Nabhaya privacy policy

Version 2026-12-26

Nabhaya is clinic management software provided by improveFX Technologies Private Limited (CIN U63999DL2024PTC438932), registered office E-49/5, First Floor, Okhla Industrial Area Phase II, New Delhi, Delhi 110020, India ("Nabhaya", "we", "us"). This policy explains what personal data we handle, why, and the choices and rights you have under the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the rules under them.

1. Two roles: patient data and our own data

• Patient data. Clinics use Nabhaya to keep their patients' records. For that data the clinic is the Data Fiduciary: it decides why and how the data is used. Nabhaya is the clinic's Data Processor and uses patient data only on the clinic's instructions, to provide the service. Each clinic publishes its own privacy notice (linked on its booking page, slips and bills). Patients should contact their clinic to see, correct or erase their records or to withdraw consent; we help clinics do this.
• Our own data. For clinic staff accounts, clinic owners and billing contacts, referral partners, Authorised Partners and the clinic contacts they introduce, and visitors to our website, Nabhaya is the Data Fiduciary and this policy applies directly.

2. Data we collect (as Data Fiduciary)

• Account details: name, email, mobile number, role, clinic, and for doctors their qualification and registration number.
• Sign-in and security records: password hash (never the password itself), two-step verification settings, passkeys, IP address, browser and device details, sign-in times and security events.
• Clinic and billing details: clinic name and address, GSTIN, PAN, authorised signatory, plan, invoices and payment status. Card, UPI and bank payments are handled by our payment partner, currently Razorpay; we do not store card or bank account numbers or full UPI IDs. If you turn on automatic payment, the partner holds the mandate; its replies when we check a mandate may include the full bank account number or UPI ID, which we discard. We keep only its reference, type, a masked label (such as the bank or card name with the last four digits), the approved limit, its status and expiry, the name, email and mobile number sent with each payment, and who approved it, when, from which device and under which version of the wording.
• Referral partners: name, email, mobile number, PAN and bank or UPI details for payouts. PAN and bank details are encrypted.
• Authorised Partners and the clinic contacts they introduce: see section 4C.
• Enquiries: what you send us through the contact, sign-up or support forms.

3. Why we use it

• To provide, secure and support the service, including sign-in, two-step verification, fraud and abuse prevention and audit trails.
• To bill subscriptions, message credits and storage, issue GST invoices and meet tax and accounting law.
• To run the referral program, including PAN-based tax deduction at source.
• To run the Authorised Partner program (section 4C), including commission, tax deduction at source and GST invoices.
• To reply to enquiries and send service messages (for example security alerts and renewal reminders).
• Only if you opt in: to send you Nabhaya product updates, offers and event invitations (section 4A).

We do not sell personal data, use patient data for advertising or analytics, or use patient data to train artificial-intelligence models.

4. Legal basis

We process your data with your consent (given when you sign up, apply or contact us) or for legitimate uses allowed by the DPDP Act, such as meeting legal obligations, responding to emergencies and keeping the service secure. You can withdraw consent at any time (section 8); this does not affect processing already done, and some data must still be kept by law.

4A. Product updates and offers (optional)

We send news about new features, offers and events from improveFX Technologies Private Limited (Nabhaya) by email and WhatsApp only to clinic owners, administrators, doctors and staff, referral partners and website visitors who ticked the optional box for it: on the clinic onboarding form, when accepting an invitation, when setting up an account, on our sign-up form, or later in Account settings → Preferences. The box is never ticked for you, and saying no does not affect your use of Nabhaya. We record when and where you agreed and the version of the wording you saw (currently 2026-11-v1).

You can withdraw just as easily, at any time: turn off "product updates" in Account settings → Preferences, use the unsubscribe link in any such email (no sign-in needed), or write to [email protected]. We stop within 48 hours. Service messages about your account, security, billing, renewals and changes to our terms or this policy are still sent, because they are needed to provide the service. Patients never receive Nabhaya marketing, and clinic contact details are passed to our customer-relationship system for marketing only with this consent.

4B. Referral partners and referred clinics

When a clinic signs up through a referral partner's link or code, we show the clinic the partner's name, and the partner sees only the clinic's name, city, sign-up date and sign-up status (setting up, on trial, subscribed or not active), plus the partner's own reward. Partners never see the clinic's contact details, plan, prices, payments or any patient data.

4C. Authorised Partners

Nabhaya also works with Authorised Partners: individuals and firms we appoint to introduce Nabhaya to clinics. They are separate from referral partners (section 4B).

