CareJourney Privacy Policy

This privacy policy applies to the CareJourney app for mobile devices and web browsers, together with any related services operated by Ebiw Info Analytics Pvt. Ltd. (collectively, the “Application”). Ebiw Info Analytics Pvt. Ltd. is referred to as the “Service Provider”, “we” or “us”.

1. Who this policy covers

CareJourney is a clinical workspace used by hospitals and clinics (“Healthcare Organizations”) and their authorized staff, such as doctors, nurses, receptionists and administrators (“Staff Users”). The Application is not offered to the general public.

Patient information entered into the Application belongs to, and is controlled by, the Healthcare Organization that entered it. The Service Provider processes it only on that organization's behalf and instructions, and keeps each organization's data separate from every other organization's.

• Patients who want to access, correct or delete their information should contact their Healthcare Organization. The Service Provider will assist that organization in responding.
• Staff Users may contact the Service Provider directly about their own account data.

2. Information we collect

Information provided by Staff Users and Healthcare Organizations

• Staff account information: name, work email address, phone number, job role and department, and professional credentials and license number.
• Patient information entered by authorized staff: patient name, date of birth, gender, phone number and address, emergency contact and guardian details, insurance information, medical history, allergies, diagnoses, prescriptions and medications, lab results and vital signs, consultation notes, and uploaded medical documents and images.
• Consultation audio and transcripts: recorded only when a clinician starts the AI Scribe feature.

Information collected automatically

• IP address, device type and operating system.
• Sign-in, sign-out and account activity, and records of which patient records were accessed or changed (audit logs).
• The screens of the Application used and the time and date of use, for security and troubleshooting.

Device permissions

• Microphone: to record consultations for AI Scribe, only when started by the user.
• Camera: to photograph documents and scan barcodes and QR codes.
• Storage: to upload documents from the device.
• Biometrics: fingerprint unlock is handled by your device. The Application never receives your fingerprint data.

The Application does not track your location and does not contain advertising or third-party analytics SDKs.

3. How we use information

• To provide the Application to Healthcare Organizations: managing patients, appointments, consultations, prescriptions, billing, documents and internal communication.
• To provide AI features (see section 4).
• To keep the Application secure: authentication, preventing unauthorized access, keeping audit logs and investigating misuse.
• To provide support and send Staff Users service-related notices, such as security alerts and updates.
• To comply with legal obligations.

Patient information is never used for marketing, sold, or shared for advertising.

4. Artificial intelligence

The Application uses AI to transcribe consultation audio and draft clinical notes (AI Scribe), summarize patient history, flag possible clinical alerts, extract data from uploaded documents, and answer questions through an in-app assistant.

• Audio and clinical text are processed by Google Cloud AI services solely to provide these features and are not used to train public AI models.
• AI output is a draft for review. A qualified clinician must review and approve it; it is not a medical decision.
• Recording only starts when a clinician starts AI Scribe. Patients should be informed and give consent according to the Healthcare Organization's procedures.

5. Service providers and sharing

To operate the Application, the Service Provider uses the following providers, which process data only on its instructions:

• Google Cloud (Vertex AI / Gemini, Speech-to-Text, Cloud Storage): transcription and AI note generation from consultation audio, document OCR, and file storage. Privacy notice
• MongoDB Atlas: encrypted database hosting for all Application data. Privacy policy
• Server hosting provider: runs the Application's backend servers.
• Google Play Services: app distribution and on-device barcode and QR scanning (ML Kit), which may send anonymous usage and diagnostic data to Google. Privacy policy
• Expo: the framework used to build and deliver the app. Privacy policy

These providers receive identifiable data, including patient health information and consultation audio, only as needed to provide the service. We may also disclose information:

• as required by law, such as to comply with a subpoena or similar legal process;
• when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

6. Cookies and session tokens

The Application uses only essential session tokens and cookies needed to keep you signed in securely. It does not use advertising or analytics trackers.

7. Security

Data is encrypted in transit (HTTPS/TLS) and at rest. Access is limited by role and by organization, with each Healthcare Organization's data isolated from every other organization's. Sign-in uses secure tokens that can be revoked, signed-in sessions end on sign-out, and access to patient records is recorded in audit logs. No system is completely secure, but we use physical, electronic and procedural safeguards appropriate to health data.

8. Data retention

• Patient records: retained according to the instructions of the Healthcare Organization and the medical-record retention periods required by applicable law, then deleted or returned to the organization.
• Staff account data: retained while the account is active and up to 12 months afterwards.
• Audit and security logs: retained as required for security and legal compliance.
• Aggregated, anonymized data: may be retained indefinitely because it no longer identifies anyone.

9. Data deletion

• Staff accounts: ask your hospital administrator to deactivate your account, or email support@ebiw.com with the subject “Account deletion”. Requests are completed within 30 days of verifying your identity.
• Patient data: deleted on the Healthcare Organization's request, subject to legal retention periods.
• Healthcare Organizations: when an organization stops using CareJourney, its data is deleted or returned on request after any legally required retention period.

Uninstalling the app stops further collection from your device but does not delete data already stored on our servers.

10. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and withdraw consent where processing is based on consent. Staff Users can contact us at support@ebiw.com. Patients should contact their Healthcare Organization first (see section 1).

India (Digital Personal Data Protection Act, 2023)

You may access, correct and erase your personal data and nominate another person to exercise these rights. You may also complain to the Data Protection Board of India.

For privacy questions or grievances, contact the eBIW Privacy Team: support@ebiw.com, phone +91 98742 87284, Merlin Infinite, Unit 513, 5th Floor, DN 51, Sector 5, Salt Lake, Kolkata 700091, West Bengal, India.

11. International data transfers

Our service providers may process data in countries other than your own. Where the law requires safeguards for such transfers, we use appropriate mechanisms, such as Standard Contractual Clauses, adequacy decisions, or your consent where required.

12. Children

The Application is used only by adult healthcare staff and is not directed at children. Information about minors may be entered as part of a patient's medical record by authorized staff of a Healthcare Organization, with consent from a parent or guardian as required by law. Such records are handled like all other patient records.

13. Data breach notification

If a data breach affects personal data, we will notify the affected Healthcare Organizations and, where required, individuals and authorities, in line with applicable law, including information about the breach and the steps being taken.

14. Changes to this policy

We may update this policy from time to time. Material changes will be posted with a new effective date and, where required by law, we will seek consent before they take effect. Previous versions are available on request from support@ebiw.com.

15. Contact us

Ebiw Info Analytics Pvt. Ltd.

Merlin Infinite, Unit 513, 5th Floor, DN 51, Sector 5, Salt Lake, Kolkata 700091, West Bengal, India

Email: support@ebiw.com Phone: +91 98742 87284