Sutros Technologies LLP, having its registered office at CGU 084, DLF Capital Greens, Karampura, New Delhi - 110015 ("SutrOS", "Company", "we", "us" or "our"), operates and provides its services under the brand name "SutrOS" and operates SutrOS, a healthcare journey-management and workflow platform made available through its website, web-based interfaces, mobile application and related services (collectively, the "Platform").
SutrOS is designed to assist healthcare organisations, healthcare professionals, care coordinators, administrative personnel and other authorised users in managing and coordinating complex healthcare journeys. The Platform enables authorised users to organise and manage information relating to patient journeys, stages, checkpoints, barriers, modifiers, pending actions, records, communications, appointments, alerts and other workflow-related activities.
The Platform may also be used by healthcare, pharmaceutical and other organisations for managing structured professional, enterprise and product-adoption journeys. Because the Platform may process information relating to patients and healthcare professionals, including medical records, treatment information, communications, images, videos and other healthcare-related information, we recognise the importance of maintaining the confidentiality, security and appropriate use of such information.
This Privacy Policy ("Policy") explains how we collect, receive, use, process, store, disclose, retain and protect Personal Data and other information when you access or use the Platform, create an account, communicate through the Platform or otherwise interact with us. SutrOS is a healthcare journey-management and workflow platform and is not intended to independently diagnose medical conditions, prescribe medicines, determine treatment plans or make clinical decisions. The Platform may provide workflow-related alerts, summaries, organisation of information and other technology-assisted outputs, but clinical decisions remain with the relevant healthcare professional or healthcare organisation.
We intend our data-handling practices to comply with applicable privacy, data-protection and information-security laws in force from time to time, including the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, to the extent applicable and in force, the Information Technology Act, 2000, and other applicable laws.
By accessing or using the Platform or providing Personal Data to us, you acknowledge that you have read and understood this Policy. This Policy is intended to provide general information regarding our data processing practices and may be supplemented by specific privacy notices or consent mechanisms presented at the point of collection or through the Platform. Where consent is required under applicable law, such notice or consent mechanism shall specify the Personal Data being collected, the purpose of such processing and the applicable means for withdrawing consent or exercising applicable data-protection rights. Where processing is permitted on any other lawful basis, such processing shall be undertaken in accordance with the applicable law and such lawful basis.
1. DEFINITIONS
1.1. For the purposes of this Policy, the following terms have the meanings ascribed to them:
1.1.1. Anonymised Data means data derived from Customer Data or Patient Data that has been irreversibly modified or processed such that an individual is no longer identifiable or reasonably linkable to the data, in accordance with applicable law and SutrOS' applicable technical and organisational measures.
1.1.2. Customer or Organisation means a clinic, hospital, healthcare organisation, pharmaceutical company, healthcare or life-sciences company, enterprise or other entity that engages SutrOS for use of the Platform or related services.
1.1.3. Customer Data means any data, information, content or material provided, uploaded, entered, submitted or otherwise made available to SutrOS by or on behalf of a Customer or its authorised Users through the Platform, including Patient Data, Personal Data and other information relating to the Customer's business, operations or workflows.
1.1.4. Data Principal means the individual to whom the Personal Data relates, as defined under applicable law.
1.1.5. Device means a computer, smartphone, tablet or other electronic device used to access or interact with the Platform.
1.1.6. Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing Personal Data, as defined under applicable law.
1.1.7. Data Processor means a person who processes Personal Data on behalf of a Data Fiduciary, as defined under applicable law.
1.1.8. Healthcare Professional means a doctor, surgeon, dentist, healthcare practitioner or other person professionally engaged in providing healthcare services and authorised to use the Platform.
1.1.9. Information means Personal Data and other information provided, uploaded, entered, submitted, generated or otherwise processed in connection with the Platform, including account information, healthcare-related information, communications, records, documents, technical information and Usage Data.
1.1.10. Patient Data means Personal Data and other information relating to a patient or prospective patient that is processed through the Platform, including medical history, treatment or procedure information, prescriptions, medical or diagnostic records, reports, photographs, images, videos, communications, symptoms, concerns, barriers, modifiers, appointments, journey information and other healthcare-related information.
