Privacy Policy

1. Overview

Cardiometcare Plus Health Solutions Pvt Ltd, operating under the brand name ClinAlly (hereinafter "we", "us", or "our"), is committed to protecting the privacy and security of your personal information and health data. This Privacy Policy explains our practices regarding the collection, use, disclosure, and safeguarding of information when you use our mobile applications, website, and related services.

By downloading, installing, or using any ClinAlly application or service, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.

2. Scope & Apps Covered

This Privacy Policy applies to all products and services operated by Cardiometcare Plus Health Solutions Pvt Ltd, including but not limited to:

• mPower Health (Package: com.clinally.mpowerclinally) — a clinical decision support and practice management application for healthcare professionals
• ai.m Healthy (Package: com.clinally.aimhealthy) — a personal health management application for individuals and patients
• The ClinAlly website at clinally.com and any associated web pages
• Any APIs, integrations, or services offered by ClinAlly

3. Data We Collect

The categories of data we collect depend on which app or service you use and how you use it.

3.1 Information You Provide Directly

• Account registration data: Name, email address, mobile number, date of birth, gender
• Professional information (mPower Health): Medical registration number (MCI/NMC), specialisation, hospital or clinic affiliation, years of experience
• Health information (ai.m Healthy): Height, weight, blood group, known allergies, chronic conditions, medications, family medical history, symptoms, and health goals
• ABHA number: If you choose to link your Ayushman Bharat Health Account (ABHA), we collect your 14-digit ABHA number and associated profile information
• Communications: Messages, feedback, or support requests you send us

3.2 Information Collected Automatically

• Device information: Device model, operating system version, unique device identifiers, mobile network information
• Usage data: Features accessed, time spent in app, screens viewed, buttons tapped, and general app usage patterns
• Log data: IP address, timestamps, crash reports, and error logs
• Location data: Approximate location (city/state level) for service availability and analytics — precise GPS location is never collected without explicit permission

3.3 Health and Medical Data

For ai.m Healthy users: vitals (blood pressure, blood glucose, heart rate, SpO₂), wellness logs, symptom tracking, exercise and diet data, menstrual health (if opted in), and any health records you upload.

For mPower Health users: patient encounter data entered by the clinician, clinical assessments, prescription history, and i-CDSS interaction logs.

Data Category	mPower Health	ai.m Healthy
Name & contact details	Yes	Yes
Professional credentials	Yes	No
Patient clinical records	Yes	No
Personal health vitals	No	Yes
ABHA linkage	Optional	Optional
Device & usage data	Yes	Yes

4. How We Use Your Data

We use the information we collect for the following purposes:

• Service delivery: To operate and provide the features of our applications, including clinical decision support, health tracking, and care coordination
• Personalisation: To tailor clinical recommendations, health insights, and content to your specific profile
• Safety alerts: To send critical clinical alerts, medication reminders, or health notifications you have opted into
• Account management: To create and manage your account, verify your identity, and communicate with you
• Customer support: To respond to your queries and resolve issues
• Analytics and improvement: To understand how our apps are used and to improve features, performance, and user experience — all analytics are conducted on anonymised or aggregated data
• Legal compliance: To comply with applicable laws, regulations, and government requirements, including ABDM integration mandates
• Research: Anonymised, aggregated health data may be used for public health research — individual users are never identifiable in such research

5. Data Sharing

We share your data only in the following limited circumstances:

5.1 With Healthcare Providers (With Your Consent)

If you use ai.m Healthy and share your health record with a doctor or hospital, data is shared only after you provide explicit, informed, and revocable consent. Each consent request specifies the purpose, duration, and scope of access.

5.2 With the ABDM Ecosystem

If you link your ABHA account, your health records may be shared with ABDM-registered Health Information Providers (HIPs) and Health Information Users (HIUs) — strictly in accordance with ABDM's consent management architecture. You remain in full control.

5.3 With Service Providers

We engage carefully vetted third-party service providers who assist us in operating our platform (e.g., cloud hosting, analytics, customer support tools). These providers process data on our behalf under strict data processing agreements and are prohibited from using your data for their own purposes.

