Synvian Privacy Policy
Operator: Intelligence Hut Private Limited (“Intelligence Hut”, “we”, “us”)
Product: Synvian, the clinic and practice management platform at synvian.ai
Last updated: [DATE]
This policy explains what personal information we collect through the Synvian website and application, how we use it, and the choices you have. It applies to visitors of synvian.ai, to people who create or use a Synvian account, and to the limited information we receive when you sign in with a Google account.
Synvian is a healthcare product. Patient records inside Synvian belong to the clinic that uses the service. Section 4 explains that distinction, because it determines who is responsible for your health information and whom to contact about it.
1. Who we are
Synvian is developed and operated by Intelligence Hut Private Limited, a company registered in India.
- Registered office: EN-35, 5th Floor, Walzen Building, Sector V, Salt Lake, Kolkata 700091, India
- Privacy contact: [privacy@intelligencehut.com]
- Grievance Officer (India, DPDP Act 2023): [NAME], [EMAIL], [POSTAL ADDRESS]
2. The two roles we play
| Data | Example | Our role |
|---|---|---|
| Account and website data | Your name, work email, sign-in records, pages you visit on synvian.ai, support messages | Intelligence Hut decides how this data is used. We are the data fiduciary (India) or controller (other jurisdictions). This policy governs it. |
| Customer data, including patient health information | Patient demographics, appointments, clinical notes, billing records entered by a clinic | The clinic decides how this data is used. We process it only on the clinic’s instructions under our Customer Agreement. We are the data processor. |
If you are a patient, your clinic is responsible for your health information. Please direct requests about your records to your clinic. We will help the clinic respond.
3. Information we collect
3.1 Information you give us
- Account details: name, work email address, job title, the clinic or organisation you belong to, and your role in Synvian.
- Sign-in credentials: if you use a password, we store it only as a one-way hash. If you sign in with Google, see Section 5.
- Support and sales communications: messages you send us, demo requests, and the details you enter on contact forms.
3.2 Information collected automatically
- Usage and device data: the pages and features you use, timestamps, browser type, operating system, screen size, language setting, and approximate location derived from your IP address.
- Security and audit logs: sign-in events, IP addresses, session identifiers, and a record of the actions taken in the application. Audit logs are a legal and security requirement for a healthcare system and cannot be opted out of.
- Application diagnostics: error reports and performance measurements. These are designed not to contain patient information.
3.3 Information from other sources
- Your organisation: the clinic administrator who invites you to Synvian provides your name, email address and role.
- Google: the profile information described in Section 5, only if you choose to sign in with Google.
4. Patient health information
Clinics use Synvian to store and manage patient records. This information is Customer Data.
- The clinic is responsible for collecting patient consent and for telling patients how their information is used.
- We process Customer Data only to provide the service to the clinic, to keep it secure, and as the law requires. We do not use patient information for advertising, for product marketing, or to train general-purpose machine-learning models.
- Where a clinic is a covered entity or business associate under the United States Health Insurance Portability and Accountability Act (HIPAA), we sign a Business Associate Agreement before any protected health information is stored in Synvian.
- When a clinic’s subscription ends, Customer Data is returned or deleted as described in the Customer Agreement.
Nothing in this policy gives Intelligence Hut any ownership of patient records.
5. Signing in with Google
Synvian offers “Sign in with Google” as a convenience. If you use it, Google shares the following with us from your Google account:
- your name
- your email address
- your profile picture
- a unique Google account identifier
We use this information only to create and secure your Synvian account, to show your name and picture inside the application, and to send you service messages. We do not request access to your Gmail, Google Drive, Calendar, Contacts or any other Google data unless a specific feature asks for it, and that feature will ask for your separate permission first.
Limited Use disclosure. Synvian’s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- we use Google user data only to provide and improve user-facing features of Synvian;
- we do not sell Google user data;
- we do not use Google user data for advertising;
- no person at Intelligence Hut reads Google user data unless you have given consent, it is needed for security or to comply with law, or it has been aggregated and anonymised.
You can withdraw Synvian’s access at any time at myaccount.google.com/permissions. Your Synvian account continues to exist and you can sign in with another method.
