Platiheal Privacy Policy

1. Who we are and what this notice covers

Platione Solutions Pvt Ltd operates Platiheal, including healthcare applications that may still use the Gripic name and healthcare websites hosted for providers. This notice explains personal-data handling for public visitors, account holders, patients, representatives, clinic personnel and authorized research users.

We determine purposes for platform accounts, security, billing, support and public-site operations. For records processed on a clinic’s or research organization’s instructions, that organization may determine the purpose and we may provide processing services. The actual purpose and agreement determine each party’s role; a label in this policy does not settle every legal responsibility. The organization’s own notice should explain its clinical or research handling.

This is a review draft. Before release, our published notice must match deployed processing, vendors, retention and consent controls. No ISO, HIPAA, GDPR, ABDM or other certification is asserted by this notice.

2. Information we receive

Account and identity information can include name, age or date of birth, contact information, login and verification events, family relationships, representative details, workspace memberships, professional role and provider affiliation. A dependent may have an internal identifier where direct contact information is not supplied.

Care-related information can include patient and clinic references, appointment and encounter details, consultation orders, bills, personal entries, clinical history, findings, investigations, examination and treatment information, follow-up, forms, amendments and uploaded documents. Research fields depend on the authorized project. Provide only information appropriate to the purpose and your authority.

We can receive payment references and status from the processor, communications and support submissions, public provider information and source URLs, and technical information such as IP address, browser/device type, device identifiers, authentication events, logs and usage events. We do not need your payment OTP, card security code or account password in a support request.

3. Sources and purposes

Information comes from you, an authorized representative, your clinic or care team, account administrators, transaction and communication providers, your device, and permitted public sources for provider profiles. When someone supplies another person’s information, they must have appropriate authority and provide the relevant notice.

We use information to authenticate users, resolve authorized workspaces, provide discovery and booking, process orders and payments, deliver requested records/forms and files, communicate service updates, answer requests, investigate misuse, maintain security and meet applicable legal obligations. Public-source audit information is used for digital-presence review and profile correction, not credential certification.

We must identify an applicable lawful basis for each purpose. Where consent is required, it must be obtained for that purpose and can be withdrawn as explained below. A general terms checkbox is not consent to treatment, research participation, marketing or all future uses of health data.

4. Health-data boundaries and identity matching

Personal health entries, clinical records and research records are distinct purposes with separate ownership and access rules. An account or a family relationship does not make all records visible. The initial patient timeline does not automatically expose all clinic-authored findings, and clinic membership alone does not make personal records available to staff.

Identifiers may be matched to reconcile patient accounts and public provider identities. Matching a phone, email or profile must not itself grant access to private clinical or research information. Public provider graphs and digital-presence evidence are separate from private health records. Report a mistaken link immediately so it can be investigated.

Private health data must not be made public or shared between unrelated organizations merely because they use the same platform. Any authorized sharing or access grant is limited to its stated recipient, purpose and scope and remains subject to applicable law.

5. Who can receive information

Depending on the requested service and access rules, recipients can include the selected clinic and authorized care staff, an appropriately authorized representative, research personnel approved for a specific project, and service providers operating hosting/storage, file security, authentication, payments, messaging, support and technical monitoring.

We may disclose information where required by a valid legal obligation or reasonably necessary to investigate abuse, protect legal rights or respond to a security incident, with appropriate assessment and data minimization. A corporate transaction may require a controlled transfer with applicable notice and safeguards.

Providers must give their own notice for onward disclosures. We do not authorize sale of private health records or their reuse for advertising through these terms. Optional analytics and marketing must have a separate, valid purpose and any required permission; private health details must not be sent in advertising events or ordinary support messages.

6. Public profiles and hosted provider websites

Published provider names, professional details, clinic information, services and public-source evidence can be visible to other users and search engines. Public information may be incomplete or outdated. Contact us or the provider to request a correction or raise an objection; we will assess the request and applicable obligations.

Do not upload patient documents to public profile, catalog or marketing fields. A public listing or website score does not establish medical registration or patient access. Provider-hosted sites can carry their own notices; identify which organization is collecting the information at the point of collection.

7. Children, families and representatives

Independent account holders must be adults. A parent or lawful guardian may manage a child’s information subject to verification and the permissions required by applicable law. We must not infer guardianship from a shared phone number or family label. A representative of another adult must have valid authority and respect that person’s choices.

Only necessary information should be entered for a dependent. Contact support if age, relationship or representative access is wrong. We must apply any additional child-data restrictions required by law, including restrictions on tracking, advertising or processing detrimental to a child. Product launch review must verify these safeguards before child-facing processing is enabled.

