Privacy Policy

Product: Caresoft eICU • Version: 1.1 • Effective:01/04/2026

This policy explains how Caresoft Systems Private Limited ("Caresoft", "we") handles personal data in connection with the Caresoft eICU platform (the "Platform"). It is written for three audiences: hospitals evaluating or using the Platform, clinical users who sign in to it, and patients and families who want to understand how the technology handles their information.

If you are a patient or a family member, the hospital treating you — not Caresoft — decides what is recorded, why, and who may see it.

Your hospital's own privacy notice governs your care. Caresoft is a technology supplier acting under the hospital's instructions. Any request about your records should go to your hospital first. Contact details for the hospital's grievance officer are in its own notice; ours are in Section 15 if you cannot reach them.

Contents

Who is responsible for what
Patient data we process
Lawful basis, including emergencies
Clinical user data
Hospital account data
Website visitors
Why we process it
Who can see patient data
Notifications and identifiers
Where data is held
How long we keep it
Security
If something goes wrong
Rights and how to exercise them
Contact and Grievance Officer
Changes

1. Who is responsible for what

Data	Hospital	Caresoft
Patient health and physiological data in the Platform	Data Fiduciary / Controller	Data Processor
Clinical user accounts, roles and access logs	Controller	Processor
Hospital's contract, billing and support records	Counterparty	Controller
Our website and enquiry forms	—	Controller
System logs required by law	—	Controller

Processing terms between Caresoft and each hospital are set out in the Data Processing Addendum, which is stricter than this policy in several respects and prevails for hospital customers.

2. Patient data we process

Determined by the hospital, but typically:

Identifiers — name, hospital number or MRN, internal patient key, age, sex, ward, bed, encounter and admission details.
Physiological data from bedside devices — heart rate, blood pressure, oxygen saturation, respiratory rate, temperature, ventilator parameters and similar measurements, sampled continuously.
Derived values — early warning scores and other calculations produced from the above.
Clinical documentation — observations, notes and entries made by nurses and doctors.
Alert and escalation records — what was raised, to whom, and what was acknowledged.
Movement data — admission, discharge and transfer events, and bed–device associations.

All of this is health data. It is sensitive in every framework that applies to it, and we treat it as such throughout. We do not process any other special category of data.

3. Lawful basis, including emergencies

The hospital establishes the lawful basis. Under India's Digital Personal Data Protection Act, 2023 this will typically be consent, or one of the Act's specified legitimate uses.

Critically ill patients frequently cannot give consent. The Act recognises this: it permits processing for taking measures to provide medical treatment or health services during an epidemic, outbreak, threat to public health, or during a medical emergency involving a threat to the life or immediate health of the person concerned.

Where a patient lacks capacity, the hospital is responsible for obtaining consent from a lawful guardian where required, and for recording the basis relied upon. Caresoft does not make that determination and cannot make it on the hospital's behalf.

Where a patient is a child, the hospital is responsible for verifiable consent from a parent or lawful guardian, and for the Act's restrictions on tracking and targeted advertising directed at children. The Platform performs no tracking or advertising of any kind.

4. Clinical user data

For each user of the Platform we process: name, role, professional identifier where supplied, work email and phone, hospital and unit, account credentials (passwords stored only as salted and peppered one-way hashes), assigned permissions, and a full record of sign-ins, actions and data accessed.

Clinical users should be aware that their activity in the Platform is logged in detail and is auditable by their hospital. This is not surveillance of performance — it is a patient safety and medical-records requirement. Access to a patient's record without a care relationship is detectable and is a disciplinary matter for the hospital.

5. Hospital account data

Organisation name and address, CIN or registration details, GSTIN, named clinical, technical and data protection contacts, licensed bed and user counts, subscription and billing records, and support correspondence. For this data Caresoft is the controller.

6. Website visitors

Enquiry form submissions, IP address, browser and device information, pages viewed and referrer. Strictly necessary cookies for session and security, and analytics cookies where you consent. Our marketing site sets no advertising cookies. The Platform itself uses only necessary and functional cookies — no analytics or advertising within the clinical portals.

7. Why we process it

To operate the Platform — acquiring, transmitting, storing, displaying and trending device and clinical data for the hospital's clinical use.
To attribute data to the correct patient, and to quarantine it safely when attribution is uncertain.
To generate notifications and reports configured by the hospital.
To maintain the audit trail the hospital needs for medical records and clinical governance.
To monitor data integrity — sync health, clock drift, data gaps — and alert on failures.
To provide support, investigate faults, and investigate patient safety or security incidents.
To meet legal obligations, including mandatory log retention and incident reporting.
To administer the hospital's account and bill it.

We do not use patient data for our own purposes. We do not sell it, share it for advertising, use it for research or marketing, or use it to train artificial intelligence or machine learning models of any kind. This is a contractual commitment in the Data Processing Addendum §17, not a policy statement we can quietly change.

8. Who can see patient data

8.1 Within the hospital

Only users the hospital has authorised, limited by their assigned role and unit. The hospital controls provisioning and revocation. The Platform enforces role-based permissions and separates the administrative, hospital-admin and clinical portals, with wrong-portal access attempts recorded.