1.1.11. Personal Data means any data about an individual who is identifiable by or in relation to such data, as defined under applicable law.
1.1.12. Service Provider means any third-party entity or individual engaged by SutrOS to provide or support hosting, infrastructure, communications, security, authentication, artificial intelligence, transcription, OCR, technical support, maintenance or other Platform-related services.
1.1.13. Usage Data means information relating to access to, interaction with and technical operation of the Platform, including logs, IP address, Device information, access times, browser information, diagnostic information and other technical information generated in connection with the Platform.
1.1.14. You or User means any individual who accesses or uses the Platform, including a patient, Healthcare Professional, coordinator, receptionist, administrator, Customer representative or other authorised user.
1.2. INTERPRETATION
1.2.1. Words in the singular shall be interpreted to include the plural, and vice versa.
1.2.2. References to the words “include” or “including” shall be construed without limitation.
1.2.3. Headings and titles in this Policy are indicative and shall not be deemed part of the Policy or be taken into consideration in its interpretation or construction.
2. COLLECTION OF INFORMATION
2.1 Information You Provide: When you create an account, access or use the Platform, communicate with us or otherwise interact with the Platform, we may collect information such as your name, email address, telephone number, account credentials, professional details, organisation details and other information voluntarily provided by you. Where consent is required under applicable law, we may provide a separate privacy notice or consent mechanism at or before the point of collection, as applicable, setting out the relevant Personal Data being collected, the purpose of processing and the manner in which applicable consent may be withdrawn.
2.2 Information Provided by Customers or Organisations: Where you are an authorised User of a Customer or Organisation, the Customer may provide or make available Customer Data necessary to create or administer your account, assign your role and permissions, manage journeys or workflows and provide access to the relevant Platform features.
2.3 Patient and Healthcare Information: Depending on the nature of the Customer's use of the Platform, Patient Data may be entered, uploaded or otherwise made available by a patient, Healthcare Professional or authorised Customer or User. Such Patient Data may include:
a) medical history and relevant background information.
b) treatment, procedure or surgery-related information.
c) prescriptions and prescription-related records uploaded by Users.
d) medical, laboratory, diagnostic and other reports.
e) photographs, medical images, scans and videos.
f) symptoms, concerns, questions and other patient communications.
g) information regarding barriers, modifiers, journey stages, checkpoints and pending actions.
h) appointment and follow-up information.
i) consent-related records or communications.
j) other information relevant to the applicable healthcare journey.
2.4 Professional Data: For the purposes of this Policy, “Professional Data” means information relating to Healthcare Professionals and other professional or business contacts processed through the Platform, including names, contact details, professional designation, specialty, organisation, professional interactions, engagement history, training or educational participation, event participation and other information relating to professional relationships.
2.5 Enterprise Data: For the purposes of this Policy, "Enterprise Data" means information processed through the Platform in connection with an Organisation's business, customer, prospect, employee, distributor, channel partner, relationship management, product or service adoption, workflow or other enterprise activities.
2.6 Communications: The Platform may process communications exchanged between patients and authorised members of the relevant care team, as well as communications between authorised Users in connection with professional or enterprise journeys. Such communications may contain Personal Data, Patient Data, Professional Data, Enterprise Data or other Information.
2.7 Voice Inputs and Transcription: Where voice-input functionality is used, the Platform may process voice inputs and generate transcripts for the purpose of creating, updating or organising notes and other permitted Platform records. Where a Service Provider is used for transcription, the relevant Information may be processed by such Service Provider for the permitted purpose.
2.8 Documents, Images and Videos: Users may upload or capture documents, prescriptions, reports, photographs, images, scans or videos through the Platform. Such Information may be stored and associated with the relevant patient, case, journey or other applicable record.
2.9 Automatically Collected Information: When you access or use the Platform, certain Usage Data may be collected automatically, including IP address, Device information, browser and operating system information, access times, activity logs, diagnostic information, security information and other technical information necessary to operate, secure, maintain and improve the Platform.
