1. Who we are
Sehat Nxt is operated by SEHATNXT Private Limited (GSTIN 08ABTCS8608R1Z2), referred to in this policy as "Sehat Nxt", "we", "us" or "our". You can reach us at support@sehatnxt.com or +91 96277 30711.
This policy is published under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), and, where they still apply, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). The DPDP Rules come into force in phases; we follow each obligation as it applies.
2. Scope
This policy covers the Sehat Nxt hospital management software ("HMS") available at www.sehatnxt.in and its apps, including the OPD queue, appointments, consultations and prescriptions, IPD, billing, laboratory, pharmacy, ABDM features, the multi-branch dashboard and the Nxt AI voice and chat assistant. It also covers this website and its demo-request form.
Our patient app and website at www.sehatnxt.com, where patients book visits and track their place in the queue, may have its own notice. Where it does not, this policy applies to it as well.
3. Our role: Data Fiduciary or Data Processor
Under the DPDP Act, the party that decides why and how personal data is processed is the Data Fiduciary. A party that processes data on its behalf is a Data Processor. Our role depends on whose data it is:
- Patient records entered by a hospital or clinic. The hospital or clinic decides what to record about its patients and why. For this data the hospital or clinic is generally the Data Fiduciary, and Sehat Nxt acts as its Data Processor. We process these records only to provide the HMS to that hospital, on its instructions and under our agreement with it.
- Staff and owner accounts, demo requests and website visitors. For the account details of doctors, owners and staff who use the HMS, for demo requests, and for data about visitors to this website, Sehat Nxt is the Data Fiduciary.
If you are a patient and want to see, correct or erase a record that a hospital keeps about you, please contact that hospital first, because it controls the record. If you contact us, we will pass your request to the hospital and help it respond.
4. Personal data we handle
Account data
Name, mobile number, e-mail address, role (such as doctor, owner, receptionist, nurse or coordinator), the hospitals and branches you belong to, and for doctors, professional details such as specialisation, medical registration number, consultation fees, schedule and signature. Passwords are stored only as one-way hashes. One-time passwords (OTPs) sent to your phone are used to verify you and are not shown in our logs.
Hospital data
Hospital or clinic name, branches, address, contact details, letterhead and logo, departments, wards and beds, price lists, staff lists and settings.
Patient records entered by the hospital
Patient name, age or date of birth, gender, mobile number, address, ABHA number or address where the hospital links one, visit and queue details, vital signs, symptoms, diagnoses, prescriptions, clinical notes, admission and discharge records, laboratory and radiology orders and reports, pharmacy dispensing, bills and payments, and documents the hospital uploads. Health data is sensitive, and we apply the safeguards in section 9 to it.
Demo-request data
When you ask for a demo on this website we collect your name, mobile number, e-mail address (optional), hospital or clinic name, city, role, facility size, your message and the page you sent the form from.
Usage and device data
Server logs of requests to our service, such as date and time, the action performed, the account that performed it, error details and technical data such as IP address and browser or app type. Some modules (laboratory, pharmacy, radiology, billing and Nxt AI) keep an activity history of who changed what and when.
Voice and text input for Nxt AI
When you use Nxt AI, your spoken audio is converted to text, your request and the information needed to answer it are sent to an AI model, and the reply may be converted back to speech. A short history of the conversation is kept for the current session so that follow-up questions work. Doctors may also choose to dictate notes or record consultations; recordings are kept in private storage and played back only through short-lived signed links, and only to doctors and owners.
