Privacy Policy

Healway.pro ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our healthcare platform.

This policy is designed to comply with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000 and the SPDI Rules, 2011, and other applicable Indian regulations.

By using Healway.pro you confirm that you have read, understood, and agree to this Policy.

Personal Information

• Full name, contact details (phone, email)
• Date of birth, gender
• Medical registration details (for healthcare providers)
• ABHA ID / ABHA address (if provided)

Health Information (Sensitive Personal Data & Information)

• Medical history and symptoms
• Consultation notes and transcriptions
• Prescriptions and treatment plans
• Follow-up schedules and vitals
• Intake form responses

Technical Information

• Device information and IP address
• Usage patterns and preferences
• Audio recordings (for transcription purposes, deleted after processing)

Under the DPDP Act, 2023, we collect and process your personal data only for the specific purposes listed below. We will seek your explicit consent for each category:

You may withdraw optional consents at any time from the Patient Portal. Withdrawal does not affect the legality of processing before withdrawal.

We use your information for the following purposes:

• Providing healthcare services and facilitating consultations
• Generating AI-assisted clinical notes and summaries (with AI Processing consent)
• Managing prescriptions and follow-up appointments
• Improving our services and user experience (with Analytics consent)
• Complying with legal and regulatory requirements
• Communicating important updates and reminders (with Communication consent)

Note: We do not use your health data for advertising purposes or sell your information to third parties.

We retain your data for the following periods, after which data is securely deleted or anonymised:

We may share your information with:

• Healthcare Providers: Your treating physicians and their authorized staff
• Service Providers: Third-party services that help us operate our platform (e.g., cloud hosting, AI processing)
• Legal Requirements: When required by law or to protect our legal rights

All third-party service providers are bound by confidentiality agreements and data protection requirements.

Our primary data store is located in India (Supabase, Mumbai region). However, some AI processing features involve transferring anonymised clinical text to the following international providers:

No direct patient identifiers (name, phone, date of birth, address) are sent to AI providers. We rely on contractual safeguards (Data Processing Agreements) for cross-border transfers. Transfer to AI providers is subject to your AI Processing consent.

We recognise that patients under 18 years of age require additional protection.

• When a minor patient is registered, we collect guardian name and contact details.
• Parental / guardian consent is required before any AI processing or analytics are performed on the minor's data.
• Guardians may request access to, correction of, or deletion of their child's data by contacting our Grievance Officer.

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Portability: Receive your data in a structured, commonly used format
• Withdraw Consent: Withdraw optional consents at any time via the Patient Portal
• Grievance Redressal: File complaints regarding data handling with our Grievance Officer
• Nominate: Nominate another individual to exercise your rights on your behalf

To exercise these rights, please contact our Grievance Officer using the details below. We will respond within 30 days of receipt.

We implement robust security measures to protect your data:

• AES-256 encryption for sensitive health information at rest
• TLS 1.2+ for all data in transit
• Role-based access controls (RBAC)
• Regular security audits and monitoring
• Multi-factor authentication (MFA) support
• Comprehensive HIPAA-style audit logging
• Breach detection with Data Protection Board notification within 72 hours

Our platform uses AI-assisted tools for clinical support, including:

• Transcription of consultation audio
• Generation of clinical note summaries
• Follow-up scheduling recommendations
• Risk assessment assistance
• Healix AI medical assistant

Important: All AI-generated content is for clinical decision support only. The treating physician is responsible for reviewing and confirming all clinical information before use. Healway.pro AI tools are not registered medical devices under CDSCO regulations and are not a substitute for professional medical judgment.

AI processing requires your explicit AI Processing consent. You may withdraw this consent at any time; this will disable AI features for your records without affecting core healthcare services.

We have appointed a Grievance Officer as required under the DPDP Act, 2023 and the IT Act, 2000. You may contact our Grievance Officer for any privacy concern, data rights request, or complaint:

If you are not satisfied with our response, you may escalate to the Data Protection Board of India once it is constituted under the DPDP Act, 2023.