Privacy policy

Last updated: 10 October 2026

Nivaya Care makes Anvaya, software that helps clinics keep patients’ lab reports and see how results change over time. This policy explains what personal data we handle, why, where it is kept and the choices you have. We have written it to be read, not skimmed past.

1. Who decides what happens to the data

Patient data in Anvaya belongs to the clinic. Under India’s Digital Personal Data Protection Act, 2023, the clinic is the Data Fiduciary for its patients’ data: it decides why and how that data is used. Nivaya Care acts as the clinic’s Data Processor and handles patient data only to run Anvaya for that clinic, on its instructions.

For everything else we are the Data Fiduciary: accounts of clinic staff, emails people send us, and visits to this website.

If you are a patient and want to see, correct or delete your data, please contact your clinic first. We will help the clinic respond.

2. What we collect

Patient data, processed for clinics

• Details the clinic enters: name, age, sex, phone number and the clinic’s patient number.
• Lab reports added by the clinic (photos and PDFs), and the test results read from them.
• If the clinic uses WhatsApp intake: the sender’s phone number, the files and messages sent to the clinic’s number, and the patient’s consent to receive reports this way.

Clinic staff accounts

• Name, email address, role and clinic.
• Sign-in data: passkeys, or the email address Google confirms if you use Google sign-in. We do not keep your Google password or access to your Google account.
• A record of important actions (for example, who confirmed or changed a value), kept so clinics can trust their records.

Website visitors and enquiries

• This website has no forms and no advertising trackers. If you email us, we keep your message and contact details to reply.
• Basic technical data our hosting provider records to keep the site running and secure, such as IP address and browser type.

3. How we use it

• To run Anvaya for clinics: store reports, read the values on them, and show doctors how results change.
• To keep accounts secure, prevent misuse and investigate problems.
• To support clinics when they ask for help. Any support access by our team is logged.
• To reply to enquiries and demo requests.
• To meet legal obligations.

We do not sell personal data, use it for advertising, or use patient data to train AI models. With a clinic’s written permission we may use de-identified report samples, with names and contact details removed, to test and improve how accurately reports are read.

4. How AI is used

Anvaya first reads the text that labs print into their PDFs. For photos and unusual layouts, and only if the clinic has turned this on, the page image and its text are sent to our AI provider (Anthropic, directly or through Amazon Web Services) to read the values. No other patient details are sent. Our providers are not allowed to use this data to train their models, and we request that they do not retain it.

Anvaya describes results; it does not diagnose. Every value links to the original page so a doctor can check it, and values the system is unsure of are marked for review.

5. Where data is stored

Patient data and clinic accounts are stored on Amazon Web Services in Mumbai, with encrypted backups in Hyderabad. Some services we rely on may process limited data outside India:

• AI reading, when the clinic has turned it on (section 4).
• Error monitoring, which is set up to remove patient data before anything is sent.
• WhatsApp messages, which are carried by Meta.

We only use such services where Indian law allows it.

6. Who we share it with

We share data only with the service providers below, only for the purpose listed, and under contracts that require them to protect it:

We may also disclose data when the law requires it, or to a buyer of our business, who would have to keep this policy’s promises.

7. How we protect it

• Data is encrypted in transit and at rest.
• Each clinic’s records are kept separate at the database level, so one clinic cannot see another’s patients.
• Receptionists can file reports but cannot see clinical values; only doctors can.
• Staff join only by an invite from their clinic admin, and the admin can remove access at any time.
• Report files are private and opened only through short-lived links.

If a breach affects personal data, we will tell the affected clinics without delay, and the Data Protection Board and other authorities as the law requires.

8. How long we keep it

• Patient data: for as long as the clinic uses Anvaya. Reports a clinic deletes are permanently erased after 30 days.
• Backups: encrypted backups are kept for up to 12 months, so deleted data can remain in them until they expire.
• When a clinic stops using Anvaya: we give the clinic a copy of its data on request, then delete it within 90 days unless the law requires us to keep it.
• Enquiries: as long as needed to reply and follow up.

9. Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask to access a summary of your data, correct or complete it, have it erased, withdraw consent you gave, nominate someone to act for you, and raise a grievance.

Patients should contact their clinic, which controls their data; we will support the clinic. Clinic staff and anyone else can contact us directly (section 12). We reply within the time the law sets.

Children’s reports may be added by clinics, which are responsible for consent from a parent or guardian. This website is not meant for children.

10. Cookies and analytics

This website uses no advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which does not use cookies or follow you across sites. If you choose Hindi, your browser remembers that choice on your device.

The Anvaya app uses one essential cookie to keep you signed in.

11. Changes to this policy

We will update this page when our practices change and change the date at the top. For significant changes we will tell clinics before they take effect.

12. Grievance officer and contact

For questions, requests or complaints about personal data, write to our Grievance Officer:

Shivam Sharma, Grievance Officer, Nivaya Care
hello@nivayacare.com

If you are not satisfied with our response, you can complain to the Data Protection Board of India.