5. Why we use personal data and on what basis
We use personal data only for clear, lawful purposes. Under the DPDP Act, processing is based either on consent or on a legitimate use listed in section 7 of the Act (for example, data a person has voluntarily provided for a specific purpose, compliance with law, or responding to a medical emergency).
| Purpose | Data used | Basis |
|---|---|---|
| Creating and securing staff accounts, signing in, OTP verification | Account data | Consent and voluntary provision for this purpose |
| Providing the HMS to a hospital: queue, consultations, IPD, billing, lab, pharmacy, reports | Hospital data, patient records | As the hospital's Data Processor, on its instructions; the hospital determines its own basis |
| Sending OTPs, queue updates and appointment messages | Mobile number, visit details | Consent or voluntary provision; on the hospital's instructions for patients |
| Answering Nxt AI requests | Voice and text input, related records | Consent of the user, and on the hospital's instructions for patient records |
| ABHA creation, linking and consented sharing through ABDM | Patient identity and health records | The patient's consent captured through the ABDM consent flow |
| Replying to demo requests and sales follow-up | Demo-request data | Consent given when submitting the form |
| Security, fraud prevention, troubleshooting and keeping logs | Usage and device data | Legitimate uses and compliance with law |
| Billing our subscription and keeping tax records | Hospital and account data | Contract and compliance with law |
We do not sell personal data. We do not use patient records for advertising, and we do not use them to build marketing profiles.
6. Consent and withdrawing consent
Where we rely on consent, we ask for it with a clear notice of the data and purpose, in plain language. You can withdraw consent at any time, as easily as you gave it, by writing to support@sehatnxt.com or, for staff accounts, by asking your hospital owner to remove your access. Withdrawal does not affect processing done before it, and we may keep data that a law requires us to keep. Once consent is withdrawn we stop the related processing and erase the data within a reasonable time, unless a law requires us to retain it.
For patient records, the hospital is responsible for giving patients notice and obtaining any consent the law requires. When a patient withdraws consent given to a hospital, the hospital decides what to do with its records and can use the deletion tools described in section 10.
7. Children's personal data
Our staff accounts and demo-request form are meant for adults only. Under the DPDP Act and Rules, personal data of a child (a person under 18) may be processed only with the verifiable consent of a parent or lawful guardian, subject to the exemptions in the Rules. We do not knowingly create accounts for children.
Hospitals and clinics record minors as patients. In that case the hospital, as Data Fiduciary, is responsible for obtaining the parent's or guardian's consent where required. The DPDP Rules give clinical establishments and healthcare professionals a limited exemption for processing a child's data to the extent needed to provide health services. We do not track, profile or show targeted advertising to children.
8. Who we share data with
We share personal data only with service providers that help us run Sehat Nxt (sub-processors), under contracts that limit their use of the data to providing their service to us, and only as much as each needs:
- Cloud hosting and storage: Supabase (database and file storage) and DigitalOcean (application servers). Our database and servers are hosted in India.
- Caching: a managed Redis service used for short-lived data such as sessions and cached reports.
- Speech and AI providers used by Nxt AI: speech-to-text, text-to-speech and AI language model providers. They receive the audio or text of a request and the information needed to answer it.
- SMS and messaging providers: to send OTPs, queue updates and appointment messages.
- Payment providers: to process payments where a hospital or patient pays online. We do not store full card details.
- Ayushman Bharat Digital Mission (ABDM) and the National Health Authority (NHA): only when a hospital starts ABHA creation or linking, or a health record is shared under a patient's consent through the ABDM consent flow.
We may also disclose data when a law, court order or government authority requires it, or to protect the safety of a person in an emergency. If our business is merged or transferred, data will move only under the same protections as this policy.
Some speech and AI providers may process data outside India. The DPDP Act allows transfers outside India except to countries the Government restricts by notification; we do not transfer data to any such country, and we limit what is sent to these providers to what a request needs.
9. Where data is stored and how we protect it
Our main database and application servers are hosted in India. We take reasonable security safeguards, as the DPDP Act and Rules require, including:
- Encryption of data in transit with HTTPS (TLS), and encryption at rest provided by our hosting providers.
- Role-based access: each staff member sees only what their role and hospital allow.
- Owner-only controls, with explicit confirmation, for exporting and deleting a hospital's records.
- Clinical documents kept in private storage and opened only through signed, time-limited or token-protected links, never from public addresses.
- Activity histories in sensitive modules, and logs to detect and investigate misuse.
- Backups, and contracts with sub-processors that require them to protect data.
More detail is on our Security page. No system is completely secure, but we work to prevent, detect and respond to unauthorised access.
