1.Who we are and what this policy covers
Nanostack Private Limited (“Nanostack”, “we”, “us”) operates this website and the hospital management platform reached through it and through each hospital’s own web address (together, the “Platform”).
This policy explains how we handle personal data about:
- visitors to this website and people who send us an enquiry, ask for a demo or start a trial;
- hospital and clinic staff who sign in to the Platform;
- patients who use a hospital’s patient portal or book an appointment on a hospital’s website.
We handle personal data in line with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them.
2.Our two roles
For our own customers and visitors, we decide why and how their data is used, so we are responsible for it as the data fiduciary. That covers enquiries, trial sign-ups, billing contacts and the accounts of people who sign in.
For patient and clinical records, the hospital or clinic that keeps them decides why and how they are used. The hospital is the data fiduciary; we are its data processor. We store and process those records only to provide the Platform to that hospital, under our agreement with it.
If you are a patient and want to see, correct or delete your records, please contact the hospital that treated you. If you contact us instead, we will pass your request to that hospital.
3.What we collect
When you visit this website or contact us
- what you type into a form: your name, phone number, email address, organisation, city and message;
- technical data: IP address, browser, pages visited and the time of your visit;
- cookies and similar technologies, described in our Cookies Policy.
When a hospital signs up or subscribes
- the hospital’s name, address, GSTIN and registration details;
- the administrator’s name, email address and phone number;
- billing and payment records. Card and UPI details are entered with our payment gateway; we do not store full card numbers.
When staff use the Platform
- the account: name, email, phone, role, department and branch;
- security records: sign-ins, two-factor settings, devices and IP addresses;
- an audit trail of significant actions, such as who opened, changed, approved or exported a record.
What hospitals enter about patients
Demographics, contact details, identifiers such as UHID and ABHA number, appointments, clinical notes, prescriptions, test results, images, bills and insurance details. We process these only as the hospital’s processor.
4.How we use personal data
We use personal data to:
- provide, secure and support the Platform;
- create and manage accounts and verify sign-ins;
- reply to enquiries, arrange demos and run trials;
- bill subscriptions, issue GST invoices and keep accounting records;
- send service messages, such as password resets, security alerts and changes to the service;
- measure and improve our marketing website and advertising, as described in the Cookies Policy;
- meet legal obligations and protect our rights and the rights of others.
We do not sell personal data. We do not use patient or clinical records for advertising, and we do not use them to build products for anyone other than the hospital that holds them.
5.Patient and clinical records
- Each hospital’s records are kept separate from every other hospital’s at the database layer. Staff of one hospital cannot see another hospital’s patients.
- Inside a hospital, access follows the roles and permissions the hospital sets, and access to clinical records is recorded in an audit log.
- Our staff have no standing access to a hospital’s records. Support access needs a time-limited grant from the hospital, which the hospital can see in its own security log.
- Messages to patients — appointment reminders, report notifications, receipts — are sent on the hospital’s instructions through the providers it enables.
- The hospital is responsible for having a lawful basis, including consent where it is needed, for the patient data it enters and for the messages it asks the Platform to send.
6.Consent and choices
Where we rely on your consent — for example, to contact you about a demo you asked for, or for advertising cookies — you can withdraw it at any time by writing to us. Withdrawing consent does not affect anything done before you withdrew it.
You can stop marketing emails or messages by using the opt-out in the message or by contacting us. We will still send messages the service needs, such as security alerts and invoices.
8.How we protect data
- Data is encrypted in transit and at rest.
- Each hospital’s data is isolated at the database layer.
- Access is role-based and checked on the server, not just hidden in the screen.
- Two-factor authentication is required for administrators and high-risk roles.
- Sign-in attempts are rate-limited.
- Significant actions are recorded in audit logs that ordinary users cannot change.
- Backups are taken regularly.
No system is perfectly secure. If a personal data breach affects you, we will inform you and the authorities as the law requires. Where the breach concerns a hospital’s patient records, we will inform that hospital promptly so that it can meet its own obligations.
9.Where data is stored
We store data on servers we operate or rent from hosting providers. Some of our service providers may process data outside India. When they do, we use providers that protect it to a standard consistent with Indian law, and we comply with any restrictions the Government of India places on transfers to particular countries.
10.How long we keep data
- Hospital records are kept for as long as the hospital’s subscription is active. After it ends, we keep them long enough for the hospital to export them, unless the hospital asks for earlier deletion. They are then deleted or anonymised, unless the law requires us to keep them longer.
- Enquiries and trial sign-ups are kept while we are in touch with you, and for a reasonable period afterwards.
- Invoices and accounting records are kept for the periods tax and company law require.
- Security and audit logs are kept long enough to investigate incidents and to meet legal requirements.
11.Your rights
Subject to the law, you can:
- ask what personal data we hold about you and how we use it;
- ask us to correct, complete or update it;
- ask us to erase it when it is no longer needed, or when you withdraw your consent;
- nominate someone to exercise your rights if you die or become unable to;
- complain to our Grievance Officer, and then to the Data Protection Board of India.
Write to us using the contact details below. We will confirm who you are before acting, and reply within the time the law allows. For patient records, please contact the hospital that treated you.
12.Children
This website and our sales process are meant for adults acting for healthcare organisations. We do not knowingly collect children’s personal data through them.
Hospitals may record the care of children on the Platform. When they do, the hospital is responsible for obtaining verifiable consent from a parent or lawful guardian where the law requires it.
13.Changes to this policy
We may update this policy as the Platform or the law changes. The effective date at the top shows when it last changed. If a change is significant, we will tell hospital administrators by email or in the Platform before it takes effect.
14.Grievance Officer and contact
For questions, requests or complaints about personal data, contact our Grievance Officer:
Nanostack Private Limited, B-Nest, Bhopal Smart City, Barkheda, Bhopal, Madhya Pradesh, India.
- Email: info@nanostack.io
- Phone: +91 7000197459
We acknowledge complaints promptly and aim to resolve them within the time set by law.