Privacy Policy

• When we decide why and how data is used, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023. This covers visitors to our website, people who ask for a demo or start a trial, and the account details of our Customers and their Users.
• For patient data, the clinic or hospital is the Data Fiduciary and we are its Data Processor. Patient records entered into HMS4all are processed only to provide the Service and on that Customer's instructions. We never sell patient data and never use it for advertising. A patient who wants to see, correct or erase his or her records should contact the clinic or hospital concerned; we will help the Customer respond.

• Enquiries, demos and trials: name, organisation, role, phone number, email address, city and your message.
• Customer accounts: names, email addresses, mobile numbers and roles of Users; clinical establishment and practitioner registration numbers; facility and professional IDs used for ABDM (HFR and HPR IDs); GSTIN and billing address.
• Payments: invoice details and the transaction references returned by Razorpay. We do not receive or store full card numbers, CVV, UPI PIN or net-banking passwords.
• Usage and technical data: log-in times, IP address, browser and device type, pages and features used, error logs, and the audit trail of actions taken in the Service.
• Cookies: essential cookies that keep you signed in and protect the Service.
• Customer content (as Processor): patient demographics, ABHA number or address (with consent), clinical notes, prescriptions, reports, images and billing records that our Customers enter.

• to respond to enquiries and arrange demonstrations;
• to create and manage accounts, and to provide, secure and support the Service;
• to bill, collect payments and keep tax and accounting records;
• to send service messages, such as log-in alerts, invoices and maintenance notices;
• to improve the Service using aggregated usage information;
• to comply with law and with lawful requests from authorities.

We use personal data on the basis of your consent or of the legitimate uses permitted by the Act, such as information you give us voluntarily for a stated purpose. Marketing messages are sent only with consent, and you can opt out at any time.

HMS4all's AI agents work inside the Customer's own account to draft, triage and reconcile information. Their output is a proposal: a clinical proposal from an agent is never approved automatically. We do not train or fine-tune AI models on your data. AI features use your facility's records and settings to answer requests. AI features use Google's Gemini service through Google's paid API, under terms that do not let Google use the data to train its models. The information sent depends on the feature — for example, a clinical note's complaint, diagnosis and history, or the results being interpreted. Some features currently include the patient's name or record number; we are removing these where the task does not need them.

• Service providers who help us run the Service — cloud hosting, email, SMS and WhatsApp messaging, and support tools — under contracts that bind them to protect the data and use it only for our instructions;
• Razorpay, our payment partner, for processing online payments;
• the National Health Authority's ABDM network, only when a Customer uses ABDM features and only with the patient's consent through the ABDM consent process;
• government authorities and regulators, where the law requires it;
• a buyer or successor, if our business is transferred, under the same protections.

We do not sell personal data.

Customer data is stored on servers in India (Mumbai). AI features and email use Google services, which may process data outside India under Google's data-protection terms.

Role-based access control, encrypted connections (HTTPS/TLS), separation of each Customer's data, audit trails, daily backups and periodic vulnerability assessments. Our staff can reach Customer data only where needed to provide support. If a personal data breach affects Customer data, we inform the Customer without undue delay and in any case within 72 hours, and we notify the Data Protection Board of India and affected persons as the law requires.

• Account and billing records: for the subscription and afterwards for as long as tax and accounting laws require.
• Customer content: for the subscription; on termination it is exported to the Customer within 15 days and then deleted from live systems, with backup copies rolling off within 30 days.
• Enquiries that do not become Customers: deleted when no longer needed, and within 12 months at the latest.

Under the Digital Personal Data Protection Act, 2023 you may ask us for a summary of the personal data we hold about you, ask us to correct, complete, update or erase it, withdraw consent you have given, nominate another person to exercise your rights, and have grievances redressed. Write to the Grievance Officer below. We respond to requests within 30 days and to grievances within 5 business days. If you are not satisfied with our response, you may approach the Data Protection Board of India.

The Service is meant for healthcare establishments and is not directed at children. Where a clinic records a child's health data, the clinic obtains the consent of the parent or lawful guardian.

We will post any update on this page with a new date, and inform Customers of material changes by email.

• Email: contact@hms4all.com
• Phone / WhatsApp: +91 96937 98977 (Monday–Saturday, 9:00 AM – 6:00 PM IST)
• Post: Curasync Technologies LLP, Kaitha, Ramgarh Cantt, Ramgarh – 829122, Jharkhand, India
• Grievance Officer: Dinesh Kumar, Designated Partner, Curasync Technologies LLP — contact@hms4all.com