1. Purpose of this Policy
This Policy explains how ACROCAN HEALTHTECH PRIVATE LIMITED handles personal data when you use Acrocan. It is written to be read, not filed. If anything here is unclear, contact us using the details in section 22.
This Policy sits alongside the short notices we show you inside the product. Those notices are not decoration. Accepting our Terms is not consent to optional processing. Acknowledging this Policy is not a WhatsApp opt-in. A WhatsApp opt-in is not a Health Cloud sharing authorisation. A sharing authorisation is not an AI action confirmation. Each is asked for separately, at the point where it matters.
2. Who we are
ACROCAN HEALTHTECH PRIVATE LIMITED
CIN: U62011WB2025PTC283512
Registered office: BL-C, 4th FR, FL- 4A, 10, Agrasain Street, LP-104/8, Liluah, Uluberia - II, Howrah- 711204, West Bengal, India
Consumer, privacy and data requests: connect@acrocanhealthtech.com
Professional and institutional enquiries: info@acrocanhealthtech.com
We are responsible for the personal data described in this Policy.
3. Who this Policy covers
Website visitors; account holders and users of our services; healthcare professionals and partner organisations using Acrocan's provider workspaces; and people who contact us with a support request, a complaint or a privacy request.
4. What we handle
What we handle depends entirely on which features you use. A visitor who reads our website generates almost nothing. A user who books a test, stores the report and shares it with a doctor generates a great deal.
Account and profile: name, date of birth, gender where relevant to a service, address, city, and the profile details you choose to add.
Contact details: phone number, email, service or delivery address, and your communication preferences.
Authentication and security: account identifiers, verification state, session data, security events, device and activity data, and records of suspicious activity.
Service and booking information: the services you request, the provider you select, appointment and collection details, home-visit location, delivery details, and the context you choose to give - such as symptoms or the reason for a visit.
Health records: prescriptions, diagnostic reports, consultation documents, files you upload and other records held in Health Cloud.
Payment information: amount, status, gateway reference, refund reference and reconciliation data. We do not store your full card details - those are handled by the payment infrastructure.
Communications: support and grievance correspondence, service messages, and your channel preferences and consent records.
Technical data: IP address, device and browser type, operating system, app and site activity, security and error logs.
5. Where it comes from
Directly from you; from a provider involved in a service you requested (for example a laboratory issuing your report); from payment, authentication and communication providers; and from your use of the platform.
6. Why we handle it
To create and secure your account; to authenticate you; to coordinate consultations, appointments, home visits, diagnostics and pharmacy requests; to operate Health Cloud and authorised record sharing; to provide AI-assisted features; to process payments and refunds; to send service communications; to answer support requests and grievances; to detect and prevent fraud and abuse; to keep audit and security records; to meet legal obligations; and to improve the reliability and safety of the platform.
We do not collect health information because it might be useful later. Different services ask for different information, and we ask for what the service needs.
Where the law requires your consent for a particular purpose, we ask for it separately and you can withdraw it.
8. Health Cloud
Health Cloud stores and organises your health records. Records reach it in different ways - you upload them, a laboratory issues a report through a booking, a doctor issues a prescription through a consultation, or Acrocan or Acrocan AI generates a summary.
We keep track of where each record came from. Health Cloud distinguishes user uploads, doctor-issued records, laboratory-issued records, other provider documents, Acrocan-generated content and AI-generated summaries. A provider-issued record is never altered or overwritten by a summary.
What we do not do with Health Cloud. We do not clinically review, interpret or monitor your records. We do not use your health records for advertising. We do not sell them. We do not use them to train any third party's AI models. Access by our staff is role-based, restricted to what a task requires, and logged.
Sharing. Where sharing is supported, you choose what to share and with whom, and we show you the recipient, the selected records and the purpose before the share happens. You can revoke future access. Revoking access stops further access through that permission; it does not delete a copy a provider lawfully received and is entitled or required to retain.
Getting your records out. You can download records from Health Cloud. Export your records before you close your account - closing it removes your access to them.
9. Acrocan AI
We use AI-assisted services to organise information, summarise context, explain platform options, help you prepare questions, prepare platform actions for your confirmation, and support limited internal operational workflows.
We send an AI service only the information that the feature genuinely needs. Health-related content is processed only through production configurations and contractual terms approved for Acrocan's healthcare use.
No training of general-purpose models with Acrocan health content. Acrocan's production requirement is that personal health information, Health Cloud records, prescriptions, reports and health-related prompts are not used by an AI provider to train or improve that provider's general-purpose or public models. If a provider cannot support this requirement, Acrocan must not send health-related content to that provider.
Prompts and outputs. Acrocan may retain prompts, generated summaries and action history in its own systems only where needed to provide the feature, preserve the user's record or action history, investigate support or security issues, maintain audit evidence, or comply with law. Retention follows the purpose and category described in section 15.
Cross-border processing. An approved AI or cloud service may process data outside India where legally permitted. Where this occurs, Acrocan applies appropriate contractual and security safeguards and keeps the processing within the purpose presented to the user.
No autonomous clinical decision. Acrocan does not use AI output as a diagnosis, prescription, treatment decision or autonomous emergency assessment. Acrocan AI prepares an action; you review and confirm it; our systems then execute it.
10. Payments
We handle the transaction data needed to take payment, reconcile it and issue refunds: amount, status, gateway reference, refund reference and reconciliation state. Card and bank credentials are handled by the payment infrastructure, not stored by us as account data.
11. Communications and WhatsApp
We use email, SMS, push notifications, in-app notifications and - where you have opted in - WhatsApp.
Service messages are those needed to operate a service you requested: confirmations, reminders, status changes, payment and refund information, and actions needing your attention. These are part of the service.
