Last updated
Nirogix is a product of Takoriya Technology LLP.
This document is under review by legal counsel and may be revised before it is final. Where a hospital or clinic has signed an agreement or order form with us, that agreement prevails over this page if the two differ. This page is not legal advice.
In short
- Hospitals and clinics that use Nirogix own their patients’ records and decide how they are used. We hold and process that data on their instructions, as their technology provider.
- Patient and health data is stored in India. We never sell it, never use it for advertising, and never send it to an analytics or advertising vendor.
- If you are a patient, requests about your health records go to the hospital or clinic that treated you. We help them respond.
- For our own records (website enquiries, customer contacts, account security), Takoriya Technology LLP is responsible, and you can contact our Grievance Officer directly.
Contents
- 1.Introduction and scope
- 2.Definitions
- 3.Who is responsible for your data
- 4.Information we collect
- 5.How information is collected
- 6.Purposes of processing
- 7.How information is used, and what we never do
- 8.Data access and permissions
- 9.Data sharing and disclosure
- 10.Third-party service providers
- 11.Cookies and similar technologies
- 12.Data security
- 13.Data storage and location
- 14.Data retention
- 15.Data deletion and account deletion
- 16.Your rights
- 17.Patient privacy considerations
- 18.Children’s data
- 19.Marketing and communications
- 20.Security incidents and personal data breaches
- 21.International data transfers
- 22.Indian privacy and data protection requirements
- 23.Grievance redressal
- 24.Privacy contact information
- 25.Changes to this policy
1. Introduction and scope
Nirogix is a hospital management system (HMS, also called a hospital management information system or HMIS) offered as a cloud service by Takoriya Technology LLP, a limited liability partnership registered in India with its office in Mehsana, Gujarat, India ("Nirogix", "we", "us" or "our"). Hospitals, clinics, diagnostic centers and other healthcare organizations subscribe to Nirogix to run their registration, appointments, outpatient and inpatient care, clinical records, pharmacy, laboratory, billing and related work.
This Privacy Policy explains what personal data is handled through Nirogix, why, how it is protected, how long it is kept, and the choices and rights available to you. It applies to:
- our public website at nirogix.com and the pages hosted on it;
- the Nirogix Portal used by hospital and clinic staff, the patient portal, the AI Portal, our platform administration console and the application programming interface (API) behind them, together the "Platform";
- pages a hospital publishes through the Platform for its own patients, such as self-registration, appointment requests, self check-in, check-in kiosks and payment links; and
- our dealings with prospective and existing customers, including demos, pilots, onboarding, support and billing.
It does not cover websites or services run by others that link to or from Nirogix, or a hospital’s own handling of records outside the Platform. Each hospital and clinic is responsible for its own privacy notice to its patients.
2. Definitions
In this policy:
- Customer
- A hospital, clinic, diagnostic center, group or other organization that has an agreement with us to use the Platform, including all of its branches.
- Authorized User
- A person a Customer allows to use the Platform under its account, such as an administrator, doctor, nurse, receptionist, pharmacist, laboratory technician or accountant.
- Patient
- A person whose records a Customer keeps on the Platform, including a person who registers, books or pays through a Customer’s public pages, and, for a minor or a person who cannot act for themselves, the parent, guardian or representative acting for them.
- Personal data
- Any data about an individual who is identifiable by or in relation to that data, as defined in the Digital Personal Data Protection Act, 2023.
- Health data
- Personal data about a person’s physical or mental health, medical history, examination, diagnosis, treatment, prescriptions, test results, images and reports, and the related billing records. Under the Information Technology Rules, 2011 this is sensitive personal data or information.
- Customer Data
- All data a Customer or its Authorized Users enter into, upload to or create in the Platform, including Patient records.
- Data Fiduciary
- The person who decides the purpose and means of processing personal data.
- Data Processor
- A person who processes personal data on behalf of a Data Fiduciary.
- Data Principal
- The individual the personal data relates to; for a child or a person with a disability, includes the parent or lawful guardian.
- DPDP Act
- The Digital Personal Data Protection Act, 2023 and the rules made under it, as they come into force.
3. Who is responsible for your data
Responsibility depends on whose records they are, and this decides where you should send a request.
