Shinel Care: Privacy Policy

DRAFT. Have a lawyer review it before publishing. Written for India's Digital Personal Data Protection Act, 2023 (DPDP Act). Last updated: ____ 2026.

Shinel Care is clinic and hospital management software developed and supported by Shinel Studios (Sujanpur, Pathankot, Punjab). This policy explains what information we handle, and why.

1. Who controls patient data

• The hospital or clinic is the Data Fiduciary. It decides why and how patient information is collected and used.
• Shinel Studios is a Data Processor. It only handles data on the hospital's instructions, under a written Data Processing Agreement (DPA).

2. The offline version (installed on the clinic's own computer)

• All patient and clinical data, bills and documents stay on the hospital's own computer and its backups.

• Shinel Studios does not receive patient data.

• If the hospital turns on health reporting, the software sends a short technical message a few times a day. It contains:

  • the software version and licence status;
  • whether backups worked;
  • error counts and free disk space;
  • security fingerprints of the money and audit records.

  It contains no names, phone numbers, diagnoses or bills.

• Error alerts sent to our support email contain an error reference code and technical details only, never patient information.

• Remote help (UltraViewer) happens only when the hospital starts a session, and only while hospital staff are watching.

3. The online version (Shinel Care Online)

Each clinic's data is stored in its own separate database:

• on servers in India;
• encrypted while stored and while travelling (HTTPS);
• backed up every day.

Shinel Studios staff access it only:

• to provide support the clinic has asked for;
• to keep the service running safely;
• when the law requires it.

Every such access is recorded.

Account information we keep: the clinic's name, owner's name, email, phone, plan and payment records (payments are processed by Razorpay).

4. What we do not do

• We do not sell or rent any data.
• We do not use patient data for advertising or to train AI models.
• We do not share data with anyone except:
  • the payment processor, for online plans;
  • authorities, when the law requires it.

5. Keeping and deleting data

• Offline: the hospital controls its own data and backups.
• Online:
  • A clinic can export all its data at any time.
  • After a subscription ends, the data stays available as read-only (view, print, export) for a grace period.
  • The data is deleted only after written notice and a final export offer.
  • Deletion is never automatic or without notice.

6. Rights of patients and users

Patients should contact their hospital, the Data Fiduciary, to access, correct or erase their information. We help the hospital respond.

Users of the software can contact us at the address below about their own account information.

7. Security

We protect the data with:

• role-based access;
• a password on the database;
• encrypted connections;
• tamper-evident money and audit records;
• daily backups;
• regular security reviews.

If there is a personal data breach, we inform the affected hospital without delay so it can meet its duties under the DPDP Act.

8. Contact (Grievance Officer)

Shinel Studios, Sujanpur, Pathankot, Punjab, India. Email: [email protected]. Grievance Officer: ____________ (name to be filled in).

We reply within 7 working days.