Optional messages require a separate opt-in. Having your phone number is not permission to message you on WhatsApp. We record when and how you opted in, and you can withdraw it at any time from your communication preferences or by replying with the opt-out shown in the message.
We keep detailed diagnoses, prescriptions, results and symptoms out of external messages where a secure link into your authenticated Acrocan account will do the same job.
12. Service providers
We use processors for hosting, databases, authentication, security, payment processing, communications, customer support, analytics, AI processing and infrastructure monitoring. They receive only what their function requires, act on our instructions, and are bound by contractual confidentiality and security obligations.
13. Legal and safety disclosures
We disclose personal data where reasonably necessary to comply with the law, respond to valid legal process or a lawful authority, investigate fraud, protect users or systems, or establish, exercise or defend legal rights.
14. We do not sell your data
We do not sell your personal data. We do not sell or share health information for advertising, profiling or any purpose unconnected to the service you asked for.
If Acrocan is ever involved in a merger, acquisition or transfer of business, personal data may transfer as part of it. Your rights under this Policy travel with the data, and we will tell you if that happens.
15. How long we keep it
We retain information by purpose and category, not indefinitely. The public rule is simple: when information is no longer needed for the purpose for which it was collected and no legal, tax, security, audit, dispute or professional-record reason requires retention, we delete it or de-identify it.
Account and profile: while the account is active; after verified closure, ordinary profile data is removed or de-identified subject to justified retention exceptions.
Health Cloud records controlled by Acrocan: until you delete them or close your account, subject to legal holds and necessary retention. Verified deletion requests are ordinarily completed within 30 days.
Provider-issued records: Acrocan deletes its eligible copy; the issuing doctor, laboratory, clinic or pharmacy may retain its independent copy under its own obligations.
Booking and service records: retained for service delivery, support, complaints, fraud prevention, audit and applicable legal limitation periods; then deleted or de-identified.
Payment, invoice, refund and tax records: retained for the period required by applicable tax, accounting, payment and audit obligations.
Consent and policy-acceptance evidence: retained while the related processing or legal evidence remains relevant, plus the applicable limitation period.
Security and access logs: retained for the period required by applicable cybersecurity and security obligations and Acrocan's approved security schedule.
Grievance and dispute records: retained until resolution and for the applicable legal limitation period.
AI prompts/outputs stored by Acrocan: retained only while needed for the feature, user record/action history, support, safety, audit or legal obligations; then deleted or de-identified.
Protected backups may retain deleted information temporarily until the normal backup cycle expires. Backups are not used as an ordinary active source after deletion.
Our Data Deletion Instructions explain what happens when you ask us to delete information or close an account.
16. Security
We use technical and organisational measures appropriate to the sensitivity of health information: authentication and identity controls, role-based access with least privilege, encryption in transit and at rest, restricted administrative access, access and audit logging, monitoring, secure infrastructure, backups and resilience measures, vendor security controls and documented incident procedures.
No system is completely secure, and we do not claim otherwise.
If something goes wrong. Where we become aware of a personal data or security incident, we investigate and contain it, report it to the competent authority within the time the law requires, and notify affected users without undue delay where the incident is likely to affect them. We tell you what happened, what data was involved and what you can do.
17. Processing outside India
Some of our service providers may process information outside your state or outside India where the law permits it. Where that happens we apply the applicable transfer restrictions and contractual and security safeguards. The location of AI processing is stated in section 9.
19. Your choices and rights
Depending on the law that applies and the processing involved, you can:
- access information we hold about you;
- correct or update it;
- withdraw a consent you gave;
- change your communication preferences, including WhatsApp;
- revoke a Health Cloud sharing permission;
- download your Health Cloud records;
- request deletion of eligible information;
- close your account; and
- raise a grievance.
We may need to verify your identity before acting - more carefully for health records than for a preference change.
We acknowledge a verified privacy or data request promptly and ordinarily complete eligible requests within 30 days, unless applicable law requires a shorter period or a justified legal-retention issue requires more time. If more time is genuinely needed, we explain why.
Withdrawing consent does not make earlier processing unlawful, and it may mean we can no longer provide a feature that depended on it. We will tell you if that is the case before you withdraw.
20. Children
Acrocan accounts are for people aged 18 or over. We do not knowingly collect personal data from children. If we learn that we have, we delete it. Where data protection law requires verifiable parental consent for a feature we later offer, we will implement it before offering that feature.
21. Changes to this Policy
We may update this Policy as our services, technology, data practices or the law change. We publish a version number and effective date, keep previous versions available, and give appropriate notice of material changes. Where a new purpose requires fresh consent, updating this Policy is not a substitute for asking you.
22. Contact
Privacy, data deletion and consumer requests: connect@acrocanhealthtech.com
Grievance Officer: Aman Kumar Singh, Director
Address: ACROCAN HEALTHTECH PRIVATE LIMITED, BL-C, 4th FR, FL- 4A, 10, Agrasain Street, LP-104/8, Liluah, Uluberia - II, Howrah- 711204, West Bengal, India
Professional, provider and institutional enquiries: info@acrocanhealthtech.com
We publish the privacy and grievance contact required for the service and applicable law. If Acrocan is required to appoint a statutory Data Protection Officer in the future, we will publish the required details here.
You can also approach a consumer commission, the National Consumer Helpline, a data protection authority or another competent authority.
Contact Acrocan
ACROCAN HEALTHTECH PRIVATE LIMITED ยท CIN U62011WB2025PTC283512
Consumer, care and privacy
Business, providers and partnerships
Registered office: BL-C, 4th FR, FL- 4A, 10, Agrasain Street, LP-104/8, Liluah, Uluberia - II, Howrah- 711204, West Bengal, India