Privacy Policy

When hospitals, clinics, or their representatives register or interact with QureSetu, we collect: • Hospital registration information: hospital name, address, bed count, GSTIN, and contact details of authorized leadership. • User account data: staff names, designations, and role-based login credentials. • Patient records submitted through the software: patient demographics, consultation notes, prescriptions, invoices, and diagnostic results. This data belongs exclusively to the subscribing hospital (the Data Fiduciary under DPDP 2023). • Website inquiry information: name, phone number, email, and hospital details submitted through our contact or demo forms.

• To provision, host, and operate the QureSetu Hospital Management System for your healthcare facility. • To respond to walkthrough requests, data migration inquiries, and support tickets. • To send billing invoices, renewal notices, and critical security updates. • To monitor system uptime, fix technical errors, and optimize software speed. We NEVER sell, rent, monetize, or commercially share patient health data or hospital operational numbers with any third party.

All hospital and patient health records are hosted exclusively within secure cloud data centers located in India (Mumbai and Hyderabad). QureSetu never transfers patient health records outside Indian borders, strictly adhering to national digital health data sovereignty guidelines.

Under India's Digital Personal Data Protection (DPDP) Act 2023, the subscribing hospital is the Data Fiduciary and QureSetu acts as the Data Processor. • Patient consent for digital health records is recorded within the software. • Patients may request copies or updates to their records through their hospital. • QureSetu provides tamper-evident audit trails and role-based access tools to ensure hospitals remain fully audit-ready.

• All data is encrypted at rest using bank-grade 256-bit AES encryption and in transit using TLS 1.3. • Role-based permissions ensure staff only view what is needed for their job. • Strict database isolation ensures no cross-hospital data access is ever possible. • Complete activity logs record user ID, action, and timestamp for all chart and billing edits. • Daily automatic encrypted backups safeguard against data loss.

• Active subscription data: Kept throughout the active subscription and for 60 days following cancellation for export. • Medical records: Stored according to medical council regulations and your hospital's retention guidelines (minimum 5 years per NMC standards). • Upon formal contract termination, hospitals can download a full structured database export of all their patient and billing records.

For questions regarding our privacy practices or data processing policies, contact our Data Protection Officer at: Email: privacy@quresetu.com Phone: +91 92967 10958 Address: QureSetu / Quantum Webframe, India