Privacy policy

Who we are

SuperDoc is hospital management and electronic health record software provided by SuperDoc, India ("SuperDoc", "we"). You can reach us at hello@superdoc.asia.

This policy covers the SuperDoc application at app.superdoc.asia and this website. It is written with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules in mind.

Our role and the hospital's

Two different relationships are involved, and they matter for who you should ask.

• Patient records belong to the hospital. A hospital or clinic that uses SuperDoc decides what is recorded about its patients and why. The hospital is the data fiduciary for those records. We process them only on the hospital's instructions, as its data processor.
• Account and contact details are ours to look after. For the login details of hospital staff, the details a hospital gives us when it registers, and messages sent to us, we are the data fiduciary.

What we hold

Recorded by a hospital about its patients

• Identity and contact details: name, date of birth, sex, phone number, address, and identifiers such as an ABHA number where the patient provides one.
• Clinical records: case sheets, vitals, diagnoses, prescriptions, investigation orders and results, surgical and admission records, uploaded documents and images.
• Billing records: bills, payments, refunds and insurance claim details.

About hospital staff

• Name, work email address, phone number, role and the branches they work at.
• Sign-in information: a password, which is stored only in a protected form that cannot be read back.
• A record of actions taken in the product, such as who created, changed or opened a record and when. This audit trail is part of the service a hospital relies on.

About the hospital

• The hospital's name, address, registration details and the contact details of the person who registered it.
• Subscription and payment records for the SuperDoc service itself.

Technical information

• IP address, browser type and the time of requests, kept in server logs for security and troubleshooting.

How we use it

• To provide the service to the hospital: storing records, producing bills and reports, and showing each member of staff what their role allows.
• To keep accounts secure: verifying email addresses, resetting passwords, detecting misuse and recording access.
• To support the hospital when it asks for help. Actions our support staff take on a hospital's account are recorded.
• To meet legal obligations.

We do not sell personal data. We do not use patient records for advertising.

Automated assistance

SuperDoc includes optional features that help staff write records faster, such as turning speech into text. Where a hospital switches these on:

• a consultation is recorded only after the patient's consent has been noted;
• the audio and text involved are processed by specialist service providers under contract, solely to return the result to the member of staff;
• nothing these features produce becomes part of a record until a member of staff has reviewed and saved it.

We do not use patient records to build or train such tools of our own.

Where it is kept

Records and uploaded documents are held in data centres in India. Where a service provider processes limited data outside India, it does so under contract and with safeguards appropriate to the data.

Who we share it with

We use a small number of carefully chosen service providers to run SuperDoc. Each is bound by contract to protect the data and receives only what it needs to do its job. They fall into these groups:

• cloud hosting and data storage;
• email and message delivery;
• payment processing, where a hospital takes online payments;
• content delivery and network security;
• speech-to-text and automated text processing, only where a hospital switches such features on.

A hospital that uses SuperDoc may ask us for the current list of providers that handle its data.

We also disclose information where the law requires it, for example under a valid order of a court or authority. Where we are permitted to, we tell the hospital first.

How we protect it

• Each hospital's data is kept separate from every other hospital's.
• Access inside a hospital is controlled by role, and can be adjusted for an individual member of staff.
• Data is encrypted in transit and at rest.
• Documents are held in private storage and can be opened only by signed-in staff of that hospital.
• Emergency access to a patient record requires a stated reason and is logged.

No system is perfectly secure. If we learn of a breach affecting personal data, we will inform the affected hospital and the authorities as the law requires.

How long we keep it

Patient records are kept for as long as the hospital keeps its account, because hospitals are required to retain medical records. When a member of staff deletes something in the product, it is marked as deleted and retained for audit, not erased.

When a hospital ends its use of SuperDoc, we return its data on request and then delete or anonymise it within a period agreed with the hospital, unless the law requires us to keep it longer.

Your rights

Subject to the law, you may ask to see the personal data held about you, to have it corrected or updated, to have it erased where it is no longer needed, to withdraw a consent you gave, and to nominate another person to act for you.

• Patients: please ask the hospital that treated you.
• Hospital staff and anyone who has contacted us: write to hello@superdoc.asia. We will respond within 30 days.

If you are not satisfied with our response you may complain to the Data Protection Board of India.

This website

This website sets no advertising or tracking cookies and runs no analytics scripts. Like any website, it is delivered through a network that briefly logs the IP address of each request for security. The SuperDoc application uses browser storage that is strictly necessary to keep you signed in.

SuperDoc is intended for healthcare providers and their staff, and is not directed at children. Records of patients who are minors are created by hospitals, which are responsible for obtaining a parent's or guardian's consent where it is needed.

Grievance officer

Questions and complaints about personal data may be sent to our grievance officer:

Changes

If we change this policy in a way that matters, we will tell registered hospitals before the change takes effect and update the date at the top of this page.