Healthcare Data Notice

1. The clinic and the technology provider

The healthcare organisation decides why it needs patient information, which administrative tasks may be automated, who may access the records and when staff must intervene. In an agreed deployment, Swarelic AI’s responsibilities for processing information on the organisation’s instructions must be recorded in the service and data-processing agreements.

The roles of Data Fiduciary and Data Processor, where the relevant Indian DPDP provisions apply, follow the facts of the processing and the law. A website label alone does not determine a party’s duties. A patient should receive the clinic’s own notice and contact details.

2. Collect only what the task needs

An appointment workflow may need a patient’s name, callback number, preferred practitioner, visit type, requested slot and language preference. A caregiver’s details should only be used with suitable authority. Avoid collecting symptoms or detailed histories when an administrative booking can be completed without them.

Aadhaar, ABHA numbers, diagnostic reports, prescriptions, payment-card information and identity-document images are not needed for a sales demo. Any production need for such information requires a separate assessment, appropriate safeguards and a documented purpose. Swarelic AI’s public site does not offer an ABDM or ABHA integration.

3. AI disclosure, recording and language

A clinic should identify its virtual assistant at the start of a call, explain the administrative purpose, and provide a way to request a person. If recording or transcription is enabled, the clinic must establish the appropriate notice, permissions, access restrictions and retention period before it begins.

Test the actual language mix and names used by your patients. The sample demonstrates Hindi and English; it is not evidence that every Indian language, accent or clinical term is supported. Confirm additional languages and how an uncertain conversation is transferred to staff.

4. Confirmations and shared phones

Many patients rely on a shared family phone. Confirm the intended recipient, contact number and preferred channel before sending a reminder. Keep message content proportionate: clinic name, appointment time and a suitable callback route may be enough without naming a sensitive specialty or diagnosis.

SMS, WhatsApp and outbound calls each need a suitable configuration and recipient permissions. Promotional outreach is a separate purpose from an appointment update. For applicable bulk telecom communications, verify sender and template requirements against TRAI’s sender guidance and the access provider’s current rules.

5. Clinical questions and escalation

Administrative AI must not be presented as a doctor or used to diagnose, prescribe, interpret reports or independently decide the urgency of a condition. The healthcare team must define when to stop the automated conversation, who receives the handoff and what happens if no member of staff answers.

A callback queue is not an emergency service. For an emergency in India, use 112 or an appropriate emergency care service. Patients should not wait for a response from this website or its business mailbox.

6. Before patient data enters a production workflow

• Written scope: permitted tasks, information categories, supported languages, clinic-approved scripts and human responsibilities.
• Data flow: all telephony, transcription, AI, hosting, scheduling and messaging providers, including processing countries and approved access.
• Protection: agreed access controls, transmission and storage protections, logs, incident contacts and applicable reporting duties.
• Lifecycle: retention for audio, transcripts, summaries and backups; procedures for correction, export, deletion and contract termination.
• Secondary use: expressly document whether any provider may use data for model training or other independent purposes. This website does not grant that permission or promise vendor terms that have not been agreed.

These are matters to establish during deployment review, not claims that a particular security certification, localisation arrangement or integration has already been verified. See the Security Overview.

7. Patients, children and caregivers

For a booking change, access to a record, consent withdrawal or a complaint about a call, contact the clinic whose number you called. It can verify identity and explain clinical-record retention rules. A parent or lawful guardian may need to act for a child; a caregiver’s relationship alone should not be treated as unlimited permission to access records.

If your concern is about this public website or an email sent to Swarelic AI, follow our privacy request process. Send a description of the issue first, without attaching medical records.

8. Indian requirements and this notice

Relevant data-protection, health-record and telecom requirements depend on the organisation, activity and provisions in force. The DPDP Act and Rules have a phased commencement; this notice does not certify a deployment’s compliance. The applicable obligations must be assessed before launch and as the law takes effect. This page supplements the public Privacy Policy and does not replace a clinic’s patient notice or a signed agreement.