Bills and medical records that the law may require the healthcare facility to keep are kept, with your name and number taken off them. Your feedback stays, without your name.

You can also name somebody to do this for you if you cannot. If your healthcare facility does not resolve a complaint about your data, you can take it to the Data Protection Board of India.

10Children

For a patient under 18, a parent or guardian gives the details, makes the booking, answers the survey and decides about being contacted.

11If this policy changes

The date and the version at the top of this page change with it. Every patient record notes which version was in force when it was agreed to, and the next time you book or fill in a survey you are asked to accept the version in force then.