3.1 Customer Data, including Patient records
Each Customer is the Data Fiduciary for the Customer Data it keeps on the Platform. It decides what is recorded about its Patients and staff, who in its organization may see it, and how long it is kept. We act as its Data Processor: we store and process that data only on the Customer’s documented instructions, under our agreement with it and our Data Processing Agreement, and for no purpose of our own.
3.2 Data we decide about
Takoriya Technology LLP is the Data Fiduciary for personal data we collect for our own purposes: website visitors and the people who contact us or request a demo, the business contacts and billing details of our Customers, the account, sign-in and security records we need to run and protect the Platform, and our support correspondence.
4. Information we collect
We collect only what is needed for the purposes in section 6. The categories below describe what the Platform can hold; what a particular Customer records depends on the modules it uses and how it configures its forms.
4.1 Website visitors and enquiries
When you fill in a demo, quote or contact form, we collect what you enter: typically your name, work email, phone number, organization, role, facility type and size, city and your message. The website does not ask for health information, and you should not include any.
To keep automated spam out of these forms, each one runs a spam check from Cloudflare that most people never see. It is described under Third-party service providers.
4.2 Account information
For each Authorized User: name, work email and mobile number, the organization and branches they belong to, their role and permissions, a password stored only as a one-way hash, two-step sign-in settings where enabled, preferences such as theme and layout, and records of sign-ins, sign-outs, failed attempts and account lockouts.
4.3 Organization information
For each Customer: its registered and trading names, address, contact details, registration numbers and GSTIN, the modules and capabilities it subscribes to, its branding (colors, logo, letterheads), billing contacts, order forms, invoices and payment records.
4.4 Hospital and clinic information
The way a facility is set up: branches, departments, floors, wards, rooms and beds, services and prices, the drug and test catalogs, suppliers, fee schedules, workflow settings, and where enabled, facility registry identifiers under the Ayushman Bharat Digital Mission (ABDM).
4.5 Doctor and staff information
For clinicians and staff whom a Customer records as providers: name, qualifications, specialty, medical council registration number, Health Professional Registry ID where used, schedules and availability, consultation fees, an uploaded signature image used to sign documents, and the record of what each person did in the Platform.
4.6 Patient information
Identity and contact details a Customer records about its Patients: name, unique hospital identifier (UHID), date of birth or age, sex, phone number, email, address, emergency contact, guardian details for a minor, identity document references where the Customer chooses to record them, ABHA number and address where the Patient provides them, insurance and payer details, and appointment, visit and admission history.
4.7 Health and medical information
The clinical record a Customer keeps: complaints, history, allergies, vital signs, examinations, diagnoses, consultation notes, prescriptions and medication administration, laboratory orders, samples and results, imaging orders and reports, procedures and operation records, nursing notes, discharge summaries, certificates and letters, uploaded documents, immunizations, blood bank records, and the bills and payments linked to that care. This is the most sensitive data on the Platform and is treated accordingly throughout this policy.
4.8 Payment information
For Patient payments, where a Customer enables online payment it connects its own merchant account with a payment gateway. We receive the payment status, amount, reference number and method type from the gateway; card numbers, UPI PINs and bank credentials are entered on the gateway’s pages and never reach our systems. For payments a Customer makes to us, we keep the invoice, the amount, the date, the payment reference and the remitting bank details shown on the transfer.
4.9 Technical and usage information
Records generated when the Platform is used: IP address, browser and device type, the time and outcome of requests, error reports, and an audit trail of who viewed or changed which record and when. We use this to operate, secure and support the Platform, not to profile anyone.
5. How information is collected
- Directly from you, when you fill in a form on our website, sign in, update your profile or contact our support team.
- From the Customer, when its Authorized Users register Patients, record care, upload documents, configure the facility or import existing records during onboarding.
- From Patients themselves, through a Customer’s self-registration, appointment request, check-in or payment pages, or the patient portal.
- Automatically, through the server logs, sessions and audit trail the Platform needs to operate securely.
- From connected services a Customer enables, such as a payment gateway reporting the outcome of a payment, or ABDM services returning a verified ABHA profile with the Patient’s consent.
