1. Who this policy covers
This policy applies to Saaro Health, a product operated by Lumotis Digital Media, a company based in Jaipur, Rajasthan, India ('Lumotis', 'we', 'us', 'our'). It covers data we collect from clinics that use Saaro Health ('clinic', 'you') and, where relevant, patients whose data a clinic processes using our platform.
For patient health data, the clinic using Saaro Health is generally the data fiduciary under the DPDP Act, and Lumotis acts as a data processor on the clinic's instructions. Our data processing terms with clinics are set out separately in our Data Processing Agreement.
2. What we collect
We collect the following categories of information:
- Clinic account information: clinic name, address, GSTIN, doctor names and registration numbers, staff user accounts.
- Patient health data entered by clinics: demographics, prescriptions, clinical notes, lab and imaging reports, appointment history, billing records, and ABHA-linked identifiers where consented.
- Communications data: messages sent and received through SaroConnect (our WhatsApp Business infrastructure) on behalf of a clinic, and delivery/read status of those messages.
- Website and product usage data: pages visited, features used, device and browser information, collected via analytics tools.
- Lead and enquiry data: name, phone number, email and clinic details submitted through our demo request and contact forms.
3. Why we process this data
We process data to provide the Saaro Health platform to clinics, including: maintaining patient records; generating and sending prescriptions, reminders and reports; processing billing and GST invoicing; supporting ABDM/ABHA linking and consent-based record sharing; responding to demo and support requests; and improving the reliability and security of the platform.
Where we process patient health data, we do so as a processor acting on the instructions of the clinic, which remains responsible as the data fiduciary for obtaining valid patient consent for that processing.
4. Legal basis and consent
Clinics are responsible for obtaining and recording patient consent for the collection and processing of their health data, as required under the DPDP Act and applicable healthcare regulations. Saaro Health provides the tools to capture and store consent artefacts, including for ABDM-linked data sharing, but the clinic determines what consent is sought and from whom.
5. How long we keep data
Patient health records are retained for as long as the clinic's account is active, and for any additional period required by applicable medical record-retention regulations, unless the clinic instructs deletion earlier and such deletion is not restricted by law. On termination of a clinic's account, data is retained or deleted in accordance with our Data Processing Agreement.
6. Where data is stored
Saaro Health's infrastructure is hosted in hosting region, within India. We do not transfer personal data outside India except where a specific integration explicitly requires it and the clinic has been informed.
7. Who we share data with
We share data with sub-processors necessary to operate the platform — including cloud hosting, our own SaroConnect messaging infrastructure, and, where connected by the clinic, third-party integrations such as diagnostic labs, payment processors and accounting tools. A full list of sub-processors is maintained at our sub-processors page. We do not sell personal data.
8. Your rights
Under the DPDP Act, individuals have the right to access a summary of their personal data, seek correction and erasure, and nominate another person to exercise these rights on their behalf in the event of death or incapacity. Patients should direct data requests to the clinic where they were treated, as the clinic is the data fiduciary. Clinics may direct requests concerning their own account data to us at contact email.
9. Security
We apply encryption in transit and at rest, role-based access controls, and audit logging to data processed on Saaro Health. Further detail is available on our security page.
10. Breach notification
In the event of a personal data breach, we will notify affected clinics without undue delay and support any notification obligations the clinic has to the Data Protection Board of India or affected individuals under the DPDP Act.
11. Cookies and analytics
Our website uses cookies for essential functionality and analytics. Details are set out in our Cookie Policy.
12. Changes to this policy
We may update this policy from time to time. The 'last updated' date at the top of this page reflects the most recent revision. Material changes will be communicated to clinic accounts.
13. Contact
For privacy questions or to exercise a data right, contact us at contact email, or write to Lumotis Digital Media, Jaipur, Rajasthan, India.