2.10 Information from Third Parties: We may receive Information from a Customer, Organisation, authorised User or Service Provider where such Information is necessary to provide the Platform or related services, subject to applicable law and contractual arrangements.
3. HOW WE USE YOUR INFORMATION
We may use Information, including Customer Data, Patient Data, Professional Data and Enterprise Data, for the following purposes:
a) creating, administering and securing User accounts and managing User access.
b) providing, operating, maintaining and supporting the Platform.
c) managing and coordinating healthcare journeys, professional journeys, enterprise journeys and other structured workflows.
d) maintaining patient or case histories, timelines, records, journey status and workflow information.
e) facilitating communications between patients and authorised members of the relevant care team or between other authorised Users.
f) storing, organising and retrieving documents, reports, images, videos and other records.
g) providing voice transcription, OCR, document-processing and related functionality.
h) generating summaries, reminders, alerts, workflow information and other Platform outputs.
i) identifying Information that may correspond to predefined safety or red-flag parameters and making such Information available to designated Users for review.
j) supporting professional and enterprise activities, including healthcare-professional engagement, lead qualification, training and education, product or service adoption, relationship management, follow-ups, events, account management, analytics and workflow management.
k) maintaining audit trails and records of actions undertaken through the Platform.
l) providing customer support, technical support and service-related communications.
m) maintaining the security, integrity and functionality of the Platform.
n) preventing fraud, misuse, unauthorised access and other security incidents.
o) complying with applicable legal, regulatory and contractual obligations.
p) exercising, establishing or defending our legal rights.
q) deriving and using Anonymised Data from Customer Data and Patient Data to analyse, develop, test, maintain and improve the Platform, including the journey engine, barrier engine, workflows, analytics and AI-assisted features, subject to applicable law and contractual arrangements. Identifiable Customer Data or Patient Data shall not be used for model training or product improvement except where expressly permitted under the applicable agreement and applicable law.
4. AI, OCR, TRANSCRIPTION AND AUTOMATED PROCESSING
4.1. Certain features of the Platform may use artificial intelligence, machine-learning, natural-language processing, OCR, voice transcription and related technologies.
4.2. Such technologies may be used to assist with functions including extracting information from uploaded documents, transcribing voice inputs, organising information, generating summaries, identifying predefined terms or patterns, and supporting workflow-related functionality.
4.3. The Platform may identify or flag information that appears to correspond to predefined red-flag parameters and make such information available to relevant authorised Users for review.
4.4. Any alert, flag, summary or other output generated through the Platform is intended to assist with information and workflow management and does not constitute a diagnosis, prescription, treatment recommendation or clinical decision.
4.5. The Platform does not independently determine whether a patient has a medical condition or what treatment should be provided. Where a potential red flag or other clinically relevant matter is identified, the relevant Healthcare Professional or other authorised User remains responsible for reviewing the Information and determining the appropriate action.
4.6. AI-assisted outputs may be incomplete, inaccurate or unsuitable in particular circumstances. Users must independently review and assess such outputs before relying upon or acting on them.
4.7. Where third-party technology providers are used to provide AI, OCR or transcription functionality, relevant Information may be processed by those providers for the permitted purposes, subject to applicable contractual, confidentiality, security and data-protection requirements.
4.8. Where Customer Data or Patient Data is used to derive Anonymised Data for learning from data patterns or improving the Platform, including the journey engine, barrier engine, workflows, analytics and AI-assisted features, such processing shall be undertaken only after the relevant data has been appropriately anonymised or irreversibly de-identified in accordance with applicable law and SutrOS' applicable technical and organisational measures. Identifiable Customer Data or Patient Data shall not be used for model training or product improvement unless such use is expressly permitted under the agreement governing the Customer's use of the Platform and is otherwise permitted under applicable law.
5. ROLE-BASED ACCESS AND INTERNAL SHARING
5.1. The Platform is designed to enable different categories of authorised Users to access Customer Data and other Information according to their assigned roles and permissions.
5.2. Depending on the configuration of the Customer or Organisation, Patient Data may be accessible to authorised Healthcare Professionals, care coordinators, receptionists, administrators and other designated members of the relevant care team.
