Privacy Policy

1. Who We Are & What This Covers

Rashuv Technologies is a technology company incorporated and operating in India. We build and operate software products across healthcare, business operations, and education. This Privacy Policy applies to all Rashuv Technologies properties and products:

2. What Data We Collect and Why

Data	Source	Product(s)	Purpose
Name, email, phone, organization name	Submitted by visitor via inquiry form	rashuv.com	To respond to business inquiries, partnership requests, and demo requests
Patient name, age, sex, mobile number	Entered by patient or receptionist at booking	RashuvMed / RMedQ	OPD queue token generation, queue position display, and SMS queue alerts
Clinic name, doctor details, operating hours, fee structure	Entered by clinic operator during onboarding	RashuvMed / RMedQ	Powers the queue engine, patient-facing clinic listing, and reception console
Employee name, mobile number, attendance records, leave records	Entered by employer/HR during RashuvBiz onboarding	RashuvBiz	Workforce attendance tracking, leave management, and salary computation
IP address, browser metadata, device type	Automatically collected from all users	All products	Security validation (Firebase App Check), rate limiting, abuse prevention. Not retained as user-level profile records.

3. Browser Storage & Cookies

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics scripts (no Google Analytics, no Facebook Pixel, no behavioral trackers) on any Rashuv Technologies property.

Our web applications use browser localStorage to store session state locally on your device. This includes things like your theme preference (light/dark), language selection, and authenticated session tokens. This data lives on your device and is cleared when you clear your browser's site data. For a full list of localStorage keys used by RMedQ specifically, see the RashuvMed Privacy Policy.

Firebase Authentication (Google) may set functional session cookies necessary for login security. These are not used for advertising or cross-site tracking.

4. Third-Party Service Processors

We use a small number of carefully selected third-party services to operate our products. They act as data processors on our behalf and receive only the data needed for their specific function:

Processor	Purpose	Products	Privacy Policy
Google Firebase / Google Cloud Platform	Database, hosting, authentication, cloud functions. Data hosted in India (Mumbai — asia-south1).	All products	policies.google.com/privacy
Resend (resend.com)	Transactional email delivery — booking confirmations, OTP emails where applicable	RashuvMed / RMedQ	resend.com/privacy
Cloudflare	DNS, DDoS protection, and network edge security for rashuv.com and rmedq.rashuv.com	All products	cloudflare.com/privacypolicy
SMS Gateway	OTP verification and queue status SMS alerts for patients	RashuvMed / RMedQ	Subject to gateway provider's terms

We do not sell, share, or transfer personal data to any third party for advertising, profiling, marketing, or commercial purposes. This is absolute.

5. Data Retention

• Corporate inquiry data (name, email, message from rashuv.com contact form): Retained for as long as needed to respond to the inquiry and maintain reasonable business correspondence records. Typically deleted or anonymized after 24 months of inactivity.
• RashuvMed patient token data: Detailed retention schedule is in the RashuvMed Privacy Policy. In summary: archived after each clinic day, retained for up to 12 months, then eligible for deletion.
• RashuvBiz employee data: Retained for the duration of the employer's active account plus 90 days after account closure, after which it is permanently deleted.
• Security logs / IP metadata: Not retained as user-level records. Processed transiently for security purposes under Firebase App Check and Cloudflare policies.

6. How Data Is Secured

• Encryption in transit: All connections to Rashuv Technologies web properties use TLS 1.3 with mandatory HTTPS Strict Transport Security (HSTS).
• Encryption at rest: All data in Google Cloud Firestore is encrypted at rest using AES-256 by Google.
• Data residency: All primary databases are hosted in Google Cloud's asia-south1 region (Mumbai, India), satisfying Indian data residency requirements under the DPDP Act 2023.
• Access control: Each product enforces role-based access. Clinic reception staff can only access their own clinic's data. Employer accounts in RashuvBiz can only access their own organization's employee records.
• No plaintext credentials: Admin PINs and passwords are never stored in plaintext.
• Firebase App Check: API endpoints are protected by Firebase App Check to prevent automated abuse from non-legitimate clients.

7. What We Do Not Do

• We do not sell, rent, or trade personal data to any third party
• We do not use advertising networks or behavioral tracking on any of our products
• We do not build cross-product user profiles linking your activity across RashuvMed, RashuvBiz, or rashuv.com
• We do not send marketing communications to patient mobile numbers or emails collected through RashuvMed
• We do not use your data to train AI or machine learning models
• We do not collect Aadhaar numbers, PAN numbers, financial account details, or government IDs on any platform

8. Legal Basis for Processing (DPDP Act 2023)

Under India's Digital Personal Data Protection Act 2023, we process personal data on the following lawful bases:

• Consent: For patients booking OPD tokens via RMedQ, and for visitors submitting inquiry forms on rashuv.com, data is processed based on explicit, voluntary consent given at the point of submission.
• Contractual necessity: For clinic operators using RashuvMed and employers using RashuvBiz, data processing is necessary to deliver the service they have subscribed to.
• Legitimate interest: IP addresses and browser metadata are processed for security and fraud prevention, where this does not override individual rights.

9. Your Rights

Under the DPDP Act 2023 and the IT Act 2000, you have the following rights:

• Right to information: Know what personal data we hold about you and how it is used
• Right to correction: Request correction of inaccurate or incomplete personal data
• Right to erasure: Request permanent deletion of your personal data from our systems
• Right to withdraw consent: Withdraw consent for data processing at any time, without affecting the lawfulness of processing prior to withdrawal
• Right to grievance redressal: Raise a complaint with our Grievance Officer, and if unresolved, with the Data Protection Board of India once constituted

10. How to Exercise Your Rights

To request data access, correction, deletion, or to withdraw consent, email us at [email protected] with:

• Your name and the product you used (rashuv.com inquiry, RashuvMed, RashuvBiz)
• The specific request (access / correction / deletion / withdrawal of consent)
• Any identifying information that helps us locate your record (e.g., mobile number used for RMedQ, email used for an inquiry)

We will acknowledge your request within 48 hours on business days and complete it within 15 business days. Identity verification may be required before deletion or access requests are processed.

11. Changes to This Policy

We will update this Privacy Policy when our data practices change, when we launch new products, or when required by law. Material changes will be announced by updating the Effective Date and, for registered users of any product, by displaying a notice in the relevant product interface with at least 14 days' notice before the change takes effect.

12. Grievance Officer & Contact

Rashuv Technologies has appointed a Data Protection & Grievance Redressal Officer as required under applicable Indian law: