Legal

Privacy Policy

Effective 17 July 2026 · Written to be read, not skimmed past.

The two kinds of data, and our two roles

• Patient records your clinic creates (demographics, visits, clinical notes, prescriptions, bills): your clinic is the data fiduciary under the DPDP Act; Foveal is a data processor acting on your clinic's instructions. We use this data only to provide the service. We do not read it, sell it, mine it, share it, or use it to train anything.
• Account and business data about the clinic (clinic name, staff names and emails, contact details, payment records): here Foveal is the data fiduciary. We use it to run your subscription and support you.

Where data is stored and how it's protected

• Mumbai, India (AWS ap-south-1, operated via Supabase). Not replicated outside India.
• Encrypted in transit (TLS) and at rest.
• Per-clinic isolation enforced in the database (row-level security); Foveal platform administrators are structurally blocked from reading patient records, and automated tests verify this on every release.
• Daily backups; access to production is limited to the operator and logged.

Sub-processors

Supabase (database, authentication, hosting — Mumbai region), Cloudflare (website and app delivery), Resend (transactional email such as staff invitations), Sentry (error reports — configured to exclude personal and patient data). We add none without updating this page.

Consent, retention, and your rights

• The product captures patient consent at registration on the clinic's behalf, with timestamp and recorder.
• We keep clinic data for the life of the subscription plus a 90-day grace period after termination, unless law requires otherwise or the clinic requests earlier deletion.
• Clinic owners can export all clinic data (CSV) at any time — including when leaving.
• Patients exercising DPDP rights should contact their clinic (the fiduciary); we support the clinic in fulfilling such requests.

What we don't do

• No advertising, no trackers on the app, no analytics scripts on this website.
• No sale or sharing of any data, ever.
• No AI training on your records.

Contact

Grievance/data contact: hello@foveal.in. We respond within 72 hours.