Privacy policy

Last updated: 17 October 2026

Medixar is operated by Daiviksoft Technologies Private Limited ("Medixar", "we", "us", "our"), a private limited company registered in India. This policy explains what data we collect, how we use it, and the rights you have over it. It applies to medixar.ai, app.medixar.ai, our mobile apps, and any related services.

If you are a patient whose data has been entered into Medixar by a clinic or hospital, that organisation is the data controller of your record — Medixar processes the data on their behalf. Please contact your clinic for access, correction, or deletion of your medical record.

1. Data we collect

From you (the practice / clinician)

• Account details — name, email, phone number, role, organisation name, registration / licence numbers.
• Billing details — GSTIN, PAN, billing address. Card numbers are never stored on our servers; we use Razorpay and Stripe for payment processing.
• Audit metadata — login timestamps, IP addresses, browser fingerprint, actions taken inside the app.

From your patients (entered by you)

• Demographics — name, date of birth, gender, contact, government ID (Aadhaar/PAN/passport when provided).
• Medical record — diagnoses, prescriptions, lab and imaging results, vitals, allergies, immunisations, clinical notes, attached documents.
• Insurance information when provided for billing.
• ABHA health ID where the patient elects to link it.

From the contact form and the sign-up links on this website

• What you type in the contact form: your name, email, phone number, clinic or hospital, the topic you choose and your message. It is recorded in Daiviksoft's own CRM (Workdome, hosted in India) and used only to reply to you.
• How you found us: the campaign tags in the link you arrived by (such as utm_source), the name of the site that referred you (never the full address) and the first page you landed on. Your browser holds this only for the current visit, in session storage that is cleared when you close the tab. It sets no cookie, and it leaves your browser only when you send the contact form or follow a Start free link to create an account. On sign-up it is stored with your organisation's account so we can tell which channels bring new customers; the Medixar app itself runs no analytics.

Automatically

• Standard web logs — IP, user agent, referring URL, request path. Retained for 30 days for security and abuse detection.
• Cookies — essential cookies in the app; on the medixar.ai website, analytics cookies only if you accept them. We do not use advertising cookies. See section 6.

2. How we use the data

• To provide, maintain, and improve the Medixar service.
• To authenticate users and protect against unauthorised access.
• To bill you for the service and to handle GST compliance.
• To respond to your support requests.
• To meet legal, regulatory, and contractual obligations.

We do not sell your data. We do not use Protected Health Information (PHI) for advertising, analytics resale, or training third-party AI models. AI features inside Medixar (voice-to-SOAP, ICD coding, predictions) work on the patient's record only; where they use an AI provider, that provider is listed in section 4 and does not use the data to train its models.

3. Protected Health Information (PHI)

PHI is treated under stricter rules than other data:

• Stored in tenant-isolated databases protected by PostgreSQL row-level security so one customer's data is never exposed to another.
• Encrypted at rest using AES-256 and in transit using TLS 1.3.
• Access is audited — every read or write of a clinical record is logged with user, tenant, timestamp, and reason. Audit logs are append-only.
• "Break-the-glass" emergency access requires a written justification and triggers a privacy-officer review within 72 hours.
• Backups are encrypted and retained for 35 days, then permanently deleted.

A Business Associate Agreement (BAA) can be agreed, by arrangement, for international-patient programmes that require one.

4. Sharing with third parties

We share data only with the sub-processors listed below, and only to the extent necessary to deliver the service:

We disclose data to government or law-enforcement authorities only when compelled by valid legal process, and we notify the affected customer unless the legal process forbids it.

5. Data residency & transfers

Customer data and PHI for Indian customers is hosted in AWS Mumbai (ap-south-1). Some sub-processors (OpenAI and Anthropic for AI inference, Stripe for international payments, PostHog for analytics) operate from outside India; where transfer is necessary, it is governed by Standard Contractual Clauses or equivalent safeguards. PHI sent to AI sub-processors is processed transiently and is not used to train their models.

6. Cookies and website analytics

In the Medixar app (app.medixar.ai) we use a small set of essential cookies — session token, CSRF token, language preference — and no analytics or tracking tools of any kind. That is where patient data lives, and it stays out of reach of every analytics vendor.

On this website (medixar.ai) two kinds of measurement run, and they behave differently:

• Cloudflare Web Analytics runs on every visit and sets no cookies. It counts page views and loading performance without identifying you or following you across sites, so it needs no consent.
• Google Analytics 4 and Microsoft Clarity set cookies and are off until you accept them in the banner. Nothing from either tool loads, and no cookie is set, unless you press Accept. If you accept, Clarity records how pages are used — mouse movement, clicks and scrolling — to show us where the site is confusing; it masks what you type into forms. Google Analytics data is kept for 14 months and Clarity recordings for 30 days.

We do not place advertising or cross-site tracking cookies. Google and Microsoft publish their own privacy policies, and process this data on their own infrastructure, including outside India.

Change my cookie choice

7. Your rights

Depending on the law that applies to you:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix inaccurate or incomplete data.
• Erasure — request deletion (subject to legal record-retention requirements that apply to medical records).
• Portability — export your data in a machine-readable format.
• Withdraw consent — at any time where processing relies on consent.
• Lodge a complaint — with the relevant supervisory authority (Data Protection Board of India under DPDPA 2023, your country's data protection authority, or HHS OCR for HIPAA matters).

To exercise any of these rights, email [email protected]. We respond within 30 days. Patients should contact their treating clinic directly — the clinic is the controller of the medical record.

8. Retention

• Account data — kept for the life of the account plus 90 days after closure.
• Medical records — retained as required by Indian medical-records law (typically 3 years for OPD, 10 years for IPD, longer for medico-legal cases). Customers can configure retention per record class within those minimums.
• Audit logs — 7 years (compliance requirement).
• Web access logs — 30 days.

9. Security

Detailed security architecture lives on our security page. In short: tenant isolation via PostgreSQL row-level security, AES-256 at rest, TLS 1.3 in transit, MFA-eligible accounts, BCMA + double-checks on high-risk medication actions, immutable audit logs, daily encrypted backups, and an incident-response plan with 72-hour notification.

10. Children's data

Medixar is used by clinicians who treat patients of all ages, including minors. The clinic, as data controller, is responsible for parental consent under Indian law (DPDPA 2023, §9). We do not knowingly market the service to children directly.

11. Changes to this policy

We will post material changes on this page and notify active customers by email at least 30 days before they take effect. Minor edits (typos, clarifications) take effect immediately and are reflected in the "Last updated" date above.

12. Grievance Officer

If you have a complaint about how Medixar or this website handles personal data, write to our Grievance Officer:

Grievance Officer, Daiviksoft Technologies Private Limited
Email: [email protected]
Post: 1-4-2, 55/10, Puthiya Road, Vennala, Kochi, Kerala 682028, India

We resolve grievances within one month of receiving them, as the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 require. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India. Patients with a complaint about their medical record should first contact their treating clinic, which controls that record.

13. Contact

Privacy / data protection: [email protected]
General: [email protected]
Postal: Daiviksoft Technologies Private Limited, 1-4-2, 55/10, Puthiya Road, Vennala, Kochi, Kerala 682028, India.

We are committed to compliance with HIPAA (Health Insurance Portability and Accountability Act, USA), the Information Technology Act 2000 and SPDI Rules 2011 (India), and the Digital Personal Data Protection Act 2023 (India).