Privacy Policy
Last updated: 1 July 2025
1. Information We Collect
We collect information you provide directly: account details (name, email, clinic name, medical registration number), clinical audio recordings submitted for transcription, and usage data. We also collect technical data including IP addresses, device identifiers, and browser information through cookies and similar technologies.
2. How We Use Your Information
Clinical data is processed solely to provide transcription and documentation services. We use account information to manage your subscription, provide support, and send service communications. Aggregated, de-identified data may be used to improve our AI models. We never sell personal or clinical data to third parties.
3. Data Storage and Security
All data is stored on servers located in India (AWS Mumbai region). Clinical data is encrypted at rest using AES-256 and in transit using TLS 1.3. Audio recordings are processed and deleted within 24 hours unless you explicitly choose to retain them. We follow SOC 2 principles and maintain rigorous security practices.
4. Patient Data
Relaya acts as a data processor for patient health information. You remain the data controller. We process patient data only on your instructions and in accordance with our Data Processing Agreement. Patient data is never used for marketing, advertising, or shared with unrelated third parties.
5. Data Retention
Account data is retained for the duration of your subscription plus 60 days. Clinical notes are retained as per your configured retention policy (default: indefinite, as required for medical records in India). Audio recordings are deleted within 24 hours of processing unless explicitly retained. You may request deletion of your account data at any time.
6. Your Rights
Under the Digital Personal Data Protection Act, 2023, you have the right to access, correct, and erase your personal data. You may export your data at any time through your account settings. To exercise these rights, contact us at privacy@relaya.one. We will respond within 30 days.
7. Third-Party Services
We use select third-party services for infrastructure (AWS), payment processing (Razorpay), and analytics (PostHog, self-hosted). All third-party processors are bound by data processing agreements and are prohibited from using your data for their own purposes. No clinical data is shared with AI model providers for training.
9. Changes to This Policy
We will notify you of material changes to this policy via email at least 14 days before they take effect. The latest version is always available at this URL.
10. Contact
Data Protection Officer: privacy@relaya.one
Relaya Health Technologies Pvt. Ltd.
Bangalore, Karnataka, India
Questions? Contact our DPO at privacy@relaya.one