Summary
Oronzo LLP acts as a Data Fiduciary for Subscriber data and a Data Processor for Patient Data. We do not sell personal data. Patient health data is classified as Sensitive Personal Data (SPDI) under Indian law.
1. Who We Are
Oronzo LLP is a Limited Liability Partnership registered in India. We operate the Curex24 Clinic platform — a SaaS clinic operations management system for Indian outpatient clinics. For privacy matters, contact hello@oronzo.io.
2. Scope
This Policy applies to all personal data processed in connection with your use of Curex24 Clinic, including data from Subscribers (clinic owners, staff), patients, and visitors to our website.
3. Data We Collect
| Category | Examples | Source |
|---|---|---|
| Identity | Name, email, phone, clinic name, role | Subscriber at signup |
| Credentials | Hashed passwords, session tokens (never plaintext) | Subscriber at login |
| Patient health (SPDI) | Vitals, prescriptions, diagnoses, lab results | Subscriber on behalf of patients |
| Payment | Razorpay transaction IDs, invoice amounts (no raw card data) | Subscriber billing |
| Usage & logs | IP address, browser, pages visited, API calls, error logs | Automatic |
| Cookies | Session cookie, analytics preferences | Browser |
4. Purposes & Legal Basis
- Service delivery — provide, maintain, and improve the Platform (Contract performance)
- Billing & subscription — process payments and manage subscriptions (Contract performance)
- Security & fraud prevention — detect and prevent abuse (Legitimate interest)
- Legal compliance — comply with Indian law (Legal obligation)
- Support & communications — respond to queries, send critical service updates (Consent)
- Analytics — aggregate, anonymised usage metrics to improve the product (Legitimate interest)
5. Consent & Withdrawal
Where we rely on consent (e.g. marketing emails), you may withdraw it at any time by emailing hello@oronzo.io or clicking "Unsubscribe" in any email. Withdrawal does not affect the lawfulness of prior processing.
6. Children
The Platform is not intended for use by persons under 18. Patient records for minor patients are managed by their authorised guardian acting through the Subscriber.
7. Sharing & Disclosure
We do not sell personal data. We disclose data only to:
- Sub-processors who help us operate the Platform (see Section 8)
- Law enforcement or government authorities when required by law
- Acquirer in the event of a merger, acquisition, or asset sale (with notice to Subscribers)
8. Sub-Processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | PostgreSQL database hosting | AWS ap-south-1 (Mumbai) |
| Cloudflare R2 | File and PDF storage | Global CDN |
| Upstash | Redis queue (BullMQ) | ap-southeast-1 |
| Razorpay | Payment processing | India |
| Twilio / Meta WhatsApp | WhatsApp message delivery | India / Global |
| Vercel | Web frontend hosting | Global Edge |
| Railway | API server hosting | Asia |
| Sentry | Error monitoring (anonymised) | US / EU |
9. Retention & Erasure
We retain Subscriber account data for the duration of the subscription plus 30 days. Patient Data is retained as configured by the Subscriber, subject to a minimum of 3 years as required by Indian medical record guidelines. You may request erasure by contacting hello@oronzo.io.
10. Security
- Data encrypted at rest (AES-256) and in transit (TLS 1.3)
- Passwords stored as bcrypt hashes — never in plaintext
- JWT tokens with short expiry and refresh token rotation
- Login lockout after repeated failed attempts
- Role-based access control (RBAC) with principle of least privilege
- Regular vulnerability scanning and dependency updates
- Sentry error monitoring for rapid incident detection
11. Your Rights (DPDP Act 2023)
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- Access — obtain confirmation of whether we process your personal data
- Correction — request correction of inaccurate or incomplete data
- Erasure — request deletion of your personal data (subject to legal retention obligations)
- Grievance redressal — lodge a complaint with our Grievance Officer
- Nominate — nominate another person to exercise these rights on your behalf
To exercise these rights, email hello@oronzo.io. We will respond within 30 days.
12. Cookies
We use essential session cookies to keep you logged in, and optional analytics cookies to understand usage patterns. You may disable non-essential cookies in your browser settings.
13. Marketing
We may send you product updates and occasional offers by email. You can opt out at any time using the unsubscribe link or by contacting hello@oronzo.io.
14. Clinic & Patient Data
Patient health data is classified as Sensitive Personal Data or Information (SPDI) under the IT (Reasonable Security Practices) Rules, 2011. The Subscriber is the Data Fiduciary for their patients' data. Oronzo LLP acts as a Data Processor on the Subscriber's instructions.
We will not use patient data for any purpose other than providing the Platform services. Subscribers are responsible for obtaining appropriate patient consent.
15. Grievance Officer & DPO
Grievance Officer / Data Protection Officer
Oronzo LLP
Email: grievance@oronzo.io
DPO Email: hello@oronzo.io
We acknowledge within 24 hours and resolve within 15 days (IT Act 2000 / IT Intermediary Guidelines 2021).
16. Changes to this Policy
Material changes will be notified by email or in-app notification at least 15 days before they take effect. The latest version is always available at clinic.curex24.com/privacy.