5.4 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of ClinAlly, our users, or the public.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you of any such transfer and ensure your data continues to be protected under equivalent or stronger terms.

6. Health Data & ABDM Compliance

ClinAlly is an official National Health Authority (NHA) partner and our applications are designed to be compliant with the Ayushman Bharat Digital Mission (ABDM) technical and policy standards.

• Health data is stored in encrypted form using AES-256 encryption at rest
• All data transmission uses TLS 1.2 or higher encryption
• We implement the ABDM consent architecture: no health record is accessed without an active, patient-granted consent artefact
• Users can view all active consents and revoke any consent at any time from within the app
• Health records are stored on servers located within India, in compliance with applicable data localisation requirements

7. Data Security

We implement a comprehensive set of technical, administrative, and physical safeguards to protect your data against unauthorised access, loss, alteration, or destruction:

• AES-256 encryption for all stored health data
• TLS 1.2+ for all data in transit
• Role-based access controls — only authorised personnel can access production data
• Regular security audits and penetration testing
• Multi-factor authentication for all administrative systems
• Anonymisation of data used for analytics and research
• Secure coding practices and regular vulnerability assessments

While we take every reasonable precaution, no method of electronic storage or transmission is 100% secure. If you have reason to believe your account has been compromised, please contact us immediately at info@clinally.com.

8. Data Retention

We retain your data only as long as necessary to fulfil the purposes described in this policy, or as required by law:

• Account data: Retained for the duration of your active account plus 3 years after account deletion, for legal compliance purposes
• Health records: Retained as long as you maintain an active account. Upon deletion, health records are purged within 30 days, except where retention is required by applicable medical records regulations
• Usage logs: Retained for up to 24 months for security and service improvement purposes, then deleted
• Anonymised analytics data: May be retained indefinitely as it cannot be linked to any individual

You may request deletion of your account and associated data at any time (see Your Rights below).

9. Your Rights

Under applicable Indian law and ABDM guidelines, you have the following rights regarding your personal and health data:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your account and personal data, subject to legal retention requirements
• Right to Withdraw Consent: Withdraw consent for any specific data processing activity at any time, without affecting prior lawful processing
• Right to Data Portability: Request your health records in a machine-readable format compatible with ABDM standards
• Right to Grievance Redressal: Lodge a complaint about our data practices with our designated Grievance Officer

To exercise any of these rights, email us at info@clinally.com with the subject line "Privacy Rights Request". We will respond within 30 days.

10. Children's Privacy

Our applications are not intended for use by children under the age of 18 without parental consent. We do not knowingly collect personal data from children under 18. If a parent or guardian becomes aware that their child has provided us with personal information without consent, please contact us at info@clinally.com and we will promptly delete such information.

11. Cookies & Tracking Technologies

Our website (clinally.com) uses cookies and similar tracking technologies to improve your browsing experience and analyse site traffic. The types of cookies we use include:

• Essential cookies: Necessary for the website to function correctly. These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with the website (e.g., Google Analytics). These are anonymised and no personal data is shared with third parties.
• Preference cookies: Remember your language and display preferences.

Our mobile applications do not use browser cookies. They may use device identifiers for session management and analytics, as described above.

You can control cookie preferences through your browser settings. Disabling analytics cookies will not affect core website functionality.

12. Third-Party Services

Our applications may integrate with or link to third-party services. This policy does not cover the privacy practices of third parties. We encourage you to review the privacy policies of any third-party service you use:

• Google Play / Apple App Store: Governed by Google and Apple's respective privacy policies
• ABDM / NHA: Governed by the National Health Authority's privacy framework
• Firebase (Analytics & Crashlytics): Google's privacy policy applies to analytics and crash reporting data
• Payment processors (if applicable): Subject to their own PCI-DSS compliant privacy policies

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send a notification through the app or via email to registered users
• Where required by law, obtain fresh consent before the changes take effect

Continued use of our apps or services after the effective date of any changes constitutes your acceptance of the revised policy. If you do not agree with the updated policy, you should discontinue use and contact us to delete your account.

14. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please contact us: