This Privacy Policy explains how Uchhal ("Uchhal", "we", "us" or "our"), the provider of the Clinovant application and related backend services (together, the "Service"), collects, uses, stores, shares and protects your personal data. Clinovant is an AI-assisted medical scribe that records doctor–patient consultations in Indian languages, transcribes them, and maintains a longitudinal medical case report.
We are committed to protecting your privacy in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") of India and other applicable laws. In this policy, "you" refers to the Data Principal whose personal data we process, and Uchhal acts as the Data Fiduciary (and, where we process data on behalf of a healthcare provider, as a Data Processor).
The Service is operated by Uchhal (uchhal.in). For any privacy-related question or request, contact us at kapilchaudhary8280@gmail.com.
We collect only the data needed to provide the Service:
| Category | What it includes | Why we collect it |
|---|---|---|
| Account data | Username, hashed password, and role (doctor or patient). | To create and secure your account and authenticate you. |
| Audio recordings | Audio of consultations or spoken descriptions you record in the app. | To transcribe the consultation into text. |
| Transcripts | Text transcriptions of your recordings, including speaker labels where available. | Input for the AI analysis and the case report. |
| Health / medical data (sensitive) | Conditions, symptoms, current status and progression, medications, vitals, investigations and clinical advice extracted into your case report; optional patient names. | To build and maintain a cumulative medical case report across visits. |
| Case & session metadata | Case titles, timestamps, session lists and status (e.g. confirmed, resolved). | To organise cases and track them longitudinally. |
| Generated documents | PDF reports created from your case data and temporary download links. | To let you export and share reports. |
We do not sell your personal data, and we do not use it for advertising.
We process your personal data to:
Our lawful basis for processing is your consent under the DPDP Act, and, where applicable, the legitimate uses permitted by that Act. You may withdraw consent at any time (see Your rights).
By using the Service you consent to the processing described in this policy. You can withdraw your consent, and delete your data, as described below.
We share your data only with the service providers needed to deliver the Service. Each processes data on our instructions for the stated purpose:
| Provider | Purpose | Data shared |
|---|---|---|
| Sarvam AI | Speech-to-text transcription of consultation audio. | Audio recordings. |
| OpenAI | AI analysis that produces and updates the medical report. | Transcripts and relevant case history (text). |
| Amazon Web Services (AWS) | Hosting the backend (compute) and storing exported PDF reports. | Application data and generated PDF reports (region: Asia Pacific, Mumbai — ap-south-1). |
| MongoDB (Atlas) | Primary database for accounts, cases, sessions and reports. | Account data, transcripts, health data and metadata. |
We may also disclose data where required by law, or to protect the rights, safety and security of users, the public or Uchhal. If Uchhal is involved in a merger, acquisition or asset sale, your data may be transferred, subject to this policy.
We aim to store your data in India (AWS Mumbai region). However, some of our sub-processors — in particular the AI analysis provider (OpenAI) — may process data on servers located outside India. We transfer such data only to the extent permitted by the DPDP Act and only for the purposes described in this policy. By using the Service you consent to such transfers.
We keep your personal data only for as long as your account and cases are active, or as needed to provide the Service and meet legal obligations. You can delete a case at any time from the app, which removes its associated data. You may also request deletion of your entire account and associated data by contacting us. Exported PDF download links are temporary and expire.
After deletion, residual copies may persist for a limited period in backups and in sub-processor systems before being erased in the ordinary course. We do not retain data longer than necessary.
We use reasonable technical and organisational safeguards to protect your data, including:
No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you and the Data Protection Board of India as required by the DPDP Act.
As a Data Principal, you have the right to:
To exercise any of these rights, email kapilchaudhary8280@gmail.com. We may need to verify your identity before acting on a request. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
The Service is intended for use by healthcare providers and adult patients. Where health data relating to a child (a person under 18) is processed, it must be provided and consented to by a parent or lawful guardian. We do not knowingly use children's data for tracking, behavioural monitoring or targeted advertising. If you believe we hold a child's data without proper consent, contact us and we will delete it.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where changes are significant, provide a more prominent notice. Continued use of the Service after an update means you accept the revised policy.
For any questions, requests or complaints about your personal data or this policy, contact our grievance point of contact:
We aim to acknowledge and respond to requests within the timelines required by law.