Privacy Policy

1. Who we are and what this policy covers

Koami Private Limited builds and supports healthcare enterprise software for hospitals, clinics, diagnostic centres and fertility units. This policy explains what we do with personal data across three surfaces: the koami.in website and its enquiry, demo and pricing forms; the Kōami product suite we license and host for healthcare organisations; and the mobile applications we distribute through Google Play, the Apple App Store and managed enterprise distribution.

We handle personal data in line with India's Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules framed under it, and the contractual commitments in our customer agreements. Where a customer is bound by additional obligations — NABH accreditation requirements, ABDM policies, or sector regulations outside India — the terms of the signed agreement with that customer apply alongside this policy.

2. Our two roles: processor and fiduciary

This distinction determines who controls your data and who you should approach about it, so it is worth reading carefully.

When we act as a data processor

Patient records, employee files, billing histories and clinical images inside a customer's Kōami system belong to that healthcare organisation. The hospital or clinic is the data fiduciary; it decides what is collected, who may see it, and how long it is kept. Kōami processes that data only on the customer's documented instructions — to run, support, back up and secure the system. We do not use it to train models, build profiles, or market anything, and we never sell it.

If you are a patient or an employee of a hospital that runs Kōami software, that hospital is your first point of contact for access, correction or deletion. We will support them in responding, but we cannot act on their records without their authorisation.

When we act as a data fiduciary

For data we collect for our own purposes — website visitors, demo requests, sales and support conversations, and administrative accounts on our portals — Kōami is the data fiduciary and is directly answerable to you. Sections 4 through 15 describe both situations and say which applies.

3. Products and applications covered

• Kōami Hospital (HMIS) — registration, OPD and IPD workflows, clinical records, billing and pharmacy operations.
• Kōami Workforce (HRMS) — employee records, attendance, rostering, payroll inputs and statutory documentation.
• Kōami Inventory — procurement, vendor management, stock, batch and expiry tracking across stores.
• Kōami Fertility — IVF cycle management, embryology records and treatment-linked consent artefacts.
• Kōami PACS — medical imaging storage, study distribution and reporting.
• Kōami Field Service — biomedical equipment servicing, maintenance schedules and engineer visit logs.

4. Information we collect

a. Website and enquiry data (we are the fiduciary)

• Details you submit through demo, contact, pricing or callback forms: name, work email, phone number, organisation, role, bed count or facility size, and anything you write in the message field.
• Technical data captured automatically: IP address, approximate region derived from it, browser and device type, pages viewed, time on page, and the referring source.

b. Administrative accounts (we are the fiduciary)

• Login identifiers, hashed credentials, multi-factor enrolment status, role assignments and session records for staff who administer a Kōami deployment or use our support portal.
• Support tickets, correspondence and call notes raised with our service desk.

c. Product telemetry (we are the fiduciary)

• Crash reports, error traces, performance timings, application version, operating system version and device model.
• Audit and access logs recording which account performed which action and when — required for clinical accountability and security investigations.

d. Customer-controlled data (we are the processor)

Depending on which modules a customer licenses, their Kōami system may hold patient identity and contact details, diagnoses, vitals, allergies, prescriptions, laboratory and radiology results, medical images, insurance and payer information, employee identity and employment records, attendance timestamps, payroll inputs, tax documentation, and vendor and procurement records. Kōami neither decides what goes into these fields nor accesses them except as described in Section 5.

5. How we use information

• Responding to you. Scheduling demos, preparing quotations, answering questions and following up on enquiries you initiated.
• Delivering the software. Provisioning environments, authenticating users, applying licence entitlements and keeping systems available.
• Support and troubleshooting. Our engineers access customer environments only when a ticket, incident or scheduled maintenance window requires it, under least-privilege access, and every such access is logged and reviewable by the customer.
• Stability and improvement. Diagnosing crashes, measuring performance and identifying defects using telemetry and aggregated usage patterns.
• Security. Detecting intrusion attempts, fraud and misuse, and investigating incidents.
• Legal and contractual obligations. Invoicing, tax records, statutory reporting and enforcing our agreements.

We do not sell personal data, and we do not share it with advertising networks or data brokers. We do not use customer clinical data to develop or train machine-learning models.

6. Legal basis for processing

• Consent — where you voluntarily submit a form, subscribe to updates, or grant an optional device permission.
• Performance of a contract — to deliver, host and support the software a customer has licensed.
• Legitimate uses recognised under law — including processing necessary for employment purposes on behalf of a customer, and for medical treatment or emergency response.
• Legal obligation — retention and disclosure that statute, regulation or a lawful order requires.

7. Mobile app permissions

Our mobile applications request permissions only where a feature needs them, and each can be declined or revoked in your device settings. Declining a permission disables the related feature and nothing else.

• Camera — scanning patient wristbands, barcodes on stock items, and capturing documents or equipment photographs.
• Photos and files — attaching reports, certificates or service evidence.
• Location — used only in Kōami Workforce and Kōami Field Service, only in the foreground, and only at the moment a user marks attendance or confirms an on-site service visit. We do not track location in the background or build movement histories.
• Notifications — critical result alerts, approval requests and task assignments.
• Biometric authentication— unlocking the app using your device's fingerprint or face sensor. The biometric itself stays in the device's secure hardware; it is never transmitted to us.
• Network access — required for the application to function.

8. Cookies and website analytics

Our website uses strictly necessary cookies to keep sessions working and preferences remembered, and analytics cookies to understand which pages are useful. Analytics data is aggregated and reported at the level of pages, sessions, regions and traffic sources — not individual identity. We do not run advertising or cross-site tracking cookies, and we do not build advertising profiles from site visits.

You can block or clear cookies in your browser settings at any time. Blocking necessary cookies may break form submission and login.

9. When we share information

• Within the customer's organisation — access inside a Kōami system is governed by roles the customer configures. We do not widen that access.
• Vetted service providers — hosting, communication gateways and diagnostics vendors listed in Section 10, each bound by written confidentiality and data protection terms and permitted to use data only to provide their service.
• When law requires it — in response to a valid order from a court, regulator or law enforcement authority. Where we are permitted to do so, we notify the affected customer before disclosing their data.
• Business transfer — if Kōami is involved in a merger, acquisition or asset sale, data may transfer to the successor entity, which remains bound by protections no weaker than those in this policy. Affected customers will be notified.

10. Sub-processors and third-party services

• Cloud hosting providers — infrastructure for application servers, databases and backups, provisioned in Indian regions.
• Google Firebase — push notification delivery and crash diagnostics.
• Google