10. How long we keep data, and deletion
We keep personal data only as long as it is needed for the purpose it was collected for, or as long as a law requires. In particular:
- Patient records are kept for as long as the hospital keeps them in the HMS. Hospitals have their own record-keeping duties under medical and other laws, and decide how long to keep records.
- Hospital owners control deletion. From Settings → Data & privacy, an owner can download all patient records as a ZIP file, delete all patient records, delete records from selected days, or set automatic deletion of records older than a chosen number of days or beyond a chosen number of latest patients. Deletion needs the owner's explicit confirmation. The hospital, its settings, staff, wards, price lists and stock are not deleted by these tools, and admitted patients are never deleted automatically.
- Staff accounts are kept while the account is active and for a reasonable time after it is closed.
- Demo requests are kept while we are in contact with you and for a reasonable time after, unless you ask us to delete them sooner.
- Logs are kept for at least one year, as the DPDP Rules require, and then deleted unless needed for an investigation or by law.
- Tax and billing records are kept for the periods required by tax laws.
When a hospital stops using Sehat Nxt, it can export its records first. We then delete or return the hospital's data as set out in our agreement with it, except where a law requires us to keep it. Deleted data may stay in backups for a limited time until those backups expire.
11. Your rights
Under the DPDP Act you have the right to:
- Access: a summary of the personal data we process about you, how we process it, and who we have shared it with.
- Correction and updating: correct inaccurate or misleading data, complete incomplete data, and update it.
- Erasure: ask us to erase data that is no longer needed for its purpose, unless a law requires us to keep it.
- Withdraw consent: at any time, where processing is based on consent.
- Grievance redressal: have your complaint handled by our grievance officer.
- Nominate: nominate another person to use your rights if you die or become unable to act.
To use these rights, write to support@sehatnxt.com from the e-mail or mobile number linked to your account, or give enough detail for us to identify you. We may need to verify your identity before acting. Staff can also correct most of their profile details in the app. For patient records, please contact the hospital that keeps them (see section 3).
The DPDP Act also places duties on you: to give accurate information, not to impersonate anyone, and not to file false or frivolous complaints.
12. Personal data breaches
If a personal data breach happens, we will act to contain it and reduce its impact. Where we are the Data Fiduciary, we will inform the Data Protection Board of India and each affected person without delay, as the DPDP Rules require, and send the Board a detailed report within 72 hours of becoming aware of the breach (or a longer time the Board allows). We will tell affected persons what happened, the likely consequences, what we are doing about it and what they can do to protect themselves. Where we act as a hospital's Data Processor, we will inform the hospital without delay and help it meet its own notification duties.
13. Grievance officer
For any question or complaint about how we handle personal data, contact our grievance officer, Sojal Solanki, at support@sehatnxt.com. We will acknowledge your complaint and respond within the time set by the DPDP Rules. If you are not satisfied with our response, you may complain to the Data Protection Board of India after using this grievance process.
14. Cookies and browser storage
The Sehat Nxt website and HMS do not use advertising cookies, analytics or tracking scripts, or third-party marketing pixels. We do not build advertising profiles.
The HMS uses your browser's local and session storage only for things it needs to work, such as:
- Your sign-in session token, so you stay signed in.
- Your e-mail address, if you choose to have it remembered on the sign-in page.
- Display preferences such as the selected hospital or branch, sidebar layout, theme and prescription mode.
- Unsaved drafts, so typed work is not lost if the page reloads, and a doctor's saved signature image on that device.
Signing out removes your session token. You can clear the rest through your browser settings, though some features may then need to be set up again. Please do not use the HMS on a shared device without signing out.
15. Changes to this policy
We may update this policy when our service or the law changes. The date at the top shows when it was last updated. For material changes we will give notice in the app or by e-mail before they take effect, and ask for fresh consent where the law requires.
16. Contact
SEHATNXT Private Limited, GSTIN 08ABTCS8608R1Z2. E-mail support@sehatnxt.com, phone +91 96277 30711. Grievance officer: Sojal Solanki, support@sehatnxt.com.