Legal
01
Siha ("we", "us", "our") is a healthcare appointment management platform operated by [COMPANY LEGAL NAME], a company incorporated under the Companies Act 2013, with its registered office at [REGISTERED ADDRESS], India.
We act as the Data Fiduciary under the DPDP Act 2023 for all personal data processed through the Siha mobile application and associated services.
For questions about this policy, contact us at support@sihahealth.in.
02
We collect two categories of data, kept separate by design through pseudonymization.
Collected at registration and stored separately from your medical records:
| Data | Purpose | Required |
|---|---|---|
| Full name | Display and identity | Yes |
| Age | Healthcare context | Yes |
| Gender | Healthcare context | Yes |
| Blood group | Healthcare context | Yes |
| Phone number | Authentication via OTP | Yes |
| Email address | Optional contact | No |
| Profile photograph | Identity display | No |
Stored under a pseudonymous ID — not directly linked to your name in our database:
| Data | Purpose |
|---|---|
| Appointment records | Booking management |
| Consultation notes written by your doctor | Medical history reference |
| Prescription photographs uploaded by you | Personal health records |
| Blood report images and extracted values | Health analytics |
| Data | Purpose |
|---|---|
| Device FCM token | Push notifications |
| Approximate GPS location | Finding nearby doctors |
| App usage logs | Bug fixing and improvement |
| Crash reports | App stability |
Collected when a doctor is registered on the platform. Medical license numbers are used solely for internal verification and are not displayed to patients.
| Data | Purpose | Required |
|---|---|---|
| Full name | Profile display to patients | Yes |
| Phone number | Authentication and account identity | Yes |
| Medical specialization | Search and profile display | Yes |
| Medical qualification | Profile display | Yes |
| Years of experience | Profile display | Yes |
| Medical license number | Identity verification | Yes |
| Profile photograph | Profile display to patients | No |
| Languages spoken | Profile display | No |
Collected when a receptionist registers their clinic. Clinic license numbers are used solely for internal verification and are not displayed publicly.
| Data | Purpose | Required |
|---|---|---|
| Receptionist name | Account identity | Yes |
| Clinic contact phone number | Authentication and patient-facing contact | Yes |
| Clinic name | Search and profile display | Yes |
| Clinic address and location | Search and distance display | Yes |
| Clinic license number | Identity verification | Yes |
When a receptionist creates an offline booking for a patient without a Siha account, only minimal information is recorded. No Siha account is created. If a walk-in patient later creates an account with the same phone number, their offline appointment history will become visible.
| Data | Purpose | Required |
|---|---|---|
| Patient name | Appointment record | Yes |
| Age | Clinical context | Yes |
| Gender | Clinical context | Yes |
| Phone number | Record linkage if account created later | No |
03
We use your data only for the following purposes:
We do not use your data for advertising, profiling, or selling to third parties.
04
Under the DPDP Act 2023, we process your personal data on the basis of your explicit, informed consent, given at the time of registration.
05
We share your data with the following third-party processors solely for service delivery. All processors are contractually bound to process data only as instructed, maintain security standards, and never use your data for their own purposes.
| Third Party | Data Shared | Purpose |
|---|---|---|
| Google Firebase (Google LLC) | All app data | Cloud storage, authentication, push notifications |
| Google Cloud Vision API | Blood report images | OCR text extraction for analytics |
| Gupshup Technologies Pvt. Ltd. | Phone number, appointment details | WhatsApp reminder messages |
| Siha Health (WhatsApp Business) | Phone number, appointment time | Message delivery |
We do not sell your data to any third party.
The doctor associated with your appointment can view your consultation notes (written by them), prescription photos you choose to upload, and your first name, age, and gender for clinical context. Doctors cannot access your phone number, email, or records from other doctors' appointments.
Clinic receptionists can view your appointment date, time, status, and first name for check-in. Receptionists cannot access consultation notes, prescription photos, blood reports, or any medical data.
Our internal team accesses doctor and clinic license numbers solely to verify credentials before approving a listing. This is limited to authorised personnel and is not shared externally.
Walk-in patient details are visible only to the receptionist who entered them and the doctor associated with that appointment.
Your data is stored on Google Firebase servers. Firebase data for Indian users is hosted in the asia-south1 (Mumbai) region. Some Firebase services may process data in other regions. Google complies with applicable data protection laws for cross-border transfers.
06
| Data Type | Retention Period |
|---|---|
| Account & PII data | Until you delete your account |
| Appointment records | Until you delete your account |
| Consultation notes | Until you delete your account |
| Prescription photos | Until you delete your account |
| Blood report data | Until you delete your account |
| Technical / crash logs | 90 days |
| Anonymized aggregate analytics | Indefinitely (cannot be linked to you) |
| Doctor profile and license data | Until doctor account is removed |
| Clinic and receptionist data | Until clinic account is removed |
| Walk-in patient appointment records | Until associated clinic account is removed |
Upon account deletion, all identifiable data is permanently deleted within 30 days.
07
In the event of a data breach likely to affect your rights, we will notify you and the Data Protection Board of India within the prescribed timeframe.
08
You can view all your profile data within the app at any time.
You can update your name, age, gender, blood group, email, and profile photo from the Profile screen in the app.
Delete your account from Profile → "Delete Account". This action is irreversible, permanently removes all personal data and medical records, and is completed within 30 days.
Contact our Grievance Officer (see §10). We will acknowledge within 3 business days and resolve within 30 days. Unresolved grievances may be escalated to the Data Protection Board of India once constituted.
You may nominate another individual to exercise your data rights in the event of your death or incapacity. Contact support@sihahealth.in to register a nominee.
You may withdraw consent at any time by deleting your account. Note that this makes it impossible for us to continue providing services.
Doctors can update their specialization, qualification, experience, languages, and profile photo in-app. Name and license number changes require contacting support@sihahealth.in. To remove a doctor or clinic account, contact us — appointment records are retained for patient medical history.
Walk-in patients without a Siha account can request data access, correction, or deletion by contacting support@sihahealth.in with their name and appointment date.
09
Our platform is open to users of all ages including individuals under 18. We collect no data beyond what is listed in §2 from any user, regardless of age. If you believe a child's data has been collected inappropriately, contact support@sihahealth.in.
10
As required under the DPDP Act 2023 and the IT Act 2000:
Grievances will be acknowledged within 3 business days and resolved within 30 days.
11
12
[COMPANY LEGAL NAME]
[REGISTERED ADDRESS]
Email: support@sihahealth.in
Phone: +91 96060 50789