Privacy Policy

SpatiaMed is a technology company registered in India. We are the Data Fiduciary for hospital administrators and staff who sign up on spatiamed.com. For patient data processed through our software on behalf of hospitals, we act as a Data Processor — the hospital (our customer) is the Data Fiduciary for their patients.

From hospital administrators (our customers): Name, work email, mobile number, hospital name, city, state, bed count, and billing information (payment processed by Razorpay — we do not store card numbers).

From patients (via our software, on behalf of hospitals): Name, mobile number, date of birth, department preference, and queue token and visit history. Clinical data the hospital's doctors record through our software: consultation notes, diagnoses and diagnosis codes, vitals, and prescriptions. Audio and transcripts of calls handled by the AI front desk. Audio and transcripts of telemedicine and in-clinic consultations, where the hospital turns on transcription or the AI scribe. Patients interact with the hospital's SpatiaMed-powered kiosk, phone line, patient tracker, telemedicine links, and WhatsApp and SMS messages — the hospital is responsible for obtaining patient consent under the DPDP Act.

Website enquiries and bookings: Name, email, organisation, and message, when you send us an enquiry or book a meeting through this website.

Usage data: Browser type, IP address, pages visited, and interactions on this website — collected via Google Analytics 4 and PostHog. We do not collect any patient or health data on this website.

Example language: We use your approximate region (state or country, derived from your IP address by our hosting provider) only to choose the language of on-page examples; we store just the chosen language in a cookie.

Session replay: PostHog records replays of how visitors interact with this website — pages viewed, scrolling, and clicks — so we can find and fix usability problems. All form inputs are masked, so what you type is never captured. And on any page where you enter personal details — including onboarding, contact, and demo booking — replay is switched off entirely, so no recording of that page is made at all.

Your choice: Analytics are on by default, and a banner on your first visit lets you accept or reject them. If you reject them, we stop collecting the usage data and session replays described above: PostHog stops capturing, and Google Analytics is not loaded at all on any page you open from then on — your browser makes no request to Google, so not even your IP address reaches it. You can change your decision at any time by selecting Cookie preferences in the footer of any page, or the links row on the sign-up pages.

We process personal data to:

• Provision and operate your SpatiaMed portal
• Deliver the features a hospital turns on for its patients — queue updates, calls answered by the AI front desk, reminders, and AI-drafted clinical notes that a doctor reviews
• Send transactional emails (setup, support)
• Process subscription payments via Razorpay
• Improve our product and monitor platform health
• Comply with legal obligations

We do not sell your data. We do not use patient data for advertising or profiling outside the hospital's use case.

Administrator account data is retained for the duration of your subscription plus 90 days after cancellation, then purged.

Patient queue history is retained for 12 months from the date of the encounter, then automatically deleted from our systems. Hospitals may export their patient data at any time from the portal.

As a Data Principal you have the right to:

• Access — request a summary of personal data we hold about you
• Correction — request correction of inaccurate data
• Erasure — request deletion of your personal data, subject to legal retention obligations
• Grievance redressal — contact our Data Protection Officer if you believe your rights have been violated

To exercise any right, write to privacy@spatiamed.com. We will respond within 30 days.

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We perform periodic access reviews and restrict data access to personnel who need it to perform their role.

We share data only with processors necessary to deliver the service:

• Amazon Web Services (hosting, storage and databases, in India)
• Sarvam AI (speech-to-text, text-to-speech and translation for Indian languages)
• Google Cloud (AI models for drafting clinical notes, summaries and call handling)
• OpenAI and Anthropic (fallback AI models, used when the primary AI models are unavailable)
• Exotel (telephony for patient calls)
• Gupshup (WhatsApp Business messaging)
• MSG91 (SMS)
• Daily.co (video for telemedicine consultations)
• Razorpay (payments)
• Resend (transactional email)
• Calendly (meeting booking: name and email)
• Vercel (website hosting)
• Google Analytics 4 and PostHog (website analytics and session replay — PostHog processes this data in the European Union)

All processors are bound by data-processing agreements consistent with DPDP requirements.

We will notify active customers by email at least 14 days before making material changes to this policy. Continued use after the effective date constitutes acceptance.

Data Protection Officer: privacy@spatiamed.com