5.3. The Platform may consolidate patient communications and journey-related Information in a common interface so that authorised members of the relevant care team can access the Information necessary for their respective functions.
5.4. Users shall access and use Personal Data only to the extent permitted by their assigned role, permissions and applicable law.
5.5. Customers and Organisations are responsible for configuring and maintaining appropriate User roles and access permissions for their authorised personnel.
6. CUSTOMER DATA AND CUSTOMER RESPONSIBILITIES
6.1. Customers and authorised Users may upload, enter, submit, store and otherwise make Customer Data available through the Platform.
6.2. Where a Customer or Organisation provides or makes available Personal Data relating to patients, Healthcare Professionals, employees, contractors or other individuals, the Customer shall be responsible for ensuring that such Personal Data is collected, shared and processed in accordance with applicable law and that any required notice, consent, authorisation or other lawful basis has been obtained.
6.3. The Customer shall be responsible for ensuring that authorised Users have appropriate rights to access and process Customer Data made available through the Platform.
6.4. Customers and authorised Users are responsible for the accuracy, completeness and timely updating of Customer Data and other Information entered or uploaded by them.
6.5. Where SutrOS processes Personal Data on behalf of a Customer, SutrOS shall process such Personal Data as a Data Processor in accordance with the applicable contractual arrangement, the Customer's documented instructions and applicable law.
6.6. Depending on the nature and purpose of the relevant processing, SutrOS or the Customer shall act as the Data Fiduciary. Where the Customer determines the purpose and means of processing Personal Data and provides such Personal Data to SutrOS for processing on its behalf, the Customer shall act as the Data Fiduciary and SutrOS shall act as the Data Processor. Where SutrOS determines the purpose and means of processing, including for account administration, Platform security, support, billing, service administration or other purposes determined by SutrOS, SutrOS shall act as the Data Fiduciary in respect of such processing.
7. SHARING AND DISCLOSURE OF INFORMATION
We do not sell or rent Personal Data. We may disclose or provide access to Information where reasonably necessary for providing and operating the Platform, performing contractual obligations, protecting our rights, complying with applicable law or otherwise as permitted under applicable law.
7.1. Service Providers: We may share Information with Service Providers engaged by us for hosting, cloud infrastructure, security, authentication, technical support, communications, artificial intelligence, transcription, OCR, maintenance and other services necessary for the operation of the Platform. Such Service Providers shall process Information only for authorised purposes and subject to applicable contractual, confidentiality and security obligations.
7.2. Legal and Regulatory Requirements: We may disclose Information where required to comply with applicable law, regulations, court orders, legal processes or lawful requests from governmental, judicial or regulatory authorities, or where reasonably necessary to establish, exercise or defend our legal rights.
7.3. Business Transfers: In connection with a merger, acquisition, restructuring, financing, sale or transfer of all or part of our business or assets, Information may be transferred to the relevant successor, acquiring entity or other authorised party, subject to applicable law and appropriate confidentiality and data-protection requirements.
7.4. Protection of Rights and Safety: We may disclose Information where reasonably necessary to protect the rights, property, safety or security of SutrOS, its Users, Customers or other persons, or to investigate fraud, misuse, security incidents or other unlawful activity, subject to applicable law.
8. DATA STORAGE, SECURITY AND RETENTION
8.1. Personal Data and other Information may be stored and processed through SutrOS' systems and third-party hosting, cloud, AI, communication, transcription or other Service Providers engaged for the operation of the Platform. Such Personal Data and other Information may, where applicable, be stored or processed in India or outside India, subject to applicable law and any restrictions on cross-border transfer or processing prescribed from time to time.
8.2. We implement reasonable technical and organisational measures designed to protect Personal Data and other Information against unauthorised access, disclosure, alteration, loss, misuse or destruction, having regard to the nature of the Information and applicable legal requirements.
8.3. Depending on the nature of the Information and the systems used, such safeguards may include role-based access controls, authentication mechanisms, encryption, audit logging, security monitoring, secure transmission, backup and recovery measures, tenant-level access controls and other appropriate technical and organisational safeguards, to the extent implemented and maintained by SutrOS.
