Privacy Policy

1. About Tympanic Healthcare

Tympanic Healthcare Pvt Ltd ("we", "us", or "our") develops and operates OgenPro, a practice management platform for healthcare providers in India.

Contact:
Email: info@tympanichealthcarepvtltd.in
Website: tympanichealthcarepvtltd.in

2. Information We Collect

Account and Practice Information

• Your name, email address, and password (hashed)
• Clinic or practice name, address, and contact details
• Provider numbers, registration council details, and professional credentials you enter
• Subscription and billing information (processed via third-party payment providers)

Patient Records (held on behalf of your practice)

When you use OgenPro to manage patient care, you enter patient health information into the platform. This data is held by us as a data custodian acting on behalf of your practice. It includes:

• Patient demographics (name, date of birth, contact information, Aadhar/ABHA number where provided)
• Medical and dental history, clinical notes, diagnoses, and treatment plans
• Prescriptions, referrals, and pathology requests
• Appointment history and billing records
• Consent forms signed via the patient portal

Usage and Technical Information

• Device type, operating system, and app version
• IP address and general location (country/state)
• Feature usage patterns and session logs (for performance monitoring only)

3. How We Use Your Information

We use the information collected to:

• Provide, operate, and improve the OgenPro platform
• Authenticate users and secure access to health records
• Process subscription payments and provide billing support
• Send transactional communications (account alerts, appointment reminders if configured)
• Diagnose technical issues and maintain platform reliability
• Comply with applicable legal obligations

We do not use patient health information for advertising, marketing, or any purpose beyond the direct provision of the OgenPro service to your practice.

4. Disclosure of Information

We do not sell, rent, or trade your information or your patients' information to any third party.

We may disclose information in the following limited circumstances:

Service Providers (Sub-processors)

• Supabase — database infrastructure and user authentication (data stored in the AWS ap-south-1 region, Mumbai)
• RevenueCat — subscription management and in-app purchase processing (where applicable)
• Apple App Store / Google Play — app distribution and in-app payment processing

Each sub-processor is bound by contractual obligations consistent with our privacy commitments. Patient health data is not transmitted to payment or distribution providers.

Legal Requirements

We may disclose information if required by law, court order, or regulatory authority, or to protect the rights, property, or safety of Tympanic Healthcare, our users, or others.

5. Data Storage and Security

All patient and practice data is stored in India (AWS Mumbai, ap-south-1 region) unless you have explicitly configured otherwise. We implement:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Row-level security controls so each practice can only access its own data
• Role-based access control within each practice
• Regular security reviews and vulnerability assessments
• Multi-factor authentication support for practitioner accounts

No system is completely secure. In the event of a personal data breach, we will notify affected Data Principals and report to the Data Protection Board of India as required under the DPDP Act, 2023.

6. Data Retention

We retain your practice data for as long as your account is active. On account termination:

• You may request a full data export before closing your account
• Practice and patient data is deleted from our active systems within 30 days of account closure
• Backups are purged within 90 days

We may retain anonymised, aggregated usage statistics that cannot be linked to any individual or practice.

7. Your Privacy Rights

Under the Digital Personal Data Protection Act, 2023, you (as a Data Principal) have the right to:

• Access a summary of personal data held by us and how it is being processed
• Correct and update inaccurate or incomplete personal data
• Erasure — request deletion of your personal data where the purpose of processing is no longer served
• Grievance redressal — raise a complaint with our designated Grievance Officer
• Nominate another individual to exercise your rights in case of death or incapacity

To exercise these rights, contact us at info@tympanichealthcarepvtltd.in. We will respond within 30 days.

8. Patient Rights

Patients whose records are held in OgenPro by their healthcare provider should direct access and correction requests to their clinic. We will cooperate with clinics acting on their patients' behalf. Patients may also contact us directly at info@tympanichealthcarepvtltd.in.

9. Children's Privacy

OgenPro is intended for use by healthcare practitioners and clinic staff. We do not knowingly collect personal information from individuals under 18 years of age as direct users of the platform. Patient records for minors are managed by the responsible adult or healthcare provider in accordance with applicable laws.

10. Cookies and Tracking

The OgenPro mobile and desktop application does not use tracking cookies or cross-site advertising trackers. Our website (tympanichealthcarepvtltd.in) may use essential cookies necessary for site functionality only.

11. Third-Party Links

OgenPro may display links to third-party websites or services (such as pathology portals or health fund portals). This Privacy Policy does not apply to those third-party services. We encourage you to review their privacy policies before submitting any information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, notify active account holders by email at least 14 days before the change takes effect.

13. Contact Us

For any privacy-related questions, requests, or complaints:

Tympanic Healthcare Pvt Ltd
Privacy Officer
Email: info@tympanichealthcarepvtltd.in

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once operational, or approach the appropriate adjudicating authority under the Information Technology Act, 2000.