8.2 Caresoft personnel

Access is restricted to what is necessary to deliver the service, and occurs only where:

the hospital has raised a support request requiring it;
a patient safety or security incident is being investigated;
contracted managed services require routine administration; or
we are compelled by valid legal process.

Every such access is individually authenticated, requires multi-factor authentication, and is logged with the person, the time, the record and the stated reason. That log is available to the hospital on request. Production patient data is never copied into development, test, training or demonstration environments.

8.3 Others

Sub-processors — a small, disclosed set, listed in the DPA Annex III. Hosting is within India. Notification providers receive masked references only.
Authorities — where compelled by valid legal process. We assess each request, disclose the minimum required, notify the hospital unless prohibited, and direct the authority to the hospital as data fiduciary where feasible.
No one else. Not insurers, not employers, not researchers, not device vendors, not our own commercial teams.

9. Notifications and identifiers

The Platform can send alerts and reports by email, SMS and WhatsApp to hospital-designated recipients. These travel over third-party networks that we do not control.

Because of this, notification content is minimised and identifiers are masked. A notification is designed to tell a clinician that attention is needed and where, not to carry clinical detail through an insecure channel. Full information is available only after signing in to the Platform.

Hospitals configuring notification content and recipient lists are responsible for keeping those lists current and for ensuring recipients handle messages appropriately — including not forwarding them.

10. Where data is held

Patient data is stored and processed within India — production, backups and disaster recovery copies.
Caresoft support and engineering access is from India. Access from outside India is not permitted for patient data without the hospital's written consent.
Transfers outside India occur only where permitted by law and instructed by the hospital in writing.
Edge agents hold a local buffer at the hospital site; that data is on hospital premises under hospital physical control until uploaded.

11. How long we keep it

Data	Retention
Patient clinical and physiological data	As instructed by the hospital, consistent with its medical-record obligations. We do not delete it on our own initiative
Audit trail of access and clinical entries	With the associated record; immutable, amendments recorded rather than overwritten
System logs required by law	Minimum 180 days, held in India (Section 13)
Data relating to an open safety or security investigation	Preserved until the investigation is formally closed, regardless of any deletion instruction
Backups	Rolling [35] days; deleted data ages out with them
Hospital account, contract and tax records	Up to 8 years as required by Indian tax law
Support correspondence	[24] months from closure
Website enquiries	[24] months, or until you ask us to remove them

On termination of a hospital's agreement, data is exported to the hospital and then deleted on written confirmation, with certification. See DPA §16.

12. Security

Measures include: encryption in transit and at rest; cryptographically signed device data with rejection of invalid signatures; role-based access with multi-factor authentication for administrative access; server-side portal separation; immutable audit logging; multi-tenant isolation; no production data in non-production environments; masked identifiers in notification channels; backup with tested restoration; vulnerability scanning and periodic penetration testing; and a documented incident response plan with a patient-safety severity ranked above critical.

The full measures are in DPA Annex II. Security is shared — the hospital is responsible for its network, its device segment, edge agent physical security, and user access hygiene, as set out in the Device Interfacing Policy.

13. If something goes wrong

We notify the affected hospital of any personal data breach within [6] hours of becoming aware — a deliberately short window, because the hospital may have its own reporting clock running.
We are required to report specified cyber incidents to CERT-In within 6 hours, and to retain system logs for a minimum of 180 days within India. These legal obligations override conflicting deletion requests to the extent the law requires.
Evidence relating to a breach or a patient safety incident is preserved and not altered until the investigation closes.
The hospital notifies patients and regulators, as data fiduciary. We provide the information and support required and do not contact patients directly without the hospital's written instruction.
We provide a written root cause analysis with corrective actions within [10] working days.

14. Rights and how to exercise them

14.1 Patients

You may have the right to access your data, have it corrected, obtain information about processing, nominate someone to act for you, and raise a grievance. Exercise these with your hospital — it holds your record and decides what happens to it. It has a grievance officer and a defined response time.

If you contact us directly, we will not disclose your records to you; we will refer you to your hospital and tell them you have been in touch within [2] working days. This is not obstruction — we are not permitted to release a hospital's medical records, and we cannot verify your identity as your treating hospital can.

Erasure of a clinical record is limited. Medical records must be retained for periods set by law and accreditation standards, and audit trails are immutable for patient safety and evidential reasons. Your hospital can explain what can and cannot be removed and why.

14.2 Clinical users

Your account and activity data belongs to your hospital's record. Raise access or correction requests with your hospital administrator. We will assist them.

15. Contact and Grievance Officer

Grievance Officer (Information Technology Act, 2000; Digital Personal Data Protection Act, 2023)
Name: Rajeev Pillai
Email: [email protected]
Address: 311, Mahesh Industrial Estate , Silver Park, Mira Road East , Thane -401107
Acknowledgement within 24 hours; resolution within 15 days.

You may complain to the Data Protection Board of India if you are dissatisfied with our response. If your complaint concerns your care or your medical record, your hospital and its accreditation body are the right route.

Caresoft Systems Private Limited, CIN : U72900MH2022PTC387875.

16. Changes

We may update this policy. The version date at the top will change. Hospitals are notified of material changes at least [30] days in advance; changes reducing protection require the hospital's agreement under the DPA. Where a change affects patients, hospitals are responsible for reflecting it in their own patient notices.