Privacy policy

We handle personal data in two distinct capacities, and the distinction matters for your rights.

For our own customers and website visitors, we are the data fiduciary. We decide what to collect and why, and we are accountable for it.

For patient data entered into the software by a laboratory, the laboratory is the data fiduciary and we are the data processor. We hold and process that data strictly on the laboratory's instructions. If you are a patient wanting access to your records, your first point of contact is the laboratory that tested you, not us.

From website visitors, we collect only what is necessary to operate the site and respond to enquiries.

Enquiry details are used to respond to your enquiry and, if you become a customer, to provide the service. Billing details are used to raise invoices and meet our tax obligations. Technical data is used to operate and secure the site.

We do not sell personal data. We do not share it with advertisers. We do not use patient data held on behalf of laboratories for any purpose other than providing the service to that laboratory.

We share personal data only where it is necessary to run the service, and only with providers bound by confidentiality obligations at least as strict as ours.

Data for Indian customers is stored on servers located in India, with backups replicated to a second Indian region. For customers outside India, we host in the region nearest them.

Data is encrypted in transit using TLS and encrypted at rest. Each laboratory's data is logically isolated from every other laboratory's.

By default, nobody. Our support staff can access a laboratory's data only when that laboratory grants temporary access for a specific issue. Every such access is logged and visible to the laboratory.

We do not browse customer records. We do not use patient data for product development, analytics, training models, or any purpose beyond running the service for the laboratory that owns it.

Enquiry data is kept for two years from your last contact with us, unless you ask us to delete it sooner.

Customer account and billing records are kept for eight years, as required by Indian tax law.

Patient data entered by a laboratory is kept for as long as that laboratory remains a customer. If a laboratory leaves, we provide a full export and delete our copy on written confirmation, other than any records we are legally required to retain.

Under the Digital Personal Data Protection Act, 2023, you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data erased where we have no lawful basis to keep it, to withdraw consent, and to nominate someone to exercise these rights on your behalf.

To exercise any of these, write to us at hello@diagnosuya.com. We will respond within thirty days. If you are a patient, please contact the laboratory that tested you first, since they hold the relationship with you and instruct us.

This website uses only the cookies necessary to make it work — remembering your theme preference and keeping forms secure. We do not use advertising cookies or third-party tracking on this site.

If we suffer a personal data breach, we will notify the Data Protection Board of India and every affected customer without undue delay, with an account of what happened, what data was involved, and what we are doing about it.

Questions about this policy, or about how we handle your data, should go to hello@diagnosuya.com, or by post to Diagnosuya Health Technologies Pvt. Ltd., 4th Floor, Prestige Tech Square, Kadubeesanahalli, Bengaluru 560103, India.