6. Purposes of processing
We process personal data only for a specific purpose and on a lawful ground under the DPDP Act: the consent of the Data Principal, or a legitimate use the Act permits, such as a purpose for which a person has voluntarily provided their data, compliance with law, or responding to a medical emergency.
6.1 As the Customer’s Data Processor
We process Customer Data to provide the Platform to the Customer as its agreement describes: to store, display, calculate, print and transmit records as its Authorized Users direct; to send the messages it configures; to support it when it asks; and to keep its data secure, backed up and recoverable. Obtaining any consent its Patients must give, and giving them notice, is the Customer’s responsibility as Data Fiduciary.
6.2 As Data Fiduciary
- to answer enquiries, arrange demos and pilots, prepare quotes, and enter into and manage our agreements with Customers;
- to create and secure accounts, authenticate users, detect and prevent fraud, abuse and security incidents, and keep the audit trail;
- to invoice, collect payment, keep accounts and meet tax obligations;
- to provide support, investigate faults and improve the reliability of the Platform; and
- to comply with law, respond to lawful requests from authorities, and establish, exercise or defend legal claims.
7. How information is used, and what we never do
Within those purposes, information is used to run the work the Platform is built for: registering a Patient and issuing a UHID, booking and calling appointments, recording a consultation and printing a prescription, ordering and reporting tests, dispensing medicines, admitting and discharging, raising bills and receipts, sending one-time codes and appointment messages, and producing the reports a Customer runs on its own data.
We do not:
- sell, rent or trade personal data or health data;
- use Customer Data for advertising, marketing to Patients, or profiling;
- send Patient, staff or hospital-identifying data to an analytics or advertising vendor;
- use one Customer’s data for another Customer, or combine Customers’ data;
- use Patient health data to train artificial intelligence models; or
- contact a Customer’s Patients for any purpose of our own.
If we ever produce statistics about how the Platform is used, they will be aggregated so that no Patient, Authorized User or Customer can be identified, and Patient health data will not be used for them.
8. Data access and permissions
8.1 Organization, hospital and clinic-level access
Each Customer’s data is kept in its own isolated tenant. Isolation is enforced by the database itself through row-level security, so one Customer can never read another’s records, whatever happens in the application above it.
Within a Customer, access is decided by the Customer’s administrators through roles and permissions: which modules a role may open, and whether it may view, create, edit, cancel or print. Individual permissions can be granted or explicitly denied per user, including for a limited period, and an explicit denial always overrides a grant. Records can be limited to a branch. Every protected action is checked again on our servers, so hiding a button is never the only control.
8.2 Patients
A Patient who signs in to the patient portal with a one-time code sees only the records that the hospitals they are registered with have linked to them, and only those hospitals. The portal is read-only for clinical records.
8.3 Our own staff
Our engineers and support staff do not browse Customer Data. Where a Customer asks for help that needs access to its account, an authorized member of our team uses a time-limited support session that is recorded in the Customer’s audit trail. Access to production systems is limited to the people who need it to run the Platform, and personal data is not used in development or test environments.
8.4 Audit trail
The Platform keeps an append-only audit trail of sign-ins, access to and changes of records, permission changes and support sessions, which cannot be edited or deleted through the Platform. It lets a Customer see who did what and when, and is retained as described in section 14.
10. Third-party service providers
We use a small number of providers (sub-processors) to run the Platform. The current list, with what each one handles, is published on our Security page, and Customers are told before it changes.
10.1 Cloud infrastructure and hosting
The application and its database run with an India-resident cloud hosting provider, in India. Uploaded files and documents are kept in private object storage, reached only through short-lived signed links, with the storage location set to India. Our website and the Platform are delivered through a content delivery and security network that terminates encrypted connections and filters attacks before traffic reaches our servers.
10.2 Messaging
Text messages and email (one-time codes, appointment confirmations and reminders, password resets and other transactional messages) are sent through MSG91, an Indian provider. It receives the recipient’s phone number or email address and the message itself, never a clinical record. We send only the messages the workflow requires.
