Version 1.1 · Effective from: 24 October 2026
1.1 This Privacy Policy explains how Appsites Infotech (the "Company") collects, uses, shares and protects personal data in connection with PrakharOne (the "Services") and the website https://prakharveda.com. Capitalised terms not defined here have the meanings given in the Terms of Service.
1.2 The Company processes personal data in two capacities:
(a) as a Data Fiduciary, for the personal data of Owners, Users and website visitors that it collects to operate the Services ("Account Data"); and
(b) as a Data Processor, for the personal data of patients and other individuals that clinics enter into the Services ("Patient Data"). Each clinic is the Data Fiduciary of its Patient Data and determines the purpose and means of its processing. A patient should first address any request about his or her data to the clinic concerned.
| Category | Whose data | Source | Purpose |
|---|---|---|---|
| Name, e-mail address, mobile number, role | Owners and Users | Given at sign-up or by the Owner | Creating and securing accounts; sending sign-in codes; service, billing and amendment notices |
| Clinic name, address, registration numbers, GSTIN, UPI ID, logo, fees | Subscriber | Given by the Owner | Printing on prescriptions, bills and invoices; billing of Fees |
| Patient name, age, sex, mobile number, address, history, examination, diagnosis, prescriptions, therapies, bills | Patients of the clinic | Entered by the clinic | Processed only on the clinic's instructions, to provide the Services |
| Sign-in records, IP address, browser details, log of additions, changes and cancellations | Users | Generated automatically | Security, prevention of misuse, the clinic's audit trail, troubleshooting |
| Payment reference, amount and date of Fees paid | Subscriber | Subscriber or payment provider | Accounting and tax invoices |
| Content of messages sent to the Company | Any person | Given by that person | Answering queries and grievances |
Card and bank account details are handled by the payment provider and are not stored by the Company.
3.1 The Company processes Account Data only to provide and secure the Services, to communicate with Owners and Users about their Accounts, Updates, amendments and billing, to comply with Applicable Law, and to resolve grievances. It does so on the basis of the consent given at sign-up and of the legitimate uses permitted by section 7 of the DPDP Act.
3.2 The Company processes Patient Data only on the instructions of the clinic, as set out in Clause 8 of the Terms of Service.
3.3 The Company does not sell personal data, does not use it for advertising or profiling, does not use Patient Data to train any artificial intelligence or machine-learning model, and does not send promotional communications without consent.
4.1 The Services use only cookies that are strictly necessary for their operation: a session cookie that keeps a User signed in, a security token that protects forms against forgery, and, where the User chooses "Keep me signed in", a remember-me cookie valid for thirty (30) days. The website https://prakharveda.com does not use advertising or analytics cookies.
5.1 The Company shares personal data only:
(a) with sub-processors that help it operate the Services, under obligations of confidentiality and security, namely HOSTINGER PTE LTD, Singapore, for hosting, databases and e-mail delivery on servers located in India;
(b) where required by Applicable Law, an order of a court or a request of a competent authority; and
(c) with a successor in the event of a transfer of the Company's business, which shall remain bound by this Policy.
5.2 Prescriptions and reminders sent through WhatsApp are sent from the clinic's own device and account; their content does not pass through the Company's servers.
6.1 Personal data is stored on servers located in India and is transmitted only over encrypted (HTTPS) connections. The Company does not transfer personal data outside India except as permitted by Applicable Law.
| Data | Retained for |
|---|---|
| Patient Data and other Subscriber Data | Until the clinic deletes it; after closure of the Account, or after the end of an unpaid Subscription Term, ninety (90) days; then deleted, with backup copies deleted within ninety (90) days |
| Owner and User contact details | While the login exists; erased when the User deletes the login |
| Records of Fees and tax invoices | For the period required by tax and accounting laws |
| Sign-in codes | Stored only as a one-way keyed hash; deleted within one (1) day |
| Activity logs | For the life of the Account; deleted with Subscriber Data |
| One-way keyed hash of the e-mail address of a login that has used the free trial | As long as the Services are offered, so that the free trial is given only once per e-mail address |
| Record of acceptance of these Terms (login, version, date and time, IP address) | Three (3) years after the Account is closed, for the establishment or defence of legal claims |
8.1 The Company takes reasonable security safeguards to protect personal data, including: encryption of all connections (HTTPS with HSTS); password-less sign-in by single-use codes, of which only a keyed hash is stored, valid for ten (10) minutes with a limited number of attempts; logical separation of each clinic's data; role-based access within each clinic; activity logs; the exclusion of health information from system logs; and restricted administrative access. The Company does not keep backups for restoration at a clinic's request; each clinic may export its data as often as it wishes, including daily.
8.2 No method of transmission or storage is completely secure, and the Company cannot guarantee absolute security.
9.1 In the event of a personal data breach, the Company shall: (a) inform each affected clinic without undue delay, so that the clinic can inform affected patients and the Data Protection Board of India as required by the DPDP Act; (b) in respect of Account Data, intimate the Data Protection Board of India and each affected Data Principal in the manner and within the time required by the DPDP Act; and (c) report the incident to CERT-In within six (6) hours of noticing it, as required by its directions.
10.1 Subject to the DPDP Act, every Data Principal has the right to: (a) obtain a summary of his or her personal data being processed and of the processing activities; (b) the correction, completion, updating and erasure of his or her personal data; (c) readily available means of grievance redressal; and (d) nominate another individual to exercise these rights in the event of his or her death or incapacity.
10.2 An Owner or User may update his or her name and mobile number, leave a clinic and delete his or her login under "My account" in the Services. An Owner may export or delete the clinic's data as provided in Clause 7 of the Terms of Service. Other requests concerning Account Data may be sent to the Grievance Officer.
10.3 A patient should send requests concerning Patient Data to his or her clinic. The Company shall assist the clinic in responding to them.
10.4 Consent may be withdrawn at any time, with the same ease with which it was given, by deleting the login or closing the Account. Withdrawal does not affect the lawfulness of processing before it, and data that Applicable Law requires to be kept may be retained for the period so required.
11.1 No person below eighteen (18) years of age may create an Account or be a User. Patient Data may include personal data of children; the clinic is responsible for obtaining the verifiable consent of the parent or lawful guardian as required by section 9 of the DPDP Act. The Company does not track or monitor the behaviour of children, and does not use their data for advertising.
12.1 Any grievance or request about personal data may be addressed to the Grievance Officer: Mr. Pawan Kumar Gupta, Proprietor, Appsites Infotech, Plot No. 80, Shanti Nagar, Gurjar ki Thadi, Jaipur, Rajasthan – 302020 · E-mail: sales@appsites.in · Phone: +91 86195 62437. The Grievance Officer shall acknowledge a grievance within seven (7) working days of its receipt and shall endeavour to resolve it within fifteen (15) working days of its receipt.
12.2 A Data Principal who is not satisfied with the resolution may approach the Data Protection Board of India in accordance with the DPDP Act.
13.1 The Company may amend this Policy in the manner set out in Clause 17 of the Terms of Service. Amendments shall be notified by e-mail to the registered e-mail address of each Owner and shall take effect not less than fifteen (15) days after such notice, save where Applicable Law requires an earlier date. Continued use of the Services after that date shall constitute acceptance of the amended Policy.
Appsites Infotech, Jaipur · sales@appsites.in