Privacy Policy

OSTRON Electronics Private Limited ("Ostron", "we", "us") provides Ostron HMIS, an ABDM M1, M2 & M3 certified hospital management information system available at hmis.ostron.in. This Privacy Policy explains how we collect, use, store, share and protect personal data, including health data, and the rights available to you. It is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 ("DPDP Act") and rules made under it, and the ABDM Health Data Management Policy.

1. Who is responsible for your data

Ostron HMIS is used by hospitals, nursing homes, clinics and other health facilities ("Facilities"). Our role depends on whose data it is:

Whose data	Who decides how it is used	Our role
Patients of a Facility (registration, ABHA, clinical records, reports, bills)	The Facility treating the patient	Data Processor – we process it only on the Facility's instructions to provide the Service
Facility staff using the software (doctors, nurses, reception, pharmacy, lab, billing)	The Facility (their employer)	Data Processor for records the Facility keeps; Data Fiduciary for login and security logs we keep to run the Service
Customers, prospects and website visitors (demo requests, contact details, billing)	Ostron	Data Fiduciary

If you are a patient, the Facility where you were treated is responsible for your records. Please contact that Facility first to access, correct or erase your data, or to withdraw consent. We will help the Facility respond to your request. You can also contact our Grievance Officer (Section 15).

2. Data we collect

2.1 Patient data (processed on behalf of Facilities)

Identity and contact: name, age/date of birth, gender, photograph, address, mobile number, email, guardian/next-of-kin details, UHID.
ABDM identifiers: ABHA number and ABHA address, and KYC status. For ABHA creation via Aadhaar, Aadhaar-based OTP verification is performed through the ABDM/UIDAI flow; we do not store the full Aadhaar number unless the Facility is required by law to record it, in which case it is masked.
Health data: vitals, history, complaints, diagnoses, prescriptions, allergies, nursing notes, medication administration, surgical/OT notes, lab and radiology orders and results, images, blood bank records, admission, transfer and discharge summaries.
Financial data: bills, receipts, payment mode, deposits, insurance/TPA policy details, PM-JAY or other scheme identifiers, claim documents. We do not store full card numbers; card payments, if any, are handled by PCI-DSS compliant payment gateways.

2.2 Staff and user data

Name, role, department, mobile number (for OTP login), email, HPR ID and registration number (for doctors), digital signature/stamp images where used.
HR and payroll data, where the HR module is used (attendance, leave, salary, bank account, PAN).
Technical logs: login time, IP address, device/browser, and an audit trail of records created, viewed, edited or deleted.

2.3 Customer and website visitor data

Details submitted through the demo/contact form: name, facility name, phone, email, facility type, number of beds, message.
Billing details: company name, GSTIN, billing address, authorised signatory.
Communications with us by phone, email or WhatsApp, including support tickets.
Technical data: IP address, browser type, pages visited, and cookie data (see Section 12).

3. ABDM, ABHA & consent

Ostron HMIS has cleared ABDM functional testing for Milestones M1, M2 and M3 (Certificate No. ATPL/FT-CERT/2609/160, 16 September 2026). Within the software:

M1 – Create & verify ABHA: a Facility may create or verify a patient's ABHA using Aadhaar or mobile OTP, or by scanning the patient's ABHA QR code, only with the patient's participation and consent.
M2 – Link health records: prescriptions, lab reports, discharge summaries and other records created at the Facility may be linked to the patient's ABHA so they appear in the patient's chosen Personal Health Record (PHR) app.
M3 – Fetch records with consent: a Facility may request a patient's records from other ABDM-registered facilities. Records are shared only after the patient approves the consent request through the ABDM consent manager, and only for the purpose, types of records and period approved by the patient.

Patients can view, manage and revoke consents through their ABHA/PHR app. Records fetched under consent are used only for the purpose consented to and are not retained beyond the consented period except where the Facility is required by law to keep them as part of its own medical records. Having an ABHA is voluntary; no patient can be denied care for not having or not sharing one.

Health data exchanged through ABDM is transmitted in encrypted form using ABDM-prescribed standards. We do not use ABDM data for any purpose other than delivering the Service to the Facility.

4. How we use data

4.1 Patient and Facility data (as Data Processor)

To provide the modules the Facility has subscribed to: registration, appointments, OPD/IPD, nursing, OT, laboratory, radiology, blood bank, pharmacy, billing, insurance/TPA, reports and analytics.
To perform ABDM functions (ABHA creation/verification, record linking, consented record fetch).
To send SMS/WhatsApp messages the Facility configures (such as appointment reminders, report-ready alerts or bills).
To provide support, troubleshooting, data migration, backups and restoration when requested by the Facility.
To maintain security, detect misuse and keep audit logs.

We do not sell patient data, use it for advertising or marketing, or use identifiable patient data to train commercial products for third parties.

4.2 Customer and visitor data (as Data Fiduciary)

To respond to demo and pricing requests, onboard customers, and issue invoices.
To provide support and send service notices (maintenance, updates, security alerts, ABDM changes).
To send product information you have agreed to receive; you may opt out at any time.
To improve our website and Service using aggregated, de-identified usage statistics.
To comply with legal, tax and regulatory obligations.

