Privacy Policy
Last Updated: September 2026 • Registered in Tamil Nadu, India • DPDP Act 2023 & IT Act 2000 Compliant
1Introduction & Statutory Compliance Scope
Qamiroo is a proprietary clinical Enterprise Resource Planning (ERP) platform developed and operated by Zeenah ("Company", "we", "our", or "us"), having its registered office in Mayiladuthurai, Tamil Nadu, India (GSTIN: 33BPYPA2578H1ZL). We operate a specialized multi-tenant clinical ERP platform for audiology practices, hearing rehabilitation clinics, hearing aid dispensaries, and speech-language therapy centers (qamiroo.com).
Statutory Privacy Framework:
This Privacy Policy is formulated and enforced in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, Sections 43A and 72A of the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).
2Data Fiduciary vs. Data Processor Relationship
Your Clinic is the Data Fiduciary. Qamiroo is the Data Processor.
Under the DPDP Act 2023, the subscribing clinic organization acts as the Data Fiduciary (Data Controller) that determines the purpose and means of collecting patient medical, audiological, and financial records.
Qamiroo acts strictly as a Data Processor providing encrypted cloud software infrastructure. All patient records, Pure Tone Audiometry (PTA) charts, case histories, device prescriptions, speech therapy notes, and invoice data remain the exclusive property of the subscribing clinic.
3Categories of Personal & Clinical Data We Process
Clinic legal name, branch addresses, GSTIN, PAN, admin contact email, phone, and practitioner professional credentials (including RCI registration numbers).
Patient full name, age, date of birth, gender, contact number, residential address, sequential clinic identifier (NJ-MB-00001), and emergency contact.
Pure Tone Audiogram (PTA) thresholds (125 Hz – 8000 Hz, Air/Bone, Masking, UCL/MCL, SRT, SDS), Otoscopy images, Tympanometry curves, and case medical histories.
Hearing aid trial logs, ear-mould lab orders, device serial numbers, GST-compliant Bills of Supply, Tax Invoices, payment receipts, and appointment audit trails.
4Legal Bases & Purposes of Processing
We process personal and clinical data exclusively for legitimate operational purposes under the DPDP Act 2023:
- Provision of SaaS Services: To facilitate clinical record creation, PTA audiogram graphing, multi-branch appointment scheduling, and role-based staff workflows.
- Billing & Tax Compliance: To calculate statutory GST (18%), issue tax invoices, and maintain accounting ledgers required under Indian tax laws.
- System Security & Audit Logging: To detect unauthorized access, protect tenant data partitions, and enforce role-based access control (RBAC).
- Transactional Communications: To transmit staff invitations, password reset verification links, and critical platform notifications.
5Data Storage & Multi-Tenant Cryptographic Isolation
Every data entity stored within Qamiroo is strictly isolated using tenant scoping keys (companyId and branchId). Cross-tenant access is architecturally impossible at the database query layer.
All HTTP communications between your clinic browsers and our servers are encrypted using modern TLS 1.3 ciphers with HSTS enabled.
Relational databases, clinical attachments, letterheads, and audiogram chart snapshots are encrypted at rest using industry-standard AES-256.
6Third-Party Sub-Processors & Infrastructure
To deliver high-availability cloud infrastructure, Qamiroo utilizes enterprise-grade sub-processors that maintain ISO 27001, SOC 2 Type II, and DPDP-aligned compliance:
| Sub-Processor | Role / Service | Data Handled | Security Standards |
|---|---|---|---|
| Razorpay Software Private Limited | Payment Gateway & Recurring Subscriptions | Tokenized payment tokens, B2B billing data | PCI-DSS Level 1, RBI Tokenization & e-Mandate Compliant |
| Vercel Inc. | Next.js Edge Compute & Hosting | Encrypted web traffic | SOC 2 Type II, ISO 27001 |
| Supabase / AWS | Managed PostgreSQL Database | Encrypted clinical & billing DB | SOC 2 Type II, HIPAA, AES-256 |
| Cloudflare Inc. | R2 Object Storage & CDN WAF | Encrypted files & audiogram media | ISO 27001, SOC 2, DDoS Shield |
| Resend Inc. | Transactional Email Delivery | Staff invitations & auth alerts | SOC 2 Compliant, TLS 1.3 |
Payment Gateway & Cardholder Data Protection (PCI-DSS):
All online transactions, card authorizations, UPI mandates, and net banking payments for Qamiroo subscriptions are processed directly through Razorpay Software Private Limited. Qamiroo and Zeenah do NOT store, process, or transmit raw credit/debit card numbers, CVVs, or bank PINs on our servers. All cardholder data is securely handled and tokenized in full compliance with PCI-DSS Level 1 standards and the Reserve Bank of India (RBI) Card-on-File Tokenization (CoFT) guidelines.
7Cookies & Zero Third-Party Tracking Policy
Zero Commercial Advertising Trackers:
Qamiroo uses strictly necessary session and authentication cookies (such as cross-subdomain authentication tokens) required to authenticate staff and secure clinic portals. We do NOT embed third-party advertising cookies, marketing pixels (e.g., Meta Pixel, Google Ads), or behavioural trackers. We NEVER sell or broker patient health data.
8Data Subject Rights, Retention & Deletion Protocols
In accordance with the DPDP Act 2023, clinic administrators and patients have statutory rights to:
- Right to Access: View all stored personal, audiological, and financial records via the clinic dashboard.
- Right to Correction & Rectification: Update or amend outdated clinical contact details or patient demographics.
- Right to Data Portability: Export complete patient files, audiogram charts, and tax invoices in standard CSV, JSON, and PDF formats.
- Right to Erasure upon Contract Termination: Following subscription termination, a 30-day export grace window is provided, after which inactive tenant data is permanently shredded from active production databases.
9Governing Law & Tamil Nadu Jurisdiction
Qamiroo is owned and operated by Zeenah, registered in Mayiladuthurai, Tamil Nadu, India. All data protection obligations and privacy claims are governed by the laws of India, with exclusive judicial jurisdiction vested in the competent courts of Tamil Nadu, India.
Data Protection Officer & Grievance Redressal
For any data privacy enquiries, DPDP Act subject requests, or grievance redressal, contact our designated Grievance Officer:
Entity Name: Zeenah (Operating Brand: Qamiroo)
Registered Address: Zeenah, Mayiladuthurai, Tamil Nadu, India
Designation: Data Protection & Grievance Officer, Qamiroo
Email: support@qamiroo.com
Response Time: All statutory privacy enquiries are acknowledged within 48 hours and resolved within 30 days under the DPDP Act 2023.