10.3 Spam protection on our website
The enquiry forms on our website use Cloudflare Turnstile to tell a person from an automated script. It receives technical signals from your browser, such as your IP address and browser details, but not what you type into the form. Cloudflare states that it uses these signals only to detect and block bots and to improve that detection, and not to identify, profile or target anyone. It is not used in the Platform.
10.4 Payment providers
Where a Customer accepts online payment from its Patients, it connects its own merchant account with a payment gateway it chooses from those the Platform supports. The payment is made to the Customer, not to us, and is governed by the gateway’s own terms and privacy policy. Payment credentials are entered on the gateway’s pages and are never stored on the Platform; the Customer’s gateway keys are stored encrypted.
10.5 Analytics and monitoring
The Platform does not use third-party analytics or advertising tools, and it never will while it holds health records. To keep it running, we monitor server health and capture error reports that describe the fault, which may be processed by an error-monitoring service; we configure these reports to carry technical details rather than the contents of records.
This website, and only this website, uses Google Analytics, and only if you agree to it in the cookie bar. It tells us which pages are read and which campaign brought a visitor here. We never send it your name, your email address, your phone number or anything you type into a form, and the address of a private payment page is replaced before it is sent. You can change or withdraw your choice at any time through the Cookie settings link in the footer of any page, and refusing changes nothing about how the site works. The Portal, the patient portal, the platform administration console and the AI Portal run no analytics at all.
When you send us an enquiry we also record how you told us you heard about Nirogix, the page you landed on and the campaign details carried in the link you followed, so that we know which of our work reaches hospitals. That record is kept with your enquiry and is never used for advertising. If you refuse analytics, nothing about your visit is stored in your browser between visits.
10.6 Optional AI features
Some deployments offer optional AI assistance, such as drafting a prescription from the consultation for the doctor to review. When a doctor uses it, only the clinical minimum needed (the complaint, diagnoses, a vital signs summary, age and sex) is sent to an AI model provider, never the Patient’s name, UHID or contact details, and the provider may process it outside India. Nothing is saved to the record until the doctor reviews and saves it. Customers decide which roles may use AI features. Browser dictation, where used, relies on the speech recognition built into the user’s web browser, which in some browsers sends audio to the browser maker.
10.7 ABDM
Our ABDM integration (ABHA creation and verification, linking records and consent-based health information exchange) is built, with ABHA verification and health information exchange tested end to end in the National Health Authority sandbox, and is not yet live in production; see our Compliance page. When it is live and a Customer uses it, data is exchanged with ABDM systems only as the ABDM framework and the Patient’s consent allow.
12. Data security
We protect personal data with technical and organizational measures appropriate to health data, including:
- tenant isolation enforced by the database through row-level security;
- role-based access control with per-user grants and denials, checked on the server for every request;
- encryption of every connection with TLS 1.2 or later, and AES-256 encryption of stored credentials such as ABDM tokens, payment gateway keys and two-step sign-in secrets;
- passwords stored only as salted one-way hashes, a single password policy, account lockout after repeated failed sign-ins, optional two-step sign-in, and automatic sign-out after fifteen minutes of inactivity;
- an append-only audit trail of access and changes;
- validation and rate limiting of every request at the server;
- separate development, staging and production environments, with no personal data outside production;
- least-privilege access for our own staff, and time-limited, audited support access; and
- automated backups of production data.
No system is perfectly secure, and we do not claim certifications we have not been audited for. What is enforced today is described, with any deployment commitments marked as such, on our Security page. Customers are responsible for the security of their own devices, networks and user credentials, and for removing access promptly when a staff member leaves.
13. Data storage and location
Customer Data, including all Patient and health data, is stored in India, in the database and object storage described in section 10. Development, staging and production each have their own database and storage; nothing is shared between them. The limited processing that may occur outside India is described in section 21.
14. Data retention
14.1 Customer Data
We keep Customer Data for as long as the Customer’s subscription is active, because the Customer needs its records. Healthcare records are subject to minimum retention periods under Indian law and the rules of the Customer’s state and regulators (for example, the medical council regulations requiring inpatient records to be kept for three years from the start of treatment, and the longer periods that apply to medico-legal and certain diagnostic records under other laws). Deciding and meeting those periods is the Customer’s responsibility as Data Fiduciary; the Platform does not delete clinical records on its own.
