Privacy

This policy explains how Orbitas ("we") handles information when a clinic uses the Orbitas application and this website. Last updated: {date}.

Who controls the data

For patient records entered into Orbitas, the clinic is the data controller and Orbitas is the data processor. We process that data only to provide the service to the clinic and on the clinic's instructions.

What we collect

• Clinic account data — names, roles, contact details of clinic staff.
• Patient data entered by the clinic — demographics, clinical records, documents, billing.
• Website data — demo-request form submissions (name, clinic, phone, city, specialty, number of doctors, and an optional free-text note), and, if enabled, privacy-friendly analytics with no cross-site tracking.

How AI features use data

Patient data is provided to AI models as read-only context, kept separate from the model's instructions. AI output is always a draft for clinician review. The AI never issues a prescription and never finalises a note. Clinic data is not used to train third-party foundation models.

Data isolation and security

Each clinic's data is logically isolated from every other clinic's. Access is role-based, actions are audit-logged, and shared prescription links expire. Data is encrypted in transit and at rest.

Retention and export

Clinic and patient data is retained for as long as the clinic's account is active. A clinic can export its data at any time and can request deletion after the account is closed, subject to any legal retention requirements.

Sharing

We share data with sub-processors that host the service and deliver messages (for example, WhatsApp/SMS/email providers), strictly to provide the service. We do not sell personal data.

Your rights

Patients should contact their clinic to exercise rights over their records. Clinic staff can contact us at hello@orbitas.in for account-level requests.

Contact

Questions about this policy: hello@orbitas.in.