RAHAT eHealth

Overview

Cardiometcare Plus Health Solutions Pvt Ltd, operating under the brand name ClinAlly (hereinafter "we", "us", or "our"), is committed to protecting the privacy and security of your personal information and health data. This Privacy Policy explains our practices regarding the collection, use, disclosure, and safeguarding of information when you use RAHAT eHealth, our personal health management application.

By downloading, installing, or using RAHAT eHealth, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.

Important: RAHAT eHealth handles sensitive personal health data. We adhere to the Ayushman Bharat Digital Mission (ABDM) data privacy framework, applicable provisions of India's Digital Personal Data Protection Act, 2023, and Google Play's health app requirements.

App Covered

This Privacy Policy applies to the RAHAT eHealth application (Package: com.clinally.rahat) — a personal health management application for individuals and patients, as well as the ClinAlly website at clinally.com and any associated web pages or APIs.

RAHAT eHealth is designed to help you track your health metrics, manage chronic conditions, store and share health records, and access personalised health education content.

Data We Collect

The categories of data we collect depend on which features of RAHAT eHealth you use.

3.1 Information You Provide Directly

• Account registration data: Name, email address, mobile number, date of birth, gender
• Health profile: Height, weight, blood group, known allergies, chronic conditions, current medications, family medical history, and personal health goals
• Vitals and health logs: Blood pressure, blood glucose, heart rate, SpO₂, exercise logs, diet entries, sleep data, and symptom records you manually enter
• Menstrual health (optional): Cycle data if you choose to enable this feature
• ABHA number: If you choose to link your Ayushman Bharat Health Account (ABHA), we collect your 14-digit ABHA number and associated profile information
• Uploaded documents: Health records, lab reports, prescriptions, or any documents you upload to the app
• Communications: Messages, feedback, or support requests you send us

3.2 Information Collected Automatically

• Device information: Device model, operating system version, unique device identifiers, mobile network information
• Usage data: Features accessed, time spent in app, screens viewed, buttons tapped, and general app usage patterns
• Log data: IP address, timestamps, crash reports, and error logs
• Location data: Approximate location (city/state level) for service availability — precise GPS location is never collected without your explicit permission

3.3 Data We Do Not Collect

• We do not collect professional medical credentials (these are only collected in mPower Health)
• We do not collect clinical patient records from healthcare providers
• We do not access your phone contacts, call logs, or SMS messages
• We do not collect precise GPS location passively in the background

How We Use Your Data

We use the information we collect for the following purposes:

• Service delivery: To operate and provide health tracking, wellness insights, and related features within RAHAT eHealth
• Personalisation: To tailor health insights, reminders, and content to your specific health profile and goals
• Health reminders: To send medication reminders, appointment alerts, and wellness notifications you have opted into
• Account management: To create and manage your account, verify your identity, and communicate with you
• Customer support: To respond to your queries and resolve issues
• Analytics and improvement: To understand how the app is used and to improve features, performance, and user experience — all analytics are conducted on anonymised or aggregated data
• Legal compliance: To comply with applicable laws, regulations, and government requirements including ABDM integration mandates
• Research: Anonymised, aggregated health data may be used for public health research — individual users are never identifiable in such research

We do not sell, rent, or trade your personal or health data to advertisers, data brokers, or any third party for commercial gain.

Data Sharing

We share your data only in the following limited circumstances:

5.1 With Healthcare Providers (With Your Consent)

If you choose to share your health record with a doctor or hospital through RAHAT eHealth, data is shared only after you provide explicit, informed, and revocable consent. Each consent request specifies the purpose, duration, and scope of access.

5.2 With the ABDM Ecosystem

If you link your ABHA account, your health records may be shared with ABDM-registered Health Information Providers (HIPs) and Health Information Users (HIUs) — strictly in accordance with ABDM's consent management architecture. You remain in full control at all times.

5.3 With Service Providers

We engage carefully vetted third-party service providers who assist us in operating our platform (e.g., cloud hosting, analytics, customer support tools). These providers process data on our behalf under strict data processing agreements and are prohibited from using your data for their own purposes.

5.4 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of ClinAlly, our users, or the public.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you of any such transfer and ensure your data continues to be protected under equivalent or stronger terms.

