Privacy Policy

Last updated: 9 November 2026

This policy explains how TriSpark Innovate ("we", "us") collects, uses, protects and shares personal data through Tanavya, our clinic software at tanavya.online, and through this website.

1. Who is responsible for which data

  • Your account data (clinic owners, doctors and staff who sign up): we decide how it is used, and we are responsible for it.
  • Patient data that a clinic enters or receives in Tanavya: the clinic decides how it is used and is responsible for it. We process it only to provide the service to that clinic, on the clinic's instructions. Patients should contact their clinic first about their data. We will help the clinic answer.

2. What we collect

  • Account and clinic details: name, email address, mobile number, clinic name, address, specialty, GSTIN if given, and your password (stored only as a secure hash).
  • Patient records entered by clinics: for example name, phone, age, appointments, consultation notes, prescriptions, lab reports and documents.
  • Messages: WhatsApp messages sent and received through the clinic's own WhatsApp Business account connected to Tanavya.
  • Payments: plan, amount, invoice and payment reference. Card, UPI and bank details are entered on the payment gateway's own page (Razorpay or Cashfree) and are never stored by us.
  • Technical data: IP address, browser and device type, and timestamps of sign-ins and actions, kept for security and audit.
  • Contact enquiries: what you share when you call, WhatsApp or email us.

3. How we use it

  • To provide Tanavya: appointments, reminders, messaging, prescriptions, reports, billing and support.
  • To verify accounts, keep the service secure and prevent misuse.
  • To issue invoices and meet legal and tax obligations.
  • To tell you about changes to the service. We send marketing only if you agree, and you can opt out at any time.

Optional AI Mode. By default, automatic replies in Tanavya come from a rule-based engine that each clinic controls, and patient chats are not sent to any artificial-intelligence service. A clinic may choose to switch on AI Mode. When it is on, the text of patient WhatsApp messages, recent chat history and the clinic's own saved details (timings, address, doctors, fees and FAQs) are sent to our AI service provider, acting as our sub-processor, only to write a reply. Patient names, phone numbers and medical records are not sent. Messages about emergencies or medical questions are never sent to the AI service and always go to the clinic's staff. The clinic can switch AI Mode off at any time.

We do not sell personal data, and we do not use patient data for advertising.

4. Who we share it with

  • Infrastructure providers that host our servers and send our emails, under confidentiality and security obligations.
  • Payment gateways (Razorpay for Tanavya subscriptions; Cashfree when a clinic collects fees from its patients through its own account).
  • Meta (WhatsApp), only through the WhatsApp Business account that the clinic itself connects and controls.
  • Google, only when a clinic chooses to send patients a link to its own Google review page.
  • Authorities, when Indian law requires it.

5. How we protect it

  • Patient details, documents and messages are encrypted, with separate keys for each clinic.
  • Each clinic's data is kept separate from every other clinic's.
  • Access inside a clinic is limited by role. Only doctors can write prescriptions.
  • HTTPS everywhere, multi-factor sign-in for platform administrators, and audit logs of sensitive actions.

6. How long we keep it

We keep account and clinic data while the account is active. A clinic can export all its data at any time, free of charge. After an account is closed, we delete or anonymise its data within 90 days, except records we must keep longer by law (for example tax invoices). Security logs are kept for a limited period.

7. Your rights

Under Indian data protection law you may ask to access, correct or erase your personal data, withdraw consent, nominate another person to act for you, and raise a grievance. Write to us using the details below. Patients should first write to their clinic, which manages their records in Tanavya.

8. Cookies and advertising

Tanavya uses only essential cookies: a session cookie that keeps you signed in and a security token that protects forms. We do not use advertising cookies inside the app.

On this public website we may use Google Ads conversion measurement to learn whether our ads lead to sign-ups. Google may set cookies for this. You can control ad personalisation at Google Ad Settings. We never share patient data with Google Ads.

On the same public pages (and the sign-up page) we use the Meta Pixel and Meta Conversions API to measure our Facebook and Instagram ads and to show our ads to people who visited this website. Meta may set cookies for this. When you create an account we send Meta a one-way scrambled (hashed) copy of your email address, mobile number and city so it can match the sign-up to an ad. You can control this in your Facebook ad preferences. The Meta Pixel is never used inside the app, and we never share patient data with Meta for advertising.

9. Children

Tanavya accounts are for healthcare providers and their staff, not for children. Where a clinic records data of a minor patient, the clinic is responsible for obtaining a parent's or guardian's consent.

10. Grievance Officer

Pankaj Naruka, Grievance Officer
TriSpark Innovate
Aravali Colony, Jaipur Road, Alwar, Rajasthan 301001
Phone: +91 77330 06261

We acknowledge grievances within 72 hours and aim to resolve them within 30 days.

11. Changes to this policy

We will post any change on this page with a new date, and tell account holders by email about important changes.