8. Research and AI

Research must have a defined project, authorized personnel, participant information and a lawful basis, including any required ethics approval and consent. Collection in a clinical form does not automatically authorize research reuse. Account acceptance and project inclusion are not research consent.

OCR, AI autofill and automated clinical-to-research copying are not promised in the current release. Before a future AI service receives health information, its purpose, provider, data flow, safeguards and any required consent must be disclosed. This policy does not grant blanket permission to train general-purpose models on private health records.

9. Cookies, analytics, notifications and device permissions

Cookies and local storage can support sign-in, security, workspace choices and performance. Technical logs and usage events can help diagnose faults. Optional analytics, advertising or marketing must be assessed separately and use any required permission; visiting a health-related page is not unlimited tracking consent.

Camera, file, location and notification access depend on the feature you choose and the permissions presented by your device. You can change device permissions in system settings, although related features may then be unavailable. We must not imply that every permission present in shared software is needed by the healthcare product.

Notification tokens, delivery information and message content may pass through communication providers. Reminders can be delayed or appear on a device lock screen; choose device settings appropriate to your privacy needs. If biometric sign-in is enabled, the operating system performs the biometric check; we do not require a copy of your fingerprint or facial template.

10. Storage, security and international processing

We apply access restrictions and technical and organizational safeguards appropriate to the data and service. No system is completely secure. Protect your device and credentials and promptly report suspected compromise. Access and file-scanning controls must be verified in the deployed environment; this notice does not promise end-to-end encryption, a specific certification or perfect availability.

Data may be handled by us, providers and contracted service providers in the locations used for the service. Before launch, the actual storage/backup locations, subprocessors and any international transfers must be recorded and made available through the privacy contact, with the safeguards and restrictions required by applicable law. We do not claim that all processing is located in India without verifying it.

If a personal-data breach occurs, we will assess, contain and respond and make notifications required by applicable law. Report concerns to [email protected] without forwarding unnecessary health documents.

11. Retention, deletion and record integrity

Retention depends on the purpose, provider instructions, applicable recordkeeping law, security needs and disputes. Account information, bookings, financial records, clinical records, research records, files and logs can have different periods. We should retain information only for an identified need and apply approved deletion or de-identification procedures when that need ends.

An account-closure request does not automatically erase clinical or research records that an organization must retain. Original record attachments may be retained without automatic expiry to preserve record integrity; deletion and amendment requests need review against the relevant legal and organizational duties. Backup copies may be removed through their applicable lifecycle rather than immediately.

Ask the privacy contact and the relevant provider for the retention basis applicable to your record. This draft does not invent a universal retention duration; the launch review must approve an operational retention schedule and deletion process.

12. Choices, rights and requests

Contact [email protected] to request information about processing, access, correction, account closure, deletion where applicable, withdrawal of optional consent or assistance with representative authority. We may verify your identity and authority proportionately before acting. Do not send a full medical file or identity document unless requested through an appropriate channel.

Withdrawing consent can affect the feature that relies on it and does not invalidate lawful earlier processing. Other retention obligations may continue. Where the clinic or research organization controls the record, we will direct or assist the request to the appropriate organization instead of changing clinical history without authority.

Available statutory rights and complaint routes depend on applicable law and its commencement. We will respect rights as they apply, including any applicable nomination or grievance rights. No contractual wording removes a remedy before a competent authority or court.

13. Contact, grievances and updates

Use the company contact details below for requests and complaints. Include enough information to locate the issue, with minimal sensitive data. We will acknowledge and address complaints within the periods required by applicable law and explain any further information needed. Where the Consumer Protection (E-Commerce) Rules apply, consumer complaints must be acknowledged within 48 hours and redressed within one month; other applicable statutory periods remain binding.

We will publish material changes with an updated version/date and provide additional notice and fresh consent where required. A later policy update does not by itself authorize a new incompatible use of health data.

Company and grievance contact

Platione Solutions Pvt Ltd
Office 4, Survey No 19/2 Sakhare Estate, Hinjawadi Wakad Rd, Hinjwadi, Pune, MH, India – 411057.

Privacy and grievance contact: Adv. Mrs. Usha Ghotankar.
Privacy: [email protected]
Grievances: [email protected]
Legal: [email protected]
Support: [email protected]
Security: [email protected]
Phone: +91-7083-888-888.

These are the existing Platione company contacts. Do not send passwords, OTPs or unnecessary sensitive documents by ordinary email. These contacts are not emergency medical services.