8.4. Access to Personal Data within SutrOS' systems is restricted, where appropriate, to personnel and Service Providers who require such access for authorised purposes and are subject to appropriate confidentiality and security obligations. The Platform may also maintain audit trails and activity logs recording actions undertaken by Users, including creation, modification, review, approval, closure or other activity associated with records and workflows.
8.5. We retain Personal Data and other Information only for as long as reasonably necessary for the purposes described in this Policy, the provision and administration of the Platform, compliance with applicable legal, regulatory and contractual obligations, dispute resolution, protection of legal rights and maintenance of necessary records. The applicable retention period may vary depending on the nature and purpose of the Information, including whether it constitutes Patient Data, Customer Data, communications, voice inputs or recordings, transcripts, uploaded documents, audit logs or other Platform records.
8.6. Where SutrOS processes Personal Data on behalf of a Customer as a Data Processor, the retention and deletion of Customer Data shall be undertaken in accordance with the Customer's documented instructions and the applicable contractual arrangement, subject to any legal, regulatory, security or other requirements requiring continued retention.
8.7. Upon expiry or termination of the applicable Customer relationship, Customer Data may, subject to the applicable agreement and applicable law, be returned to the Customer or deleted, as applicable. Sutros may retain Anonymised Data derived from such Customer Data where permitted under the applicable agreement and applicable law.
8.8. Where Information is no longer required and its retention is not otherwise required or permitted under applicable law or contract, we may delete, anonymise or securely dispose of such Information in accordance with our applicable data retention practices. SutrOS may maintain an internal Data Retention Schedule setting out applicable retention periods and deletion practices for different categories of Information, including Patient Data, communications, voice recordings or inputs, transcripts, uploaded documents, audit logs, backups and inactive accounts.
8.9. In the event of a Personal Data breach, SutrOS shall take reasonable steps to investigate, contain and mitigate the impact of the breach and undertake appropriate remedial measures. Where SutrOS acts as a Data Processor, SutrOS shall notify the relevant Customer or Data Fiduciary without undue delay and in accordance with the applicable contractual arrangement and applicable law. Where SutrOS acts as a Data Fiduciary, SutrOS shall comply with the applicable statutory notification, reporting and other obligations arising from such breach.
9. COOKIES AND TECHNICAL INFORMATION
9.1. The Platform may use Cookies and similar technologies, where applicable, to enable essential functionality, maintain sessions, remember preferences, support security and understand the usage and performance of the Platform.
9.2. The Platform may process certain technical and Usage Data necessary for authentication, security, troubleshooting, performance and operation, including IP address, Device information, access logs and other technical information generated through use of the Platform.
9.3. Where required under applicable law, non-essential Cookies or similar technologies shall be used subject to an appropriate consent or preference mechanism, which may be presented through the Platform or otherwise at the relevant point of collection.
9.4. You may manage available Cookie preferences through your browser or Device settings, although disabling certain Cookies or similar technologies may affect the availability or functionality of certain Platform features.
10. DATA PROTECTION RIGHTS AND APPLICABLE LAWS
10.1. We shall process Personal Data in accordance with applicable data-protection and privacy laws, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, to the extent applicable and in force from time to time.
10.2. Subject to applicable law, a Data Principal may have rights in relation to Personal Data, including rights relating to access to information concerning processing, correction or updating of inaccurate Personal Data, erasure where permitted, withdrawal of consent where processing is based on consent, grievance redressal and such other rights as may be available under applicable law.
10.3. Requests relating to applicable data-protection rights may be submitted through the contact details provided in this Policy. We may take reasonable steps to verify the identity and authority of the person making such request and shall process the request in accordance with applicable law.
10.4. Where Personal Data is processed through the Platform on behalf of a Customer and the Customer acts as the Data Fiduciary, requests relating to such Personal Data may need to be directed to the relevant Customer. SutrOS may reasonably assist the Customer in responding to such requests, subject to applicable law and the relevant contractual arrangement.
10.5. Where SutrOS acts as the Data Fiduciary in respect of the relevant processing, applicable requests may be made directly to SutrOS through the contact details provided in this Policy.
