Privacy Policy

This Privacy Policy explains how RAHY Healthcare ("RAHY", "we") collects, uses, and protects information in connection with RAHY Heal Focus and its public patient booking site (together, the "Service"). Claim Focus is a separate product with its own privacy policy at claimfocus.in.

We collect information in three broad categories:

• Account & hospital information: names, usernames, emails, roles, and hospital details for staff accounts a Hospital creates.
• Patient & operational data: patient records, billing, admission/discharge details, and other clinical or operational data that Hospitals enter into the Service to run their operations. Appointment requests submitted through the public booking site (patient name, phone, preferred time) are also collected on a Hospital's behalf.
• Usage & technical data: log data, device/browser information, and similar technical data generated by using the Service.

For patient and clinical data entered by a Hospital, the Hospital is the data controller and RAHY acts as a data processor, handling that data solely on the Hospital's instructions and for the purpose of providing the Service. Requests to access, correct, or delete patient data should generally be directed to the Hospital in the first instance, who may work with us to action them.

• To provide, operate, and maintain the Service;
• To authenticate users and enforce role-based access to data;
• To communicate with Hospitals about their account, billing, or support;
• To monitor, secure, and improve the Service;
• To comply with legal obligations.

We do not sell personal or patient data. We share data only with: (a) infrastructure sub-processors that host and run the Service (e.g. our database and hosting providers), bound by confidentiality and security obligations; (b) as required by law, regulation, or valid legal process; and (c) with a Hospital's own explicit configuration — for example, an outsourced lab/pharmacy vendor role is deliberately restricted to seeing only a patient's name and MRN, nothing else.

Access to data in the Service is governed by role-based permissions configured per Hospital, enforced at the database level — a user only ever sees the modules and records their role grants. We use industry-standard measures including encrypted connections and access controls, and follow the principle of least privilege for internal access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data is retained for as long as a Hospital's subscription is active, plus a reasonable period afterward to allow for data export or as required by applicable record-keeping obligations (many healthcare records are subject to statutory retention periods). A Hospital may request deletion of its data subject to those legal retention requirements.

Depending on applicable law, you may have rights to access, correct, or request deletion of your personal information. Staff users should contact their Hospital administrator; patients should contact the Hospital they visited. You can also reach us directly using the contact details below.

The Service uses essential cookies/local storage to keep you signed in and remember basic preferences (such as a collapsed sidebar section). We do not use these for third-party advertising.

The Service itself is intended for use by hospital staff and adult patients booking appointments; it is not directed at children. Where a Hospital records data for a minor patient as part of normal clinical care, that data is handled under the same processor relationship described above.

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated date on this page.

Questions about this Privacy Policy or how your data is handled can be sent to support@claimfocus.in.