6. How we use information
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the service and your account | Account details, sign-in data, usage data | Performance of our agreement with you or your organisation |
| Keep the service secure, detect fraud and abuse | Security logs, IP addresses, device data | Legitimate interest in protecting a healthcare system; legal obligation |
| Maintain the audit trail a healthcare system requires | Audit logs | Legal obligation; legitimate interest |
| Respond to support requests and sales enquiries | Communications you send us | Performance of agreement; legitimate interest |
| Send service announcements, security notices and billing information | Email address | Performance of agreement |
| Send product news and marketing | Email address | Consent, which you may withdraw at any time |
| Improve the product | Aggregated, de-identified usage data | Legitimate interest |
| Comply with legal obligations | Whatever is required | Legal obligation |
7. Sharing information
We do not sell personal information. We share it only as follows.
- Your organisation. Clinic administrators can see the names, roles and activity of users in their own clinic.
- Service providers. Companies that host, store, deliver email for, or monitor Synvian on our behalf. They act only on our instructions and are bound by written agreements. The current list is available on request: [SUB-PROCESSOR LIST / URL].
- Legal requirements. Courts, regulators or law-enforcement bodies where the law requires it. We tell the affected clinic where we are permitted to.
- Business transfers. If Intelligence Hut is merged, acquired or sells assets, personal information may transfer to the successor, who remains bound by this policy.
8. Cookies and similar technologies
- Essential cookies keep you signed in and protect against request forgery. The application does not work without them.
- Preference cookies remember your language and display choices.
- Analytics on the public website measure page visits in aggregate. We do not run analytics or advertising trackers inside the signed-in application, and no patient information is ever sent to an analytics provider.
You can control cookies through your browser settings. Blocking essential cookies prevents sign-in.
9. Security
Synvian is built for health information. Among other measures:
- all data is encrypted in transit and at rest, and especially sensitive fields are encrypted separately at the application layer;
- every clinic’s data is isolated from every other clinic’s at the database level;
- access is controlled by role, and every read or change of a patient record is written to an audit log;
- staff access to production systems is limited, logged and reviewed.
No system is perfectly secure. If we learn of a breach affecting your information we will notify the affected clinic, and the authorities where required, without undue delay.
10. Retention
| Data | Retained |
|---|---|
| Account details | While your account is active, then [90] days |
| Security and audit logs | [7 years], as required for healthcare systems |
| Support communications | [3 years] after the matter closes |
| Website analytics | [26 months], in aggregate |
| Customer Data (patient records) | As instructed by the clinic; returned or deleted within [30] days of subscription end |
11. Where data is stored and transferred
Synvian is hosted in [REGION, e.g. India (Mumbai) / United States]. Clinics choose their hosting region at sign-up where more than one is offered. Where personal information crosses borders we rely on contractual safeguards recognised by the applicable law.
12. Your rights
Depending on where you live you may have the right to:
- access the personal information we hold about you;
- correct inaccurate information;
- delete your information, subject to our legal retention duties;
- withdraw consent where processing is based on consent;
- object to or restrict certain processing;
- receive a copy of your information in a portable format;
- nominate a person to exercise these rights on your behalf (India);
- complain to a supervisory authority, including the Data Protection Board of India.
To exercise a right, email [privacy@intelligencehut.com]. We will verify your identity and respond within the time the law allows, normally 30 days. If your request concerns patient records, we will refer it to your clinic and assist them.
13. Children
Synvian accounts are for healthcare professionals and clinic staff and are not offered to anyone under 18. Clinics may record the health information of minors as patients. That information is Customer Data under the clinic’s responsibility.
14. Changes to this policy
We will post any change on this page and update the date at the top. If a change materially reduces your rights we will notify account holders by email at least 30 days before it takes effect.
15. Contact
- Email: [privacy@intelligencehut.com]
- Post: Intelligence Hut Private Limited, EN-35, 5th Floor, Walzen Building, Sector V, Salt Lake, Kolkata 700091, India
- Grievance Officer: [NAME, EMAIL]