Version 1.0

Tanuva Privacy Policy

Effective date:

Susmita Dutta, operating the Tanuva service as an individual.

This Policy describes information handling for Tanuva, operated by Susmita Dutta as an individual, including its website, registration and clinic-management service. It distinguishes information supplied by Clinics for healthcare operations from information collected directly to manage accounts and the service.

The Clinic ordinarily determines why patient information is collected and used for its healthcare operations. Depending on enabled features, this may include patient identity and contact details, appointments, medical or dental history, consultations, prescriptions, treatment information, bills, documents, photographs, X-rays and other clinical images. Tanuva processes this information to provide, secure and support the software, subject to applicable law and contractual duties; it does not independently determine clinical purposes or make medical decisions.

We may collect registration and account information such as names, Clinic details, business address, email, phone, account identifiers and role information; enquiries and support correspondence; subscription and transaction records; and technical information associated with service use. Only provide information necessary for the relevant purpose. Tanuva does not sell personal data.

We retain evidence of the separate authority confirmation and acceptance of the Terms and Privacy Policy. It includes timestamps, the registration identifier, resulting Clinic reference, document versions and a document fingerprint, and may include an IP address and bounded browser/user-agent information. It supports accountability and the establishment or defence of legal claims. Selecting a Clinic Admin during registration is not treated as proof that that user personally accepted. Historical evidence is not overwritten when documents change.

Information is used to create and administer accounts, provide Clinic workflows, manage subscriptions and payments, respond to enquiries, maintain security, investigate misuse and errors, support continuity, meet legal obligations and establish or defend claims. Access should be limited to what the relevant purpose requires. We do not use Clinic patient data to provide independent medical advice.

Processing must have the consent or other lawful basis required under the applicable framework. The Clinic must ensure it has authority to submit patient data and provide required notices and permissions. Accepting these service documents does not provide consent on behalf of every patient or authorise unrelated processing. Where we rely on consent for a distinct purpose, withdrawal is addressed as described below.

Payment credentials entered directly with providers such as Razorpay are handled under that provider’s processing and policies. Tanuva may retain order, transaction, payment status and reconciliation evidence needed to administer subscriptions, investigate issues and meet legal obligations. Do not send card credentials, banking passwords or one-time passwords to support.

We may use hosting, infrastructure, communications, security, support and payment providers where needed for the service. They may process information for those purposes under applicable arrangements and legal requirements. Independent services you choose may have their own privacy terms.

Information may be disclosed to authorised Clinic users, necessary service providers, professional advisers under appropriate duties, or authorities where legally required. Disclosure may also be necessary to investigate misuse, protect safety or security, or establish or defend legal claims. Requests should be assessed and disclosure limited to what is appropriate and legally permitted.

The Clinic controls its authorised users, roles and branch access and must review these regularly. Protect devices and credentials and report suspected compromise promptly. Technical access controls assist the Clinic but do not replace its confidentiality and professional responsibilities.

We use technical and organisational measures intended to protect information against unauthorised access, alteration or loss. No internet service can guarantee absolute security. Security incidents may occur despite precautions; we will respond and provide notifications where required by applicable law. Avoid submitting passwords or unnecessary clinical information through general enquiries.

Information is retained for the purposes for which it is needed, taking account of the service relationship, legal and professional retention duties, security, disputes and backup cycles. Different records may require different periods. Registration acceptance and financial evidence may need to be retained after account closure for legal accountability. Backup copies may persist until their ordinary secure expiry; no backup system guarantees zero data loss.

Contact support to request account closure or deletion of information under our control. We will assess identity, authority, the scope of the request and legal retention requirements. Closure does not guarantee immediate deletion of every record, backup, payment or legal-evidence entry. For Clinic-controlled patient records, contact the Clinic first; we may need its instructions and may assist it as required by law. Clinics should arrange necessary records before closure.

Keep account and Clinic information accurate and request corrections where necessary. Clinical records are controlled by the Clinic and may be subject to professional record-integrity requirements. Corrections must not falsify historical financial or legal evidence; where appropriate, a correction or supplemental record can preserve the history.

Depending on applicable law and its commencement, individuals may have rights relating to information about processing, access, correction, erasure, grievances and other statutory remedies. Contact us using the details below. We may reasonably verify identity and authority before responding and will follow applicable timelines, exceptions and restrictions. Patient requests concerning a Clinic’s records should ordinarily begin with that Clinic.

Where processing relies on consent and withdrawal is available under applicable law, contact the relevant Clinic or Tanuva for the processing each controls. Withdrawal may affect the ability to provide the related service. It does not retrospectively invalidate lawful prior processing or require removal of records that must lawfully be retained for another purpose.

The service is intended for authorised Clinic personnel, not for children to register independently. Clinics entering children’s patient information must meet applicable notice, parental or guardian permission, verification, safeguarding and clinical obligations. Contact the Clinic regarding a child’s clinical record and Tanuva for concerns about the operation of the service.

The application uses cookies and session mechanisms for functions such as sign-in, maintaining context and protecting forms. Disabling necessary cookies may prevent those functions from working. This Policy does not imply consent to optional advertising or tracking technologies; any such addition would require appropriate disclosure and controls.

Technical records may include IP address, browser or user-agent information, request times, identifiers and security or diagnostic events. These support operation, troubleshooting and abuse prevention. Legal-acceptance metadata is bounded and retained as evidence; it is not treated as conclusive identification of a person.

Providers or their infrastructure may operate in India or other jurisdictions. We must assess applicable restrictions and safeguards when arranging processing or transfers. This Policy does not promise that every copy remains in a particular country, and does not override mandatory localisation or transfer restrictions.

If operation of the service is transferred, information may be transferred where lawful and necessary for continuity, subject to appropriate protections and notice where required. Such a transfer does not remove existing confidentiality, contractual or statutory responsibilities.

Revisions will have a new version and effective date. We will provide appropriate notice of material changes and obtain fresh consent or acceptance where required. Earlier versions and acceptance evidence remain identifiable; a revised page does not rewrite what was previously accepted.

Direct privacy enquiries and grievances to Susmita Dutta, the operator and privacy contact, at support@tanuva.in or the address below. State the Clinic, the nature of the request and a safe reply address, and avoid unnecessary patient details. We will assess requests and respond within applicable legal requirements. You retain any right to approach a competent authority or forum under applicable law.

We apply the Indian privacy and information-technology requirements applicable to the relevant processing at the relevant time, including the Information Technology Act, 2000 and applicable rules, and the Digital Personal Data Protection Act, 2023 and its rules to the extent their provisions have commenced and apply. Commencement and transition are phased; this Policy does not state that all staged or future requirements already apply identically. Nothing here limits mandatory privacy rights or duties.

Tanuva Operated by Susmita Dutta Flat 4A, DB-88, Street No. 288 Action Area I, Newtown Kolkata – 700156, West Bengal, India

support@tanuva.in
tanuva.in