When a subscription ends, the Customer has 30 days to export its data, after which we delete it from the live systems within a further 60 days, unless the Customer asks us in writing to keep it longer under a continuing agreement or the law requires us to retain it. Copies in backups are overwritten in the normal backup cycle and are not restored except to recover from an incident.
14.2 Records we keep as Data Fiduciary
- Enquiries and demo requests that do not lead to an agreement: up to two years from our last contact, unless you ask us to delete them sooner.
- Contracts, invoices and payment records: eight years from the end of the financial year they relate to, as Indian tax and accounting law requires.
- Security, sign-in and system logs: at least 180 days, as the CERT-In directions require, and longer where needed to investigate an incident.
- The audit trail: 180 days, the period the CERT-In directions require, after which entries are deleted automatically. Entries cannot be edited or deleted sooner by anyone.
15. Data deletion and account deletion
15.1 Records within a Customer’s account
Clinical and administrative records are corrected rather than overwritten, and are cancelled or deactivated rather than erased, so that the history of a patient’s care stays complete and auditable. A request to erase a Patient’s data is decided by the Customer, taking into account its legal duty to retain medical records; we carry out the Customer’s documented instruction.
15.2 Authorized User accounts
A Customer’s administrator deactivates a user’s account when they leave; the user can no longer sign in. Their name stays on the records they created and in the audit trail, because those records must show who made them.
15.3 A Customer’s whole account
When a Customer ends its subscription, its data is deleted as described in section 14, once it has had the opportunity to export it. We do not charge to export data at the end of a subscription. Some records are kept for longer only where the law requires: our invoices and contracts, and the logs we must retain.
15.4 Your own enquiry data
If you contacted us or requested a demo and want that information deleted, write to us by email to jaivik@thefortunetech.com and we will delete it unless we must keep it for a legal reason.
16. Your rights
Subject to the DPDP Act and other applicable law, as a Data Principal you have the right to:
- obtain a summary of the personal data being processed about you and the processing activities;
- have inaccurate or misleading data corrected, incomplete data completed, and outdated data updated;
- have your data erased once it is no longer needed for the purpose it was collected for, unless the law requires it to be kept;
- withdraw consent you have given, as easily as you gave it, without affecting processing that took place before;
- have your grievances addressed; and
- nominate another person to exercise your rights in the event of your death or incapacity.
16.1 Where to send a request
For Patient records, send your request to the hospital or clinic that holds them. It is the Data Fiduciary and is best placed to verify your identity and decide. If you write to us about a Patient record, we will pass your request to the Customer concerned and tell you we have done so; we will help the Customer respond.
For data we hold as Data Fiduciary, write to us by email to jaivik@thefortunetech.com. We may ask you to verify your identity before acting. We acknowledge requests within two working days and respond within one month, or sooner where the law requires.
Withdrawing consent or asking for erasure may mean we, or a Customer, can no longer provide a service that depends on that data. Medical records that the law requires a Customer to keep cannot be erased on request until that period ends.
17. Patient privacy considerations
If you are a Patient of a hospital or clinic that uses Nirogix:
- Your records belong to the care relationship between you and that hospital. The hospital decides who in its organization can see them; we do not use them for anything except providing the Platform to the hospital.
- The hospital should give you its own privacy notice and obtain any consent it needs. Questions about why something was recorded, who saw it, or correcting it, should go to the hospital first.
- The patient portal shows you records the hospital has linked to your phone number or email. There is no self-signup; the hospital creates that link. Our sign-in screen answers the same way whether or not a number is registered, so it cannot be used to discover who is a patient.
- Messages you receive from the hospital through Nirogix, such as a one-time code or an appointment reminder, are sent on the hospital’s behalf and contain no clinical details.
- Recording a consultation for transcription, where a hospital makes that feature available, requires your consent to be recorded first.
- Your ABHA number and ABDM-linked records are shared through ABDM only with your consent, which you manage in your ABHA app.
18. Children’s data
Our website and the Platform are not directed at children, and we do not knowingly collect personal data from children for our own purposes.
