Privacy Notice & Data Protection Practices

1. Data Minimization & Roles

HealthPlusGo acts as a Data Processor on behalf of subscribing laboratories (Data Fiduciaries). Laboratories collect patient personal and health data for the exclusive purpose of processing laboratory tests and generating diagnostic reports.

2. Types of Data Processed

• Lab Staff / Owner Data: Name, mobile number, role, IP address, and security logs for authentication and audit provenance.
• Patient Data: Name, age, gender, mobile number, referred doctor, diagnostic test orders, and numerical/qualitative result parameters entered by the lab.

3. Cloud Infrastructure, Storage & Subprocessors

Patient and operational diagnostic records are hosted in dedicated managed cloud databases protected by PostgreSQL Row-Level Security, least-privilege database roles, and TLS 1.3 encryption in transit and AES-256 encryption at rest. Subprocessors process technical data strictly under instruction to deliver hosting, computing, and communications services. We do not sell, rent, monetize, or use patient diagnostic results for marketing or advertising purposes.

4. Report Verification Privacy

Public verification QR codes expose only masked patient identities (e.g., A**** K****) and document status to verify authenticity without leaking full clinical parameters to unauthorized third parties.

5. Grievance Redressal

In accordance with Indian regulations, a designated Grievance Officer is reachable via our contact channel for privacy inquiries, data subject access, and correction requests.