Privacy Policy

When hospitals, clinics, or their representatives register or interact with QureSetu, we collect: • Hospital registration information: hospital name, address, bed count, GSTIN, contact details of authorized persons (Owner/MD/Administrator). • User account data: staff names, designations, role-based login credentials (hashed). • Patient data submitted through the HMS: patient demographics, clinical notes, prescription records, billing invoices, diagnostic results. This data belongs to and is controlled by the subscribing hospital (the Data Fiduciary under DPDP 2023). • Website enquiry data: name, phone, email, hospital name, and stated pain points submitted via our lead capture forms.

• To provision and operate the QureSetu Hospital Management System for your facility. • To respond to demo requests, migration inquiries, and revenue audit submissions. • To send transactional communications related to your subscription (invoices, renewal reminders, system alerts). • To improve our product, diagnose technical issues, and monitor platform reliability. We do NOT sell, rent, or commercially share patient data or hospital operational data with any third parties.

All hospital and patient data is stored in India-based cloud infrastructure. QureSetu does not transfer patient health records outside the territory of India. Our database architecture uses PostgreSQL with Row-Level Security (RLS) ensuring strict physical isolation between hospital tenants.

Hospitals using QureSetu are the Data Fiduciaries for their patient records under India's Digital Personal Data Protection Act, 2023 (DPDP Act). QureSetu operates as a Data Processor on their behalf. • Patient consent for digital health record sharing is captured and logged within the HMS. • Patients may request access to or deletion of their records through the treating hospital. • QureSetu provides hospitals with audit logs and consent management tools to fulfill their DPDP obligations.

• All data is encrypted at rest using AES-256 and in transit using TLS 1.3. • Role-based access control (RBAC) limits staff access to only their relevant clinical and billing modules. • Row-Level Security (RLS) at the PostgreSQL layer prevents any cross-tenant data access. • Immutable audit logs capture every record modification with timestamp and user ID. • Daily automated encrypted backups with isolated tenant disaster recovery.

Our marketing website (quresetu.com) uses minimal cookies for session management and basic analytics (page views, referral source). We do not use persistent tracking pixels or third-party advertising cookies. The QureSetu HMS application itself does not use browser cookies for clinical functionality.

• Active subscription data: retained for the duration of the subscription plus 6 months post-termination. • Patient health records: retained per the hospital's configuration and local medical records regulations (minimum 5 years per MCI guidelines). • Lead and enquiry data (from website forms): retained for up to 24 months for follow-up purposes. • Upon request, hospitals may request complete data export and deletion upon subscription termination.

As a hospital subscriber or individual whose data we hold, you have the right to: • Access the personal data we hold about you. • Request correction of inaccurate data. • Request deletion (right to erasure) where legally permitted. • Withdraw consent for processing where consent is the legal basis. To exercise any of these rights, contact us at: contact@quresetu.com

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated via email to registered hospital administrators at least 30 days before taking effect.

For privacy-related queries, data access requests, or DPDP concerns: Email: contact@quresetu.com Phone: +91 92967 10958 Address: Quantum Webframe, India