5. Legal basis & consent

We process personal data on the basis of consent, or for legitimate uses permitted under the DPDP Act (such as data voluntarily provided for a specific purpose, compliance with law, medical emergencies, or employment purposes). Facilities are responsible for giving patients the required notice and obtaining their consent for processing through Ostron HMIS. Where processing is based on consent, you may withdraw it at any time; withdrawal does not affect processing already done, and some records may still need to be retained by the Facility under law.

We share personal data only as follows:

With the Facility that owns the data, and within the Facility only to users whose role permits access.
With ABDM/NHA systems (ABHA, HFR, HPR, gateway, consent manager) when a Facility uses ABDM features.
With service providers who help us run the Service, such as India-based cloud hosting, SMS/OTP and WhatsApp providers, email services and payment gateways, under written contracts requiring confidentiality and security and limiting use to our instructions.
With insurers, TPAs, government schemes or laboratories only when the Facility initiates such sharing through the Service (for example, submitting a claim file).
With authorities when required by law, court order or a lawful request by a government agency, including for verification of identity or prevention, detection or investigation of offences.
In a business transfer (merger, acquisition or restructuring), subject to the recipient being bound by this Policy.

7. Storage & localisation

For cloud deployments, all Customer Data, including patient health data, is stored on servers located in India. For on-premise deployments, data is stored on the Facility's own server and the Facility controls its storage, access and backups. We do not transfer patient health data outside India.

8. Security

We maintain reasonable security practices and procedures in line with IS/ISO/IEC 27001 principles and the ABDM Health Data Management Policy, including:

encryption of data in transit (HTTPS/TLS) and encryption of backups;
role-based access control so each user sees only what their role requires;
OTP-based sign-in on registered mobile numbers and session timeouts;
audit trails recording who created, viewed, changed or deleted records;
scheduled automatic backups and tested restoration;
regular updates and patching; and
independent security audits. hmis.ostron.in was audited by Avasure Technologies Pvt. Ltd., a CERT-In empanelled organisation, from 8 to 16 September 2026 and certified "Safe to Host" (Certificate No. ATPL/SEC-CERT/2609/160, valid 16 September 2026 to 15 September 2027).

No system is completely secure. Facilities and users must keep their devices secure and never share login credentials or OTPs.

9. Retention

Patient and Facility data is retained for as long as the Facility's subscription is active, and thereafter as instructed by the Facility. Facilities are responsible for meeting medical-record retention periods required by law and professional regulations (for example, generally at least 3 years for in-patient records under National Medical Commission regulations, and longer for medico-legal cases or under applicable State rules). After termination, data is available for export for 30 days and then deleted from active systems, with backups overwritten in the normal backup cycle.
Audit and security logs are retained for at least 180 days, or longer where required by CERT-In directions or other law.
Customer, billing and enquiry data is retained for as long as needed for the purpose collected and as required by tax and company law (typically 8 years for accounting records). Demo enquiries that do not lead to a subscription are deleted within [24] months unless you ask us to delete them sooner.

10. Your rights

Subject to the DPDP Act and other applicable law, you have the right to:

Access a summary of your personal data being processed and the processing activities;
Correction, completion and updating of inaccurate or incomplete data;
Erasure of data no longer needed for the purpose, unless retention is required by law;
Withdraw consent at any time, as easily as it was given;
Nominate another person to exercise your rights in the event of death or incapacity; and
Grievance redressal through our Grievance Officer, and thereafter to approach the Data Protection Board of India.

Patients should exercise these rights with the Facility that treated them (see Section 1). Customers and visitors may write to our Grievance Officer. We may need to verify your identity before acting on a request.

11. Children & persons with disability

Facilities may register patients who are children or persons with disability. In such cases, the Facility is responsible for obtaining verifiable consent from a parent or lawful guardian as required under the DPDP Act, except where processing is permitted without it (such as for providing healthcare). We do not use children's data for tracking, behavioural monitoring or targeted advertising. Our website is not directed at children.

12. Cookies

Our website and application use essential cookies to keep you signed in, protect against fraud (for example, CAPTCHA and session security) and remember preferences. We may use basic analytics cookies to understand website traffic in aggregate. We do not use advertising cookies inside the HMIS application. You can manage cookies in your browser settings, but disabling essential cookies may prevent the Service from working.

13. Data breaches

If we become aware of a personal data breach, we will act promptly to contain it, notify affected Facilities without undue delay, and report to CERT-In, the Data Protection Board of India and other authorities within the timelines required by law. Where we are the Data Fiduciary, we will also inform affected individuals as required.

14. Changes to this policy

We may update this Privacy Policy to reflect changes in law, ABDM guidelines or our Service. The updated version will be posted on this page with a revised "Last updated" date, and material changes will be notified to customers by email or in-app notice.

15. Grievance Officer & contact

OSTRON Electronics Private Limited
655A/P05 Gayatripuram, Near Kursi Road, Lucknow – 226022, Uttar Pradesh, India
Email: admin@ostron.in
Phone: +91 63932 90670 (Mon–Sat, 9:00 AM – 8:00 PM)

We acknowledge grievances within 24 hours and aim to resolve them within 15 days, or sooner where required by law. If you are not satisfied with our response, you may approach the Data Protection Board of India in accordance with the DPDP Act.