Privacy policy

This policy explains how personal data is handled in Althena Care: the patient app, the web apps used by hospitals, clinicians and partners, and this website. Althena Care is provided by Alpha Business Solutions Private Limited, Tirunelveli, Tamil Nadu, India ("Althena", "we").

1. Who is responsible for your data

If you're a patient, your hospital decides why and how your care information is used. Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") the hospital is the Data Fiduciary for it, and Althena processes it on the hospital's behalf under a contract with them.

For hospital staff, clinicians and partners who use our web apps, and for anyone who writes to us, Althena is responsible for the data.

2. What we collect

If you're a patient

• Your account: your phone number (checked with a one-time code), your name, your date of birth and the language you'd like Andrea to speak.
• Your care: the clinician and hospital you're linked to, the consent choices you make, and the plan your clinician writes for you.
• Your conversations with Andrea: what you say or write, kept as text. Calls are not recorded. After each conversation we create a short summary for your clinician, including Andrea's estimate of your mood and sleep and any safety concern. If you allow it, Andrea also remembers helpful things you've told her.
• Your check-ins: the moods, notes and sleep times you log.
• Payments: if your hospital charges for a plan, what you bought, the amount and whether it went through. Your card or UPI details go straight to Razorpay; we never see them.
• Technical data: the app version, and security logs of who did what and when (never what you said).

If you're a clinician, hospital staff member or partner

• Your name, work email, role and the hospital or partner organisation you belong to; for clinicians, professional registration details we check; for partners, bank details for payouts.
• A record of what you do in the web apps, including when you open a patient's conversations or check-ins.

3. How it's used

• To provide Althena Care: so you can talk to Andrea, so your clinician can support your care, and to send the reminders you choose. Andrea also sees your check-ins from the last few days, so she can ask how you've been.
• To keep you safe: if what you say or log suggests you may be at risk, your clinician is alerted and you're shown crisis helplines.
• To take payments, pay hospitals and partners, and keep the records tax law requires.
• To keep the service secure and working, and to meet our legal obligations.

We don't sell personal data, we don't show ads, and we don't use your conversations to train AI models.

4. Who sees it

• Your clinician, who sees your conversations, summaries, check-ins and alerts so they can support your care. Your hospital is responsible for these records.
• Service providers that process data for us only to run Althena Care:

Each provider may use the data only to provide its service to us.

• Authorities, when the law requires it.
• In an emergency, your clinician may act under their hospital's protocol if someone's life or safety is at risk.

5. Where it's stored

Patient records are stored on servers in India. Some service providers may process data outside India to deliver their service: Google Firebase (phone sign-in), Cloudflare (delivering the apps securely) and LiveKit (carrying call audio) run worldwide networks, so the data they handle may pass through or be processed in other countries, including the United States. Andrea's replies and summaries run on Google Cloud in India, and Sarvam AI, Razorpay and Zoho process data in India.

6. How long it's kept

We keep personal data only as long as it's needed for your care or the law requires. Care records are kept for 3 years after your care ends, or longer if your hospital's record-keeping rules require it. Payment records are kept for 8 years, as tax law requires. Security logs are kept for 180 days. When you end your care or ask for your account to be deleted, see Delete your account for what is erased and what must be kept.

7. Your rights

Under the DPDP Act you can:

• ask for a summary of your personal data and how it's used, and who it's shared with;
• ask for it to be corrected, completed or updated;
• ask for it to be erased, unless the law requires it to be kept;
• withdraw a consent at any time: in the app, go to Settings and turn it off (some features stop working without it);
• nominate someone to exercise these rights if you die or can't act yourself;
• have a grievance addressed by us or your hospital, and then complain to the Data Protection Board of India.

To use these rights, ask your clinician, or write to our Grievance Officer (below). We'll reply within 30 days.

8. How it's protected

• Everything is encrypted in transit and at rest; each hospital's conversations are encrypted with that hospital's own key.
• One hospital can never see another hospital's patients, and within your hospital only your own clinician can open your conversations and check-ins.
• Access is limited to the people who need it, and opening a patient's records is logged.
• Our systems don't write what patients say into their logs.

9. Children

Althena Care is for adults aged 18 and over. We don't knowingly collect data from children.

10. This website

althena.ai uses no cookies, analytics or trackers, and loads nothing from other companies. Cloudflare, which delivers it, keeps short-lived technical logs to protect it from attacks. If you email us, we use your message only to reply.

11. Changes to this policy

If we change how your data is used, we'll tell you in the app before the change takes effect, and ask for your consent again where the law requires it.

12. Contact and grievances

Grievance Officer: Sivaguru Srinivas P
Email: [email protected]
Address: Tirunelveli, Tamil Nadu, India