Privacy Policy — RASYA Care
Last updated: 5 October 2026 · Data Fiduciary: RASYA Foundation (a Section 8 company), India · Contact: rasya@rasya.org
RASYA Care (“the App”) is a clinical and practice-management application used by authorised staff of the RASYA group — RASYA Clinic (Hyderabad), RASYA Institute (Guntur) and RASYA Hearing — to deliver and record patient care. The App is operated by RASYA Foundation (“we”, “us”). This policy explains what information the App handles, why, and your rights. It is written to be consistent with India’s Digital Personal Data Protection Act, 2023 (DPDP).
1. Who this App is for
RASYA Care is an internal tool for clinicians and clinic staff. It is not a public consumer app. Patients do not log in to this App; their information is entered and managed by treating staff as part of their care.
2. Information we handle
- Staff account information — name, role, work email, and login credentials for the people who use the App.
- Patient personal information — name, contact details, demographics, guardian/family details, and patient or guardian photographs captured for identification.
- Patient health information — medical history, consultations and clinical notes, diagnoses, test orders and results, reports, hearing-device and therapy records, consents and forms.
- Billing information — quotations, invoices, payments and receipts related to care.
- Activity records — an audit log of actions taken in the App, kept for safety and accountability.
Health information and children’s information are treated as sensitive and handled with additional care (see sections 6 and 8).
3. Why we handle it
We use this information only to provide and document clinical care — registration, consultations, diagnosis and treatment, reports, hearing devices and therapy, billing, follow-ups and recalls — and to meet our record-keeping, safety and legal obligations. We do not sell personal information, and we do not use it for advertising.
4. Legal basis
We handle personal data on the basis of consent and for the legitimate purpose of providing healthcare that a patient (or their guardian) has approached us for, as permitted under the DPDP Act. Patients are asked for consent as part of registration and care.
5. How it is stored and protected
Information is stored in a secure, access-controlled database (hosted on Supabase) with encryption in transit. Access is restricted to authorised staff through individual accounts and role-based permissions enforced at the database level, so a staff member sees only the records their role allows. The App is used on managed clinic devices.
6. Children’s information
A significant part of RASYA’s work is care for children. Information about a child is entered and accessed only for that child’s care, with the consent of a parent or guardian, and is never used for tracking or advertising.
7. Who can see the information
Only authorised RASYA staff involved in a patient’s care. We use trusted service providers (such as our cloud database provider) solely to operate the App on our behalf, under confidentiality obligations. We may disclose information where required by law or to protect safety.
8. How long we keep it
Clinical records are retained for as long as needed to provide care and to meet medical record-keeping and legal requirements, after which they are securely deleted or anonymised.
9. Your rights
Under the DPDP Act you may request access to, or correction of, your personal information, withdraw consent, or raise a grievance. To do so, contact our Grievance Officer at rasya@rasya.org. We will respond within the time required by law.
10. Data breaches
If a personal-data breach occurs, we will act to contain it and notify the Data Protection Board and affected individuals as required by law.
11. Changes to this policy
We may update this policy and will revise the “Last updated” date above when we do.
12. Contact
RASYA Foundation — rasya@rasya.org