Privacy Policy

1. Who we are

StayRising is a sole proprietorship owned by Aryan Yadav and registered under the Government of India's Udyam scheme. We provide StayRising, a cloud-based Hospital Management Software (HMS) with a WhatsApp messaging module, to hospitals and clinics.

Legal name

StayRising (Sole Proprietorship)

Proprietor

Aryan Yadav

Product

StayRising — Hospital Management Software (HMS) with WhatsApp messaging module

Udyam Registration No.

UDYAM-UP-38-0102031

Registered address

1, Prem Babu, Shitalganj, Mariyahu Road, Mariyahu, Jaunpur, Uttar Pradesh – 222161, India

Phone

+91 8081070281

Email

support@stayrising.in

Website

stayrising.in

2. Our role: Data Processor and Data Fiduciary

Hospitals, clinics and other healthcare providers that subscribe to StayRising ("Customers") decide why and how their patients' personal data is processed. For that patient data, the Customer is the Data Fiduciary and StayRising acts as a Data Processor on the Customer's behalf. We process patient data only on the Customer's instructions and only to provide the service.

StayRising is the Data Fiduciary only for:

• personal data of visitors to our website; and
• account, billing and contact data of our Customers and their authorised users.

If you are a patient, the hospital or clinic you visited is responsible for your data. See Your rights for how to make a request.

3. Data we collect

Hospital account and admin data

• Names, email addresses, phone numbers and roles of the Customer's authorised users.
• Hospital or clinic name, address, billing and tax details.
• Login credentials (passwords are stored only in hashed form), account settings and configuration.
• Support requests and communications with us.

Patient data entered by hospitals

• Patient name, phone number and demographic details.
• Appointments, visit history and queue/token information.
• Billing, invoices and payment status.
• Medical records such as consultation notes, prescriptions, diagnoses and reports.
• WhatsApp messages exchanged between the hospital and the patient.

Medical records are sensitive personal data. We process them only on behalf of the hospital that entered them.

Website usage data and cookies

• Technical data such as IP address, browser and device type, pages visited, referring page, and date and time of visit.
• Information you submit through our contact or demo forms (name, email, phone and message).
• Cookies and similar technologies, as described in the Cookies section below.

4. How and why we use data

• To provide, operate and maintain the HMS, including appointments, records, billing and queues.
• To send and receive WhatsApp messages on a Customer's behalf, such as appointment confirmations, reminders and replies.
• To create and manage Customer accounts, authenticate users and provide support.
• To bill subscription fees and keep financial records.
• To secure the service, prevent fraud and misuse, and maintain audit logs.
• To respond to enquiries and demo requests submitted through our website.
• To improve the service using aggregated or de-identified usage information.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell personal data, and we do not use patient data or message content for advertising.

5. Legal basis and consent

Patient data: we process patient data on behalf of the Customer. The Customer is responsible for having a valid basis under applicable law for processing its patients' data, which will usually be the patient's consent, and for giving patients any notice the law requires.

Website visitors and Customer account data: we rely on your consent (for example, when you submit a form), on the performance of our agreement with the Customer, and on other legitimate uses permitted by law, including compliance with legal obligations.

You may withdraw consent at any time (see Your rights). Withdrawal does not affect processing carried out before it.

6. WhatsApp Business Platform

StayRising's WhatsApp module is built on Meta's WhatsApp Business Platform (WhatsApp Cloud API).