10.6. Where we are required or permitted to retain Personal Data notwithstanding a request for deletion or other action, we may retain or continue processing such Personal Data to the extent required or permitted under applicable law.
10.7. Nothing in this Policy limits any rights or remedies available to a Data Principal under applicable law.
11. THIRD-PARTY SERVICES AND INTEGRATIONS
11.1. The Platform may rely on third-party Service Providers and technology providers for hosting, cloud infrastructure, communications, authentication, artificial intelligence, transcription, OCR, security, maintenance and other functions necessary for the operation, support and improvement of the Platform.
11.2. Where third parties process Personal Data on behalf of SutrOS, SutrOS shall seek to ensure that such processing is subject to appropriate contractual, confidentiality and security obligations, as required under applicable law.
11.3. Where you access an independent third-party website, application, service or integration through or in connection with the Platform, the processing of Personal Data by such third party may be governed by its own privacy policy and terms.
11.4. SutrOS shall not be responsible for the independent privacy practices of third parties operating their services independently of SutrOS.
12. CHILDREN'S PRIVACY
12.1. The Platform may be used in healthcare contexts involving patients of different age groups. Where Personal Data relating to a child is processed, such processing shall be undertaken in accordance with applicable law, including any requirement to obtain verifiable consent of the parent or lawful guardian, as applicable.
12.2. Where the Customer acts as the Data Fiduciary in relation to the Personal Data of a child, the Customer shall be responsible for obtaining and, where required under applicable law, verifying the consent of the parent or lawful guardian before such processing is undertaken. SutrOS, where acting as a Data Processor, shall process such Personal Data in accordance with the Customer's lawful instructions and applicable law.
12.3. Where SutrOS acts as the Data Fiduciary in relation to the Personal Data of a child, SutrOS shall obtain and, where required under applicable law, verify the consent of the parent or lawful guardian before processing such Personal Data and shall implement the applicable mechanisms and safeguards prescribed by law.
12.4. SutrOS and the relevant Customer, as applicable, shall not undertake processing of a child's Personal Data in a manner prohibited under applicable law, including processing likely to cause a detrimental effect on the well-being of the child or any other processing restricted by law.
12.5. If SutrOS becomes aware of processing of Personal Data relating to a child in circumstances not permitted under applicable law, it shall take reasonable steps to address such processing in accordance with applicable law.
13. CHANGES TO THIS POLICY
13.1. We may update or modify this Policy from time to time to reflect changes in the Platform, our data-processing practices, applicable legal requirements, technology or other operational developments.
13.2. The updated Policy shall be made available through the Platform or other appropriate channels and shall indicate the date of the latest update.
13.3. Where applicable law requires additional notice, communication or consent in relation to any material changes to this Policy or the manner in which Personal Data is processed, we shall take appropriate steps to provide such notice or obtain such consent, as applicable.
14. CONTACT AND GRIEVANCE REDRESSAL
14.1. For questions, concerns, requests or grievances relating to this Policy or the processing of Personal Data through the Platform, you may contact us at:
SutrOS Technologies LLP
Address: CGU 084, DLF Capital Greens, Karampura, New Delhi - 110015
Email: rm@sutros.care
Privacy / Grievance Contact: Sindhuja Asampalli
Phone: 9820757767
14.2. We shall endeavour to address privacy-related requests and grievances within the timelines prescribed under applicable law.
14.3. Where a grievance or request relates to Personal Data processed through the Platform on behalf of a Customer and the Customer acts as the Data Fiduciary, we may direct the relevant Data Principal to the Customer for resolution and may reasonably assist the Customer in addressing such request or grievance in accordance with applicable law and the relevant contractual arrangement. Where SutrOS acts as the Data Fiduciary in respect of the relevant processing, the Data Principal may contact SutrOS directly using the contact details provided in this Policy.
15. GOVERNING LAW AND JURISDICTION
15.1. This Policy shall be governed by and construed in accordance with the laws of India.
15.2. Subject to applicable law and any mandatory rights or remedies available to an individual, matters arising out of or in connection with this Policy shall be subject to the jurisdiction of the competent courts at New Delhi, India.