Health Data & ABDM Compliance

ClinAlly is an official National Health Authority (NHA) partner. RAHAT eHealth is designed to be compliant with the Ayushman Bharat Digital Mission (ABDM) technical and policy standards.

• Health data is stored in encrypted form using AES-256 encryption at rest
• All data transmission uses TLS 1.2 or higher encryption
• We implement the ABDM consent architecture: no health record is accessed or shared without an active, patient-granted consent artefact
• Users can view all active consents and revoke any consent at any time from within the app
• Health records are stored on servers located within India, in compliance with applicable data localisation requirements

Data Security

We implement comprehensive technical, administrative, and physical safeguards to protect your data against unauthorised access, loss, alteration, or destruction:

• AES-256 encryption for all stored health data
• TLS 1.2+ for all data in transit
• Role-based access controls — only authorised personnel can access production data
• Regular security audits and penetration testing
• Multi-factor authentication for all administrative systems
• Anonymisation of data used for analytics and research
• Secure coding practices and regular vulnerability assessments

While we take every reasonable precaution, no method of electronic storage or transmission is 100% secure. If you believe your account has been compromised, please contact us immediately at info@clinally.com.

Data Retention

We retain your data only as long as necessary to fulfil the purposes described in this policy, or as required by law:

• Account data: Retained for the duration of your active account plus 3 years after account deletion, for legal compliance purposes
• Health records and vitals: Retained as long as you maintain an active account. Upon deletion, health records are purged within 30 days, except where retention is required by applicable regulations
• Usage logs: Retained for up to 24 months for security and service improvement, then deleted
• Anonymised analytics data: May be retained indefinitely as it cannot be linked to any individual

You may request deletion of your account and associated data at any time through the app settings or by contacting us.

Your Rights

Under applicable Indian law and ABDM guidelines, you have the following rights regarding your personal and health data:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your account and personal data, subject to legal retention requirements
• Right to Withdraw Consent: Withdraw consent for any specific data processing activity at any time, without affecting prior lawful processing
• Right to Data Portability: Request your health records in a machine-readable format compatible with ABDM standards
• Right to Grievance Redressal: Lodge a complaint about our data practices with our designated Grievance Officer

To exercise any of these rights, email us at info@clinally.com with the subject line "Privacy Rights Request". We will respond within 30 days.

Children's Privacy

RAHAT eHealth is not intended for use by children under the age of 18 without parental consent. Users aged 13–17 may use RAHAT eHealth only with the explicit consent and supervision of a parent or guardian. We do not knowingly collect personal data from children under 13. If a parent or guardian becomes aware that their child has provided us with personal information without consent, please contact us at info@clinally.com and we will promptly delete such information.

Cookies & Tracking Technologies

Our website (clinally.com) uses cookies and similar tracking technologies to improve your browsing experience and analyse site traffic. The types of cookies we use include:

• Essential cookies: Necessary for the website to function correctly. These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with the website (e.g., Google Analytics). These are anonymised and no personal data is shared with third parties.
• Preference cookies: Remember your language and display preferences.

The RAHAT eHealth mobile application does not use browser cookies. It may use device identifiers for session management and analytics purposes as described above.

You can control cookie preferences through your browser settings. Disabling analytics cookies will not affect core website functionality.

Third-Party Services

RAHAT eHealth may integrate with or link to third-party services. This policy does not cover the privacy practices of third parties. We encourage you to review the privacy policies of any third-party service you use:

• Google Play / Apple App Store: Governed by Google and Apple's respective privacy policies
• ABDM / NHA: Governed by the National Health Authority's privacy framework
• Firebase (Analytics & Crashlytics): Google's privacy policy applies to analytics and crash reporting data
• Payment processors (if applicable): Subject to their own PCI-DSS compliant privacy policies

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send a notification through the app or via email to registered users
• Where required by law, obtain fresh consent before the changes take effect

Continued use of RAHAT eHealth after the effective date of any changes constitutes your acceptance of the revised policy. If you do not agree with the updated policy, you should discontinue use and contact us to delete your account.

Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please contact us:

We will acknowledge your query within 48 hours and respond fully within 30 days of receipt.