01
Who We Are
RXI Care Technologies Pvt. Ltd. ("we", "us", "RXI Care") operates the RXI Care platform at rxi.care and associated subdomains. We process personal data in compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable health data regulations.
This Privacy Policy explains how we collect, use, store, share, and protect information about you and, where applicable, your patients.
Note on patient data: You (the healthcare provider) are the data fiduciary for your patients' personal health data. RXI Care acts as a data processor on your instructions. This policy covers both your account data and patient data held on your behalf.
02
Data We Collect
Account & Professional Data
- Name, email address, mobile number
- Professional registration number and licence details
- Organisation/clinic name, address, GST number
- Profile photo (optional)
Patient Data (entered by you)
- Patient name, date of birth, gender, contact details
- Medical history, complaints, diagnoses, clinical notes
- Prescriptions, lab orders, investigations
- Vitals, follow-up records, treatment plans
- ABHA ID and linked health records (if ABDM-enabled)
Communication Data
- Messages sent via the Inbox (WhatsApp, SMS, email) to patients
- Appointment reminders and notifications
Usage & Technical Data
- Login timestamps and session information
- Feature interactions and navigation patterns
- Device type, browser, operating system, IP address
- Error logs and crash reports
03
How We Use Your Data
We process your data to:
- Provide the Service — host records, enable AI Scribe, generate prescriptions, manage appointments and billing
- AI processing — transcription and note generation run on secure, HIPAA-aligned AWS infrastructure; audio is not retained beyond the session
- Communications — send transactional messages (appointment reminders, OTPs, payment confirmations)
- Billing — process subscription payments and issue invoices
- Platform improvement — analyse aggregated, anonymised usage to improve features (never individual patient data)
- Legal compliance — respond to lawful requests from authorities, maintain audit logs
- Security — detect fraud, abuse, and unauthorised access
04
ABDM & ABHA Compliance
RXI Care supports integration with the Ayushman Bharat Digital Mission (ABDM). Where ABDM features are enabled:
- Data sharing with the ABDM Health Information Exchange (HIE) occurs only on the basis of a valid patient consent artefact
- We act as a Health Information Provider (HIP) and, where applicable, a Health Information User (HIU) under ABDM regulations
- Patient ABHA-linked data is governed by ABDM's own privacy framework in addition to this policy
05
Storage & Security
Infrastructure
All data is stored on Amazon Web Services (AWS) infrastructure hosted in India (ap-south-1 — Mumbai region). Data does not leave India except where you explicitly use integrations with third-party services.
Encryption
- Data in transit: TLS 1.2 or higher on all connections
- Data at rest: AES-256 encryption for database storage
- Sensitive credentials (access tokens, API keys) encrypted at the application layer
Access Controls
- Role-based access control (RBAC) — staff access only what their role permits
- RXI Care staff access to customer data is restricted and logged
- Multi-factor authentication available for all accounts
Incident Response
In the event of a data breach affecting your personal data, we will notify you and relevant authorities as required by the DPDP Act and applicable regulations, within the prescribed timelines.
06
Data Sharing
We do not sell, rent, or trade your data or your patients' data. We share data only with:
Sub-processors
Trusted third-party processors under written Data Processing Agreements, including:
- AWS — cloud infrastructure (India region)
- Twilio — SMS delivery
- Meta (WhatsApp Business API) — WhatsApp messaging
- Resend / SendGrid — transactional email delivery
- Firebase (Google) — push notifications
- AWS Transcribe / Bedrock — AI Scribe transcription and note generation
Legal Requirements
We may disclose data to law enforcement, courts, or regulators when legally compelled to do so. We will notify you where legally permitted before complying with such requests.
Business Transfer
In the event of a merger, acquisition, or sale of assets, data may be transferred to the acquiring entity, subject to equivalent privacy protections.
07
Data Retention
- Active subscription: all data retained for the duration of your subscription
- Post-cancellation: data retained for 90 days to allow export, then securely deleted
- Backup data: purged within 180 days of account closure
- AI Scribe audio: session audio is not retained after transcription is complete
- Communication logs: message metadata retained for audit purposes for 12 months
You may export your complete data at any time via the platform's export feature under Settings.
08
Your Rights (DPDP Act 2023)
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- Access — obtain information about what personal data we hold about you
- Correction — request correction of inaccurate or incomplete personal data
- Erasure — request deletion of personal data where no legal retention obligation applies
- Grievance redressal — raise complaints about our data handling
- Nomination — nominate another individual to exercise rights on your behalf
- Withdraw consent — where processing is consent-based, withdraw consent at any time
To exercise any right, contact our Data Protection Officer at app@rxi.care with the subject line "Privacy / Data Rights Request". We will respond within 30 days.
09
Cookies & Tracking
Essential Cookies
Required for authentication and core platform functionality. Cannot be disabled without breaking the Service.
Analytics Cookies
We use privacy-respecting analytics (anonymised, no cross-site tracking) to understand how the platform is used. You may opt out by disabling analytics cookies in your browser settings.
No Third-Party Ad Tracking
We do not use advertising cookies, pixel tracking, or behavioural profiling.
10
Children's Privacy
The Service is not directed to children under 18 as account holders. Patient records of minors may be created by you as a healthcare provider, under your responsibility and with appropriate guardian consent. We do not knowingly collect personal data from minors for our own marketing or service purposes.
11
Changes to This Policy
We may update this Privacy Policy periodically. We will notify registered users by email before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
