SMRKOMED Privacy Policy

1. Introduction

SMRKOMED is a modular healthcare technology platform developed and operated by Smrkonova Softech Solutions LLP (“we,” “our,” or “us”). The platform supports healthcare organizations with patient management, appointments, care coordination, workflows, communication, documentation and related healthcare operations.

This Privacy Policy explains how information may be collected, processed, stored, protected, used and deleted when users interact with SMRKOMED or when healthcare organizations use the platform.

2. Information We May Process

SMRKOMED does not collect every category of information from every user. Depending on the modules, configuration and integrations used, SMRKOMED may process:

• Account and Identity Information: Login credentials, staff usernames, roles, and administrative contact details.
• Staff/User Information: Professional designations, staff profiles, and authorization roles.
• Organization and Clinic Information: Healthcare facility profiles, branch locations, operating schedules, and organizational settings.
• Patient and Couple Demographics: Patient names, dates of birth, genders, partner linkages (where relevant to fertility or couple care pathways), and emergency contacts as entered by the clinic.
• Contact Information: Phone numbers, email addresses, and communication addresses.
• Appointment and Scheduling Information: Scheduled visit dates, consultation types, assigned doctors or specialists, and attendance status.
• Care Plans, Treatment Journeys and Tasks: Care protocols, journey milestones, task tracking, follow-up reminders, and care coordination steps.
• Clinical Documents and Reports: Diagnostic reports, imaging attachments, test findings, and clinical documentation uploaded by clinic personnel.
• Medications and Prescription-Related Information: Prescribed medications, dosage instructions, frequency, and prescription schedules.
• Communication Records: Operational message logs, patient reminders, and authorized correspondence.
• WhatsApp Business Messages and Related Metadata: Inbound and outbound message text, delivery statuses, timestamps, and WhatsApp phone identifiers when WhatsApp integration is enabled.
• Voice/Audio Information: Audio recordings or dictated speech notes where voice consultation or transcription features are enabled.
• Billing/Invoicing Information: Fee amounts, invoice references, payment status records, and transaction receipts (payment card numbers or banking credentials are not stored by SMRKOMED).
• Technical and Browser Information: IP addresses, browser types, device identifiers, and session tokens necessary to operate the platform securely.
• Security and Audit Information: Activity logs, authentication timestamps, security events, and administrative access records.
• Consent and Communication Preferences: Patient communication choices, consent statuses, and notification opt-ins.

Note: SMRKOMED does not claim or require that all of these categories are collected or processed for every user or healthcare organization.

3. How Information Is Used

Information processed through SMRKOMED may be used to:

• Provide and operate the SMRKOMED platform
• Manage patients and healthcare workflows
• Manage appointments
• Support care journeys and treatment plans
• Facilitate authorized communication
• Provide WhatsApp messaging functionality where enabled
• Support reminders and follow-ups
• Maintain documents and reports
• Provide operational dashboards and analytics
• Maintain security
• Detect unauthorized activity
• Troubleshoot technical problems
• Improve reliability and performance
• Maintain audit records
• Manage consent and privacy requests
• Comply with applicable legal, regulatory and contractual obligations

4. Healthcare and Patient Data

SMRKOMED is designed for healthcare environments where privacy and confidentiality are important:

• Platform Role: SMRKOMED is a technology platform and not a medical practitioner. It does not replace doctors or other healthcare professionals.
• Clinical Responsibility: SMRKOMED does not independently determine diagnosis or treatment. Healthcare professionals remain responsible for clinical decisions.
• Access Controls: Access is controlled through authentication, role-based permissions and organization/clinic boundaries.
• Data Minimization: SMRKOMED is designed to minimize access to information according to the user's role and required workflow.

5. WhatsApp Business Integration

SMRKOMED may integrate with Meta's WhatsApp Business Platform / WhatsApp Cloud API when a healthcare organization enables the integration.