• Clinics a partner introduces. When a partner asks us to send a clinic our onboarding link, the form names the partner and says what the partner will see. While the clinic is active on Nabhaya, the partner sees its name and city, plan, status, trial and renewal dates, whether automatic payment is on, and the subscription amount (before GST) that the partner's commission is worked out from (added up with the partner's other clinics until the partner's monthly statements start, then shown for each commission), and gets reminders when the trial or a renewal is due. Once the clinic is no longer active, the partner sees only its name, city and since when. Partners never see patients or any patient data, staff, invoices, GST details, payment details or how the clinic uses Nabhaya. The clinic's Billing page names its partner, and questions go to [email protected].
• People a partner tells us about (leads). Before adding a clinic contact, the partner tells them about Nabhaya and shares our notice for leads (/partner-lead-notice). We hold the contact's name, mobile number, email, city and clinic details and the partner's notes of their meetings, only to talk to the clinic about Nabhaya and to record which partner introduced it. We send leads no messages of our own and never share a lead with another partner. If the clinic does not join, we remove the contact details 180 days after the lead is closed and keep a restricted copy for one year, then erase it. To stop being contacted and have the details removed, write to [email protected]; no partner can then add the contact again.
• Partners' own details. We hold each partner's name, contact details, PAN, GSTIN and bank or UPI details (PAN and bank details are encrypted) to appoint the partner, pay commission, deduct tax at source and handle GST invoices, and keep payout and tax records as long as tax law requires.

5. Who we share it with

We share only what each provider needs, under contracts that require them to protect it:

• Amazon Web Services: hosting, database and backups (Mumbai, India).
• Cloudflare: network security, content delivery, and file storage (R2) for uploaded files and per-clinic backup copies. Private files and backups are encrypted by us before upload and the keys stay on our servers in India. R2 storage may be outside India; we plan to move these files to storage in India.
• Meta Platforms (WhatsApp Business): appointment, billing and other messages and sign-in codes.
• Google: email delivery and Firebase push notifications for staff.
• Razorpay: payments, including automatic-payment mandates if you turn them on.

Video consultations take place on the video service the clinic chooses (for example Google Meet in the clinic's own Google account, or the clinic's own Zoom link). That service works for the clinic under the clinic's own agreement with it; we do not host or record video calls and send it no patient details, only the meeting link to the patient.

Some of these providers process limited data (such as phone numbers, email addresses and message content) outside India. We transfer data abroad only as permitted by the DPDP Act and any restrictions notified under it. We disclose data to authorities only when required by law.

6. Cookies

We use only cookies that are needed for the service to work: keeping you signed in, the screen lock, recognising a trusted device for two-step verification, confirming a booking phone number and opening a shared document. We do not use advertising or analytics cookies, and we do not track you across other websites.

7. How long we keep it

• Staff accounts: while the clinic uses Nabhaya, then erased with the clinic's account (see our Terms).
• When a clinic's subscription ends and is not renewed (after a 7-day grace period): for 90 days the account is read-only, so staff can still view and export the clinic's data but not change it; from day 90 to day 180 only the clinic's administrators can sign in, to renew or export. We remind the administrators by email and WhatsApp when the subscription ends and 60, 30 and 7 days before deletion. On day 180 the clinic's data, including patient records, files, staff accounts and settings, is permanently deleted, unless we agreed in writing to keep it longer, and we email the administrators a deletion certificate. Renewing before then cancels the deletion.
• Security and audit logs: at least 180 days and normally one year, as required by CERT-In directions.
• Invoices and payment records (including GST documents) for clinics: eight years, as tax law requires, also after the clinic's account is deleted.
• Referral and payout records: as long as tax law requires.
• Enquiries that do not become customers: up to two years.

Encrypted backups expire on their normal schedule (daily and weekly copies within 35 days, the first copy of each month within about 13 months), are used only to recover from a disaster and are never restored for use once the data has been deleted.

8. Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete, update or erase it;
• withdraw consent you have given;
• nominate another person to exercise your rights if you die or become unable to;
• raise a grievance with us, and if unresolved, with the Data Protection Board of India.

Email [email protected] from the address registered with us (or tell us how to verify you). We reply within 30 days. Patients: please contact your clinic first; if you cannot reach it, write to us and we will pass your request to the clinic.

9. Security

Data is encrypted in transit and at rest, sensitive fields and files are encrypted again by the application, access is limited by role and protected by two-step verification, every access to patient records is logged in a tamper-evident audit trail, and backups are encrypted. If a personal data breach affects you, we will tell you and the Data Protection Board as the law requires, and report cyber incidents to CERT-In.

10. Children

Our own services are for adults. Clinics may record data of patients under 18 only with the verifiable consent of a parent or lawful guardian, and patient data of children is never used for marketing.

11. Grievance Officer

Vikash Kumar Pal, Chief Executive Officer, improveFX Technologies Private Limited, E-49/5, First Floor, Okhla Industrial Area Phase II, New Delhi, Delhi 110020, India. Email: [email protected]

We acknowledge grievances within 48 hours and resolve them within 30 days.

12. Changes

We will post any change here with a new version date, and tell account holders in the application or by email before a material change takes effect.

Draft pending legal review. The final text may change before launch.