This policy explains what personal data HaanJi (HaanJi) handles, why we handle it, how long we keep it, and who to contact. It is written with India's Digital Personal Data Protection Act, 2023 (DPDP Act) in mind. We have kept it short and plain. It describes the practices we actually follow.
1. Two different roles
| Whose data | Our role | Who decides how it is used |
|---|---|---|
| Patients and callers who phone a clinic that uses HaanJi | We are a Data Processor. We process the data only on the clinic's behalf. | The clinic is the Data Fiduciary. |
| Clinics (our customers), people who book a demo with us, and visitors to this website | We are the Data Fiduciary. | HaanJi |
2. Patient and caller data (processed for the clinic)
What we process
- Caller's phone number and call time and duration.
- Call audio. This is converted to text in real time so HaanJi can understand the caller and reply.
- Call transcripts: the text of what the caller and HaanJi said.
- Appointment requests: patient name, phone number, preferred date and time, and the reason for the visit as the caller states it (for example "toothache").
HaanJi is designed not to ask for more than it needs. It does not ask for Aadhaar, payment card details or medical records. The reason for a visit can still be sensitive, so we treat all of this data as confidential.
Why we process it
- To answer the call, take the appointment request and pass it to the clinic's staff.
- To let the clinic review what was said, so staff can confirm appointments and fix mistakes.
- To fix problems and improve that clinic's setup, for example correcting a misheard clinic FAQ.
We do not sell this data, use it for advertising, contact patients for our own purposes, or use it to train AI models for other customers.
How long we keep it
| Data | How long |
|---|---|
| Live call audio | By default, used only while the call is in progress to convert speech to text. It is not stored as a recording afterwards. |
| Call recordings (only if the clinic asks us in writing to turn recording on) | Deleted automatically after 30 days. |
| Transcripts and appointment requests | Deleted automatically after 90 days, or sooner if the clinic asks. |
| Everything above, when a clinic stops using HaanJi | We export it to the clinic on request, then delete it within 30 days of the service ending. |
Copies in backups are overwritten on the same schedule.
Telling callers
At the start of every call, HaanJi says it is the clinic's AI assistant. As Data Fiduciary, the clinic is responsible for giving patients any notice required by law and for handling consent. This includes consent for children, which needs a parent or guardian. We give clinics suggested notice text on request.
Patients' rights
Under the DPDP Act, patients can ask for access to, correction of, or erasure of their personal data. Please send these requests to the clinic. If a patient contacts us directly, we pass the request to the clinic and help the clinic act on it quickly.
3. Service providers who help run HaanJi
To run the service, we use a small number of providers, each for one specific job:
- Telephony provider: receives the forwarded call.
- Speech-to-text, AI language model and text-to-speech providers: understand the caller and generate HaanJi's reply.
- Cloud hosting: runs our software and stores transcripts and appointment requests.
Some of these providers may process data outside India. The DPDP Act allows this, except to countries the Government of India restricts. Before a clinic goes live, we give it the current list of providers in writing. If we add or change a provider that handles patient data, we tell the clinic first. We choose providers that do not use our customers' data to train their public models, as far as their published terms allow.
4. Clinic, demo and website data (HaanJi as Data Fiduciary)
- Clinic contacts: doctor or manager name, clinic name and address, phone, WhatsApp, email, and the clinic information you give us to set up HaanJi. We use these to provide the service, support you and bill you.
- Payment records: amount, date, UPI reference or transaction ID. We keep these for as long as Indian tax and accounting laws require (generally up to 8 years). We never see or store your UPI PIN or card details. Payments are handled by your UPI app or bank, and later by Razorpay.
- Browser demo: the demo converts what you say or type into text and may save test appointment requests. Please don't enter real patient details in the demo. We delete demo data within 30 days.
- This website: it does not use analytics, advertising or tracking cookies. Our hosting and network provider (currently Cloudflare), and the font and style libraries it loads (Google Fonts, Tailwind CDN), may see your IP address and browser details as part of normal web traffic.
You can ask us at any time to see, correct or delete your personal data, or to withdraw consent. We do this unless the law requires us to keep it, for example payment records.
5. How we protect data
- Data is sent over encrypted connections (HTTPS/TLS).
- Access is limited to the founder. If we ever hire staff or contractors, they will get only the access their job needs and will be bound by confidentiality.
- Each clinic's data is kept separate and is used only for that clinic.
- If we become aware of a personal data breach, we will inform the affected clinic without undue delay and give it the details it needs to meet its own DPDP obligations, including notifying the Data Protection Board and patients where required.
6. Contact and grievances
For privacy questions or complaints, contact our Grievance Officer, HaanJi, on +91 91821 63868 or at mininglife7@gmail.com. We acknowledge within 48 hours and aim to resolve within 15 days. If you are not satisfied, you may approach the Data Protection Board of India once it is accepting complaints.
7. Changes
If we change this policy, we will update the date at the top. For changes that affect patient data, we will tell our clinics before the change takes effect.