When this integration is active:

• Incoming and outgoing WhatsApp messages may be processed by SMRKOMED.
• Message content, timestamps, phone identifiers and relevant delivery metadata may be processed.
• Messages may be associated with a patient, couple or contact within the relevant clinic where configured.
• WhatsApp data is processed to provide communication, inbox, reminders, follow-ups and related workflow functionality.
• The healthcare organization is responsible for using WhatsApp communication appropriately and obtaining any required consent or authorization.
• SMRKOMED does not use WhatsApp information for cross-clinic advertising or unrelated profiling.
• Meta/WhatsApp operates its own infrastructure and policies. Data processed directly by Meta is subject to Meta's own terms and privacy practices.
• SMRKOMED cannot control or delete data stored directly on Meta's infrastructure.

6. AI and Automated Processing

SMRKOMED may provide optional AI-assisted features. Examples may include:

• Summarization of consultation or visit notes
• Workflow assistance and administrative coordination
• Task extraction and milestone suggestions
• Administrative queries against clinic workflow materials
• Drafting follow-up content and patient reminders
• Processing relevant consultation information where enabled

Please note the following operational parameters regarding AI functionality:

• AI is assistive.
• AI is not intended to independently diagnose medical conditions.
• AI is not intended to independently prescribe medication.
• AI does not replace professional clinical judgment.
• Human review may be required before AI-generated content is finalized or communicated.

7. Voice and Audio

Where voice or consultation features are enabled, audio may be temporarily processed to generate transcription, summaries or workflow information. Retention and storage of audio may depend on the specific feature and configuration.

8. Data Sharing and Disclosure

Information may be shared with:

• Authorized users within the healthcare organization
• Service providers required to operate the platform
• Cloud/database/infrastructure providers
• Integration providers when integrations are enabled
• Payment providers where applicable
• Healthcare/digital health integration providers where applicable
• Government authorities where legally required
• Other parties where appropriately authorized

Access is limited to information necessary for the relevant service or purpose where appropriate.

9. Data Security

SMRKOMED implements technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure or destruction.

Implemented security controls include:

• HTTPS/TLS encryption in transit
• Role-based access control
• Authentication/session controls
• Tenant and clinic-level data isolation
• Secure handling of integration credentials
• Encryption/security controls for sensitive integration secrets
• HMAC/signature validation for supported webhooks
• Audit logging
• Secure document handling
• Access controls
• Secrets management

No internet-based system or electronic storage mechanism can be guaranteed to be completely secure.

10. Data Retention

The duration for which information is retained depends on:

• Nature and sensitivity of information
• Healthcare organization's requirements
• Applicable legal/regulatory requirements
• Contractual obligations
• Accounting/tax requirements
• Security and audit requirements
• Product configuration

Certain healthcare, financial, contractual or security records may need to be retained where required by applicable law, regulatory requirements, contractual obligations or legitimate security purposes.

11. Data Deletion

Users may request deletion of applicable personal information processed by SMRKOMED. Deletion is subject to applicable legal requirements, healthcare record retention requirements, contractual requirements, accounting requirements, and security/audit requirements.

For complete instructions on submitting a deletion request, please see our dedicated page: Request Data Deletion.

12. Data Access, Correction and Export

Appropriate users and authorized clinic administrators may be able to access, correct or export information depending on their role and platform configuration.

Patients requesting access or correction to healthcare records may need to contact the healthcare organization that maintains their records, as the healthcare provider retains primary medical custody over the clinical record.

13. Cookies and Technical Information

SMRKOMED utilizes essential cookies and session mechanisms along with technical logs required to operate, authenticate, and secure the platform. We do not use third-party advertising cookies or cross-site behavioral tracking pixels.

14. Third-Party Services and Integrations

SMRKOMED may integrate with external services, including:

• Meta WhatsApp Business Platform
• Payment services
• ABDM/ABHA-related services
• Other healthcare integrations

When a third-party integration is enabled, the third party may process information under its own terms and privacy policies. SMRKOMED does not control third-party infrastructure or data retention practices.

15. Children and Minors

Healthcare organizations using SMRKOMED may process information relating to minors where relevant to their healthcare services. Such organizations are responsible for handling information relating to minors in accordance with applicable law and their professional obligations.

16. Privacy Requests and Grievances

Users may contact SMRKOMED regarding applicable:

• Privacy questions
• Access requests
• Correction requests
• Deletion requests
• Data-related concerns
• Grievances

17. Updates to This Policy

This Privacy Policy may be updated when the platform, integrations, legal requirements or data practices change.

Last updated: September 2026