Who we are
Hosphi is the operating system for Indian outpatient clinics. In this policy, "Hosphi", "we", "us" and "our" mean [legal entity name], the operator of hosphi.com.
The legal entity is registered in [jurisdiction]. The contact for privacy questions is below.
Privacy questions: hello@hosphi.com
What the marketing site collects
This policy covers the public marketing site at hosphi.com. When you send an email or use a pilot contact, we receive your email address and whatever you write in the message.
Our hosting provider records standard server logs: the page requested, the time, an IP address and basic browser information. We use the logs to keep the site running and to investigate abuse.
The marketing site does not set advertising cookies and does not run advertising trackers.
Patient data and the clinic's role
Clinics use Hosphi to run patient care. For patient data, the clinic is the data controller and Hosphi is a data processor. The clinic decides what is collected, why it is collected and who can see it.
We process patient data only on the clinic's instructions and to provide the service. Patients should contact their clinic first about their records. We help the clinic answer export and deletion requests.
The doctor-page request form
A public doctor page can include an appointment request form. When a patient sends it, the name, phone number, preferred time and reason go to the clinic and appear in the clinic's Hosphi workspace.
The form sends a request. It does not confirm an appointment, create a patient account or book a slot. The clinic decides whether to call back and book.
Subprocessors
Hosphi uses Supabase for its database and authentication, and Cloudflare for hosting and network security. Both process data on our instructions.
This is the current subprocessor list. We will update this policy before we add another subprocessor that handles patient data.
Retention
We keep clinic and patient data while the clinic's account is active, then for the period needed to close the account, resolve disputes and meet legal obligations.
Contact messages are kept until the question is resolved, unless we need them for a legal reason. Server logs are kept for a limited period.
Export and deletion
A clinic can export patient, appointment and consultation records as CSV from inside Hosphi. The clinic can also ask us for an export or for deletion of its organisation's data.
We respond within a reasonable period. Some records may need to be kept where the law requires it, and the clinic remains responsible for its own patient-record obligations.
If you are a patient, ask your clinic first. We will assist the clinic with the request.
Export and deletion requests: hello@hosphi.com
Security
Access is checked on the server at the clinic the record belongs to. The security page sets out access, permissions, audit and data in more detail.
Hosphi is pre-certification. We do not claim SOC 2, ISO 27001, ABDM certification or data residency. Report a security issue to the address below.
Security contact: security@hosphi.com
Changes to this policy
This is a draft. We will publish the final policy with an effective date before the first pilot goes live.
When the policy changes, the new version will appear on this page with a new effective date.