This Privacy Policy explains what information BME Cloud collects when hospitals and their staff use the Service, and how that information is used, shared, and protected. It applies to account holders and users within an organization ("you"), and is written with reference to India's Digital Personal Data Protection Act, 2023.
Account & organization information: your name, work email address, password (stored as a one-way hash, never in plain text), role, and your organization's name and, if provided, GSTIN.
Operational data you enter: equipment records (asset ID, serial number, manufacturer, location, department), maintenance and calibration schedules, breakdown tickets, AMC/CMC contracts, vendor and spare part records, gate passes, and equipment transfer history. This is asset and operations data about your facility, not patient medical records — see Section 8.
Billing data: invoices, subscription plan, and payment records (amount, status, and a transaction reference from our payment gateway). We do not store your card, UPI, or bank account details — those are handled directly by our payment gateway, Razorpay.
Usage & audit data: to maintain an audit trail of who changed what, we log actions taken in the Service together with the acting user, timestamp, IP address, and browser user agent. Sensitive fields such as passwords are redacted before being written to this log.
We do not sell personal data, and we do not use your organization's operational data for advertising.
We share data only as needed to operate the Service:
Within your own organization, data you enter is generally visible to other users in that organization according to their role. A super administrator may access organization data for support, billing, or security purposes.
We retain Customer Data for as long as your organization's account is active, and for a reasonable period afterward to allow account recovery, meet legal/accounting obligations (such as invoice records), and resolve disputes. Audit log entries are retained according to our data retention schedule and may be purged after that period. You may request deletion of your organization's data, subject to any records we are legally required to keep.
We apply reasonable technical and organizational measures to protect data, including password hashing, per-organization data isolation, role-based access control, and audit logging of changes to records. No system can be guaranteed 100% secure, and we encourage you to use strong, unique passwords and to promptly deactivate accounts for staff who leave your organization.
Subject to applicable law, you may request access to, correction of, or erasure of your personal data, or ask questions about how it is processed. Your organization administrator can update or remove most account and operational records directly within the Service; for anything else, contact us using the details in Section 10.
BME Cloud is designed to track biomedical equipment — asset registers, maintenance, and compliance records — not individual patients. Organizations should not enter patient names, medical record numbers, or other individually identifiable patient health information into the Service. If your organization needs to reference a patient in relation to an incident report, use a de-identified or internal case reference instead of directly identifying information wherever possible.
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate, we will notify organization administrators.
To exercise your rights or ask questions about this Policy, contact support@bmecloud.in or via our Contact page. A dedicated grievance officer contact will be published here once designated.