Privacy Policy

1. Who we are & what this policy covers

Medbus is clinic management software provided by Techbus Tech Solutions, Kochi, Kerala, India ("Medbus", "we", "us", "our"). This policy explains how we handle personal data when you visit medbus.org and its blog (the "Website"), contact us, or use the Medbus web and mobile applications (the "Platform").

This policy is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them. It should be read with our Terms & Conditions.

3. Information we collect

3.1 Information you give us

• Enquiries and demo requests: name, phone number, email, clinic name, city, specialty and your message.
• Account and billing details: names, contact details and roles of account holders and Authorised Users, clinic address, GSTIN, billing contacts and payment records. Card and bank details are handled by our payment partners; we do not store full card numbers.
• Support communications: emails, calls, chats and messages with our team, including any information you share in them.
• Clinic Data: information the Clinic enters into the Platform, which may include patient names, contact details, demographics, medical history, prescriptions, reports, images, appointments and bills.

3.2 Information collected automatically

• Technical data: IP address, browser and device type, operating system, and pages or screens viewed.
• Usage and security logs: log-ins, actions taken in the Platform, errors and audit-trail records.
• Cookies and similar technologies: see Section 8.

4. How we use information

• To respond to enquiries, arrange demos and provide quotations.
• To set up accounts, provide, maintain, secure and support the Platform, and to process payments and issue invoices.
• To send service messages such as account alerts, security notices, invoices, renewal and price-change notices, and changes to our terms.
• To send product news and offers about Medbus, where you have agreed or where permitted by law. You can opt out at any time.
• To understand how the Website and Platform are used, fix problems and improve our services, using aggregated or de-identified data wherever possible.
• To prevent fraud and misuse, enforce our terms, and meet legal, tax, accounting and regulatory obligations.

We process personal data on the basis of your consent, or for legitimate uses permitted by law — for example to perform a contract you have entered into, to comply with law, or to respond to a request you have made.

5. How we treat clinic data

• We do not sell Clinic Data and do not use it for advertising.
• We process Clinic Data only to provide, secure and support the Platform for the Clinic, on the Clinic's instructions, or where the law requires.
• Our staff access Clinic Data only where necessary — for example to resolve a support request the Clinic has raised, carry out a data migration, or investigate a security issue — and are bound by confidentiality.
• When a Clinic turns on an integration such as WhatsApp, SMS, email, payments or video consultation, the data needed for that feature (for example a patient's phone number and appointment time) is sent to that provider to deliver the service.
• We may create aggregated, de-identified statistics that cannot identify any patient, Clinic or individual, and use them to improve the Platform.

6. Website enquiries & marketing

This section applies only to information collected through the Website and our marketing channels. It never applies to Clinic Data.

• When you submit an enquiry or demo form, we use your details to contact you about Medbus by phone, email or WhatsApp.
• Where you have consented, or where otherwise permitted by law, we may use hashed contact details with advertising services such as Google Ads and Meta (Facebook and Instagram) to measure our advertising and show relevant ads, including to people with similar interests. These services process the data under their own privacy policies.
• We may use email-marketing services such as Brevo or Mailchimp to send newsletters to people who have subscribed.

You can withdraw consent or opt out at any time by clicking "unsubscribe" in an email, replying "STOP" to a message, or emailing admin@techbus.org with "Marketing opt-out" in the subject. You can also manage ad preferences in your Google and Meta account settings. Opting out of marketing does not stop essential service messages to customers.

7. Who we share data with

We share personal data only as described in this policy:

• Service providers who help us run our business — cloud hosting, data storage and backup, email and messaging, payment processing, video calls, customer support, analytics and accounting — under contracts that restrict their use of the data to providing services to us.
• Integrations the Clinic enables, as described in Section 5.
• Professional advisers such as lawyers, auditors and accountants, under confidentiality.
• Authorities, where required by law, court order or a lawful request from a government agency, or to protect the rights, safety or property of Medbus, our customers or others.
• A successor business, if Medbus is involved in a merger, acquisition, restructuring or sale of assets, subject to this policy continuing to protect the data.

8. Cookies & analytics

• Essential cookies keep you signed in, protect forms from abuse and remember basic preferences. The Website and Platform do not work properly without them.
• Analytics cookies (such as Google Analytics) help us understand how visitors use the Website, in aggregate.
• Advertising cookies and pixels (such as Google and Meta tags) may be used on the Website to measure the results of our advertising.

You can block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the Website or Platform from working. Analytics and advertising cookies are not used inside the clinic Platform.

9. Security

We use reasonable security practices and procedures appropriate to the nature of the data, including encryption of data in transit, access controls and role-based permissions, audit logs, regular backups, and limiting staff access to what their work requires. Clinics control which of their users can see which records.

No system can be guaranteed to be completely secure. Account security also depends on Clinics and their users — for example keeping passwords private, removing access for staff who leave and keeping their devices secure, as described in our Terms. If we become aware of a personal-data breach in systems under our control, we will notify affected Clinics, and the Data Protection Board of India and affected individuals where the law requires, without undue delay.

10. How long we keep data

• Clinic Data: for as long as the Clinic's account is active. After the account ends, the Clinic may export its data for 30 days; we then delete it from active systems, and from backups as they cycle out, unless the law requires us to keep it. Clinics are responsible for keeping medical records for the periods their own regulations require.
• Enquiry and marketing data: for up to 2 years after our last contact with you, or until you ask us to delete it or withdraw consent, whichever is sooner.
• Billing, tax and contract records: for as long as tax and accounting laws require (generally up to 8 years).
• Security and audit logs: for up to 1 year, or longer if needed to investigate an incident or required by law.

11. Where data is stored

We use reputable cloud hosting providers. Some of our service providers may process data outside India. Where this happens, we do so only as permitted under Indian law, including any restrictions notified under the DPDP Act, and with contractual safeguards to protect the data. Enterprise customers who need a specific hosting location can discuss this with us.

12. Your rights

Subject to the DPDP Act and other applicable law, you have the right to:

• obtain a summary of the personal data we process about you and how we process it;
• have inaccurate or incomplete data corrected, completed or updated;
• have your data erased where it is no longer needed for the purpose for which it was collected or for a legal requirement;
• withdraw consent at any time, without affecting processing that took place before withdrawal;
• nominate another person to exercise your rights in the event of death or incapacity; and
• have your grievances addressed by us, and if you are not satisfied, to complain to the Data Protection Board of India.

To exercise these rights, contact us using the details in Section 15. We may need to verify your identity. For Clinic Data, please contact your Clinic first (see Section 2).

13. Children

The Website and Platform are intended for healthcare providers and their staff, not for children. We do not knowingly collect personal data directly from anyone under 18. Clinics that record information about minor patients are responsible, as data fiduciaries, for obtaining verifiable consent from a parent or lawful guardian where the law requires.

14. Changes to this policy

We may update this policy to reflect changes to our services or the law. The "Last updated" date shows the current version. For material changes, we will notify customers by email or in-app message before the changes take effect.

15. Contact & grievance officer

For privacy questions, requests to exercise your rights, or complaints, contact our Grievance Officer. We aim to acknowledge requests within 24 hours and resolve them within 15 days, or sooner where the law requires.