• Connecting an account. Each hospital connects its own WhatsApp Business Account (WABA) to StayRising through Meta's Embedded Signup. The hospital remains the owner of its WABA and phone number.
• What we store. We store the hospital's WABA ID, phone number ID and the access tokens issued by Meta. Access tokens are stored encrypted and are used only to send and receive messages on the hospital's behalf.
• Message processing. Message content, delivery and read status, and patient replies are processed through Meta's WhatsApp Cloud API and stored in the hospital's StayRising account so that authorised staff can view conversation history.
• Meta's terms also apply. Meta processes this data under its own terms and policies, including the WhatsApp Business Policy and the Meta Privacy Policy.
• No selling, no advertising. We do not sell WhatsApp message data and do not use it for advertising.
• Patient opt-in. Hospitals are responsible for obtaining patients' opt-in before sending them WhatsApp messages, and for honouring opt-out requests.
• Disconnecting. A hospital can disconnect WhatsApp at any time from Settings > WhatsApp in StayRising. To have stored WhatsApp data deleted, follow our Data Deletion Instructions.

7. Sharing of data

We share personal data only with:

• Meta Platforms (WhatsApp), to send and receive WhatsApp messages through the WhatsApp Cloud API.
• Hosting and cloud providers that store and run the service on our behalf, under confidentiality and security obligations.
• Our payment gateway, to process subscription payments. We do not store full card details.
• Authorities, when required by law, court order or a lawful request from a government authority.

Patient data is also available to the hospital that entered it and to that hospital's authorised staff. We do not sell, rent or trade personal data.

Some of these providers, including Meta, may process data outside India. Where this happens, we do so in accordance with applicable Indian law.

8. Security

We use reasonable security practices to protect personal data, including:

• Encryption in transit (HTTPS/TLS) and encryption at rest, including for stored WhatsApp access tokens.
• Access controls, so that only authorised people can reach the data.
• Role-based access within the HMS, so staff see only what their role requires.
• Audit logs of access and important actions.

No system is completely secure. If we become aware of a personal data breach affecting a Customer's data, we will inform that Customer without undue delay so that it can meet its own obligations.

9. Data retention and deletion

• Customer and patient data is kept while the Customer's account is active, or as the Customer instructs.
• When an account is closed or a deletion request is made, we delete the data within 30 days, except data we must keep to meet legal obligations (for example, tax and accounting records), which we keep only for as long as the law requires.
• Website enquiry data is kept only as long as needed to respond and follow up.

To request deletion, see our Data Deletion Instructions.

10. Your rights

Subject to applicable law, you have the right to:

• access information about the personal data processed about you;
• correct, complete or update your personal data;
• have your personal data erased;
• withdraw consent you have given; and
• have your grievances addressed.

Patients: please contact your hospital or clinic first, because it controls your data. If you contact us instead, we will pass your request to the relevant hospital and help it respond.

Customers and website visitors: email us at support@stayrising.in. We may need to verify your identity before acting on a request.

11. Grievance Officer

For any privacy question or complaint, contact our Grievance Officer:

• Name: Aryan Yadav
• Email: support@stayrising.in
• Phone: +91 8081070281
• Address: 1, Prem Babu, Shitalganj, Mariyahu Road, Mariyahu, Jaunpur, Uttar Pradesh – 222161, India

We will respond within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India as provided under the Digital Personal Data Protection Act, 2023.

12. Cookies

We use cookies and similar browser storage that are needed for the website and the HMS to work, such as keeping you signed in and remembering simple preferences. If we use analytics cookies, they are used only to understand overall website usage.

You can block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the service, such as signing in, from working.

13. Children's data

Our website and service are not directed at children, and we do not knowingly collect personal data from children through our website.

Hospitals may enter data about patients who are minors as part of providing care. They may do so only with the consent of the minor's parent or lawful guardian, which the hospital is responsible for obtaining. We do not use children's data for tracking, behavioural monitoring or targeted advertising.

14. Laws we follow

• The Digital Personal Data Protection Act, 2023.
• The Information Technology Act, 2000.
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

15. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new effective date. For material changes, we will also notify Customers by email or in the HMS.

16. Contact us

Questions about this policy can be sent to support@stayrising.in, by phone on +91 8081070281, or by post to StayRising (Sole Proprietorship), 1, Prem Babu, Shitalganj, Mariyahu Road, Mariyahu, Jaunpur, Uttar Pradesh – 222161, India.