Privacy policy

This service is operated by MyParcha Innovations, a sole proprietorship registered in India, at Plot No. 419, A Block, Dayal Residency, Faizabad Road, Chinhat, Lucknow, Uttar Pradesh 226028, India. In this policy “we”, “us” and “MyParcha” mean that entity.

This policy is written to the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 together with the rules made under it.

MyParcha sits in two distinct positions, and your rights differ depending on which one applies to you.

• When a clinic, lab or hospital uses MyParcha, that organisation decides what is collected and why. It is the Data Fiduciary for its patients; we are its Data Processor and act on its instructions. If you are a patient of such a clinic, your first point of contact is the clinic — though you may always write to us and we will help.
• When you use MyParcha directly — /decode, /my, or the enquiry form — we are the Data Fiduciary and the whole of this policy applies to us directly.

Health data. Images of medical documents — prescriptions, lab reports, discharge summaries, hospital bills — and the structured data read from them: medicines, dosages, lab values, dates, diagnoses, procedures and amounts.

Identifiers. A patient’s name, mobile number, age and sex, where a clinic records them or where a patient supplies them to reach their own records.

Account data for clinic staff: name, work email, the organisation they belong to and their role.

Enquiry data that you type into the contact form: name, work email, organisation and what you wrote.

Operational logs. IP address, timestamps and request metadata, kept to run the service, apply rate limits and investigate abuse or a security incident.

We do not sell personal data. We do not use health data for advertising, and we do not build advertising profiles of anyone.

• To read a document and return structured data — the service you or your clinic asked for.
• To let clinic staff review and correct anything the system was not confident about.
• To let a patient reach a copy of their own record, and to verify a document is unaltered.
• To keep an audit trail of who accessed or changed a record, which is a safety requirement, not an optional feature.
• To secure the service — rate limiting, abuse prevention, incident investigation.
• To reply to you if you contact us.

Where we act as a Data Fiduciary, we process personal data on the basis of your consent, or for the legitimate uses permitted by the DPDP Act. You may withdraw consent at any time — see section 9.

Our database, our document storage, our web application and our processing worker all run in Indian regions — Mumbai and Bangalore. Backups stay in India and are encrypted.

We use the following processors. Each is bound to process data only on our instructions, and only for the purpose named.

Beyond these, we disclose personal data only where the law compels it, and we will tell the person concerned unless we are prohibited from doing so.

• Clinical records held for a clinic — for as long as that clinic’s account is active, and thereafter as required by applicable medical record-keeping rules. A clinic may ask us to export and then delete its data.
• Free decode uploads — not retained at all.
• Enquiry form submissions — kept while we are in correspondence with you, and deleted on request.
• Operational logs — a rolling window, kept only as long as needed for security and reliability.
• Audit trails — retained for the life of the associated record, because their purpose is to remain checkable afterwards.

Under the DPDP Act you may:

• Ask what personal data of yours we hold and how it is being processed.
• Have inaccurate or incomplete data corrected, updated or completed.
• Ask for erasure, where we are not required to keep it by law.
• Nominate another person to exercise these rights on your behalf if you are unable to.
• Withdraw consent, as easily as you gave it. Withdrawal does not undo processing already carried out lawfully.
• Have a grievance heard and answered — see section 12.

To exercise any of these, write to [email protected]. We will respond within a reasonable period and in any case within the time the law allows. Where a clinic is the Data Fiduciary for your record, we will forward your request to them and support them in answering it.

Encryption in transit, private storage with short-lived signed access, strict separation between organisations so one clinic can never read another’s records, role-based access for staff, and an audit trail on access to records. The controls are set out in full at /security, along with what has not been done yet.

MyParcha is not offered directly to children. Where a clinic records a child’s medical document, the clinic obtains consent from the parent or lawful guardian as part of treatment. We do not track children, do not target advertising at anyone, and do not process a child’s data in any way likely to cause a detrimental effect on their wellbeing.

If you are unhappy with how your data has been handled, tell us and we will answer. The full procedure, including escalation, is at /grievance.

Grievance Officer

Aditya Kumar Singh

Email

[email protected]

Telephone

+91 63873 33961

Post

Plot No. 419, A Block, Dayal ResidencyFaizabad Road, ChinhatLucknow, Uttar Pradesh 226028India

If our answer does not satisfy you, you may complain to the Data Protection Board of India under the DPDP Act.

When this policy changes materially we will update the date at the top and, where the change affects how health data is handled, tell affected clinics directly. We do not make a change quietly and rely on you re-reading the page.