Privacy policy
HealthSarthi is a small, independently run business. This page says plainly what we collect, why, where it lives, who else touches it, and how to get it deleted. If anything here is unclear, write to us and a person will answer.
1. Who we are
HealthSarthi is a sole proprietorship registered in India under the Udyam scheme (MSME), owned and operated by Prakhar Pandey, who is also the grievance officer and the person responsible for your data under the DPDP Act, 2023. We build MedStock, billing and inventory software for medical stores, and we are building the wider HealthSarthi network for patients, doctors, labs, clinics and hospitals. Only MedStock is live today; the rest of this policy already covers the network services so nothing changes underneath you when they launch.
2. What we collect
When you create a MedStock account
- Your name, mobile number and email address.
- Your shop's name, address, GSTIN and drug-licence number — what a GST invoice legally has to carry.
- A password, stored only as a salted hash. We never see the password itself.
Data you enter while running your shop
- Products, batches, expiry dates, purchases, sales, stock movements and suppliers.
- Customer names and phone numbers if you choose to record them on a bill or a khata entry.
- Staff names, roles and attendance, if you use those features.
This is your business's data. We process it only to run the software for you.
Collected automatically
- Device type, operating system, app version and a device identifier — used to pair your counters and keep them in sync.
- Server logs: the time of a request, the endpoint, your account id and IP address. Kept for 30 days for security and debugging.
- We do not use advertising trackers.
Cookies and browser storage
- healthsarthiai.com (this website) sets no cookies. It keeps two small values in your browser's local storage: your light/dark theme choice (
ms-theme) and the fact that you have seen the cookie notice (hs-consent-v1). Visits are counted with Cloudflare Web Analytics, which is cookieless and does not identify you. - app.healthsarthiai.com (MedStock) sets one cookie,
medstock_refresh, only after you sign in. It keeps you signed in, is HttpOnly and Secure, and is removed when you sign out. The dashboard also keeps a per-tab flag in session storage so a page reload stays inside the app. - Clearing your browser's site data removes all of the above. Nothing here is used for advertising or shared with third parties.
WhatsApp messaging
MedStock can send reorder messages to your distributors and, in future, reminders to your customers, through the Meta WhatsApp Business Platform. For that we process the recipient's phone number, the message content, and delivery status. Meta processes these under its own terms; we only message numbers that you have told us the recipient agreed to receive messages on, and we keep a record of that consent.
3. Why we use it
| Purpose | Legal basis (DPDP Act 2023) |
|---|---|
| Running the software you signed up for — billing, stock, sync, backups | Consent given at sign-up; performance of our agreement with you |
| Sending WhatsApp messages you trigger (reorders, receipts, reminders) | Consent of you and the recipient |
| Support, fraud prevention, keeping the service secure | Legitimate use for the stated purpose |
| Legal obligations — GST records, responding to lawful requests | Legal obligation |
We do not sell personal data. We do not use your shop's data to train models or share it with other businesses.
4. Where it lives
- On your device first. MedStock is offline-first. Your shop's records are stored in an encrypted local database (SQLCipher) on each counter and phone.
- Then synced to our servers in India. When you are online, changes sync to our servers hosted in the AWS Asia Pacific (Mumbai) region. Data stays in India. Backups are encrypted and also stored in Mumbai.
- Isolated per shop. Each business is a separate tenant in our database with row-level security, so one shop can never read another's data — this is enforced by the database itself, not just by application code.
5. Who else sees it
| Provider | What for | What they receive |
|---|---|---|
| Amazon Web Services (Mumbai) | Hosting, storage, backups | Encrypted data at rest; AWS cannot read it in the ordinary course |
| Meta Platforms (WhatsApp Business Platform) | Delivering WhatsApp messages you send | Recipient number, message content, delivery status |
| Google Fonts | Fonts on the public website | Your browser's request for the font file (IP address, user agent) |
We share data with authorities only when the law requires it, and we tell you unless we are legally prevented from doing so. If we ever sell the business, your data moves with it under this same policy and you will be notified.
6. How long we keep it
- Account and shop data: for as long as your account is active, plus 30 days after deletion to allow recovery from mistakes.
- GST invoices: the Indian GST law requires records to be kept for 6 years from the return's due date. We keep only the invoice records needed to meet that, and nothing else, after deletion.
- Server logs: 30 days.
- WhatsApp consent records: for as long as we could still message that number, then deleted.
7. Your rights
Under the Digital Personal Data Protection Act, 2023 you can ask us to:
- Show you the personal data we hold about you and how it has been used.
- Correct or complete it.
- Delete it (see Data deletion).
- Withdraw consent at any time — the service may stop working for you, but we will not hold that against you.
- Nominate someone to exercise these rights for you.
- Complain — first to our grievance officer (see Patient rights & grievances), then to the Data Protection Board of India.
Email team@healthsarthiai.com from your registered email. We answer within 7 days and complete the request within 30.
8. Deleting your data
Full instructions, including how to remove HealthSarthi from your Facebook or WhatsApp business settings, are on the data deletion page. In short: email us "Delete my account" from your registered email, and within 30 days your account, shop data and backups are gone, except the GST records we are legally required to keep.
9. Security
Everything travels over TLS. Local databases are encrypted with SQLCipher. Passwords are hashed. Access tokens expire. Tenants are isolated with row-level security. Our team is small, and only the people who run the servers can reach production. We do not currently hold an ISO 27001 or SOC 2 certificate, and we will not claim one until we do. Details and how to report a problem are on the security page.
10. Children
MedStock is for businesses and their staff, and is not meant for anyone under 18. If we learn we have collected a child's data without a parent's consent, we delete it.
11. Changes
If we change this policy in a way that matters, we email account holders and show a notice in the app before it takes effect. Older versions are available on request.
12. Contact
Write to team@healthsarthiai.com. For grievances, see the grievance process.