Privacy policy

If you are a patient, your clinic decides what to record about you and why. Under the DPDP Act the clinic is the Data Fiduciary, and Blitho is its Data Processor: we store and process your records only on the clinic’s instructions, and we do not use them for anything else. Requests about your medical record should go to your clinic first; we will help the clinic answer them.

If you are a doctor, clinic staff member or applicant, Blitho is the Data Fiduciary for your account and application details.

Records stay with the clinic that created them. Blitho does not share one clinic’s patient records with another clinic.

• Beta applications: your name, email, phone, qualification, medical registration number and council, practice name and address, and optionally GSTIN or PAN, plus the certificates you upload. We use these only to verify that you are a registered practitioner before opening a clinic. We do not collect Aadhaar.
• Clinic accounts: name, email, phone, a hashed password (never the password itself), your role in the clinic, and a log of sign-ins and sensitive actions, kept for security and audit.
• Patient records (processed for the clinic): demographic details, visit notes, vitals, diagnoses, prescriptions, invoices and the messages the clinic sends.
• This website: we set only the cookies needed to keep you signed in (see the cookie policy). We count page visits with Cloudflare Web Analytics, which uses no cookies and does not identify you. It runs on public pages only, never inside the clinic app.

We do not sell personal data, and we do not use it for advertising.

All application and clinic data is stored in India, in Google Cloud’s Delhi region. Data is encrypted in transit and at rest, and each clinic’s records are isolated from every other clinic’s by the database itself, not just by our code. Access by Blitho staff is limited to support and verification work, and it is logged.

We use these service providers. Each receives only what its job needs.

• Google Cloud: Hosting, database, file storage and background jobs. Location: India (Delhi, asia-south2).
• Cloudflare: Network security, delivery and cookieless website analytics. Location: Its global edge network; nothing is stored there beyond short-lived caches of public pages.
• Zoho Mail: Sending account and application emails. Location: India.
• Meta (WhatsApp Business Platform): Delivering prescriptions, invoices and reminders a clinic chooses to send on WhatsApp. Location: Meta's infrastructure, under its WhatsApp Business terms.
• Google Sign-In: Optional sign-in; we receive your name and email address only. Location: Google's infrastructure.

• Patient records are kept for as long as the clinic uses Blitho, and for any longer period the clinic is legally required to keep medical records. When a clinic closes its account, it can restore it for a limited period; after that, its data is deleted.
• Documents uploaded with an application that is refused are deleted after a short review period.
• Account and audit logs are kept for as long as they are needed for security.

Under the DPDP Act you can:

• ask what personal data about you is processed, and with whom it has been shared;
• ask for inaccurate or incomplete data to be corrected, completed or updated;
• ask for data to be erased once it is no longer needed, unless the law requires it to be kept;
• withdraw consent you have given, for example to receiving WhatsApp messages;
• nominate someone to exercise these rights for you if you cannot; and
• raise a grievance with our Grievance Officer, and then with the Data Protection Board of India if you are not satisfied.

Patients: please contact your clinic first. Everyone else: write to support@blitho.com. We reply within 7 days.

Blitho is used by clinics, not by children directly. When a clinic registers a patient under 18, the clinic is responsible for obtaining a parent’s or guardian’s consent.

If we change how we handle personal data, we update this page first and change the date at the top. For material changes we also email clinic owners before the change takes effect.

Questions: support@blitho.com.