Hospitals and clinics do keep records of children who are their Patients, including through pediatric features such as growth and immunization records. In that case the Customer, as Data Fiduciary, is responsible for obtaining the consent of the parent or lawful guardian where the law requires it, subject to the exemptions the DPDP Act and its rules provide for healthcare. The Platform records guardian details alongside a minor’s record. It does not track children’s behavior, monitor them, or direct advertising at them, and nothing in the Platform is used for those purposes.
19. Marketing and communications
We send transactional messages that the service requires, such as sign-in codes, password resets, security alerts, invoices and notices about changes to the Platform or these documents. These are part of providing the service and cannot be switched off while you have an account.
We may send product news and event invitations to business contacts at our Customers and to people who have asked to hear from us. Every such email lets you unsubscribe, and you can also ask us by email to jaivik@thefortunetech.com. We never send marketing to a Customer’s Patients, and we never use Patient contact details for our own communications.
20. Security incidents and personal data breaches
We maintain a process to detect, contain, investigate and recover from security incidents.
- Where a breach affects Customer Data, we notify the affected Customer without undue delay after becoming aware of it, with what we know, the steps we are taking, and what we recommend, and we support the Customer in meeting its own obligations to notify Patients and the Data Protection Board of India.
- Where a breach affects personal data for which we are the Data Fiduciary, we notify the affected individuals and the Data Protection Board of India in the manner and within the time the DPDP Act and its rules require.
- We report cyber security incidents to CERT-In within the time its directions require, currently six hours of noticing a reportable incident.
If you believe your account or data has been compromised, contact us immediately by email to jaivik@thefortunetech.com, and tell your hospital’s administrator.
21. International data transfers
Patient and health data is stored in India and we do not transfer Customer Data abroad for storage. A limited amount of processing may take place outside India:
- the content delivery and security network that carries traffic to our website and the Platform may route requests, including IP addresses, through locations outside India;
- optional AI features send the de-identified clinical minimum described in section 10 to an AI model provider that may process it outside India;
- browser dictation is handled by the user’s browser maker; and
- email you send or receive is handled by your own and the recipient’s email providers, wherever they operate.
Any transfer outside India is made in accordance with the DPDP Act, which permits transfers except to countries the Government of India restricts by notification, and under contractual safeguards with the provider.
22. Indian privacy and data protection requirements
Nirogix is designed to support compliance with the laws that apply to health data in India, including:
- the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as their provisions come into force;
- the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent they continue to apply;
- the directions of the Indian Computer Emergency Response Team (CERT-In) on reporting incidents and maintaining logs;
- the Telemedicine Practice Guidelines, 2020, where a Customer provides consultations remotely;
- the Ayushman Bharat Digital Mission’s Health Data Management Policy, where ABDM features are used; and
- the rules on medical records, clinical establishments and professional conduct that apply to each Customer.
Designing for these requirements is not a certification. We do not hold, and do not claim, any data protection certification; our Compliance page states what we have and have not been assessed for. Each Customer remains responsible for its own compliance as a healthcare provider and Data Fiduciary.
23. Grievance redressal
If you have a concern or complaint about how your personal data is handled through Nirogix, write to the Grievance Officer, Takoriya Technology LLP, by email to jaivik@thefortunetech.com. Please include your name, how we can reach you, the organization or hospital concerned, and a description of the issue.
We acknowledge every grievance within two working days and resolve it within one month of receiving it. If your grievance concerns Patient records held by a hospital, we will forward it to that hospital, tell you we have done so, and support its response.
If you are not satisfied with the outcome, you may approach the Data Protection Board of India once it is able to receive complaints under the DPDP Act, after exhausting the grievance redressal described here.
24. Privacy contact information
Takoriya Technology LLP, Mehsana, Gujarat, India. For any privacy question or request, contact us by email to jaivik@thefortunetech.com. Hospital and clinic customers may also raise privacy questions through their account contact or our support channels described on the Support page.
25. Changes to this policy
We may update this policy as the Platform, our providers or the law change. The date at the top shows when it was last updated. If we make a material change, such as a new category of data, a new purpose or a new kind of sub-processor, we will notify Customers by email or within the Platform before it takes effect and, where your consent is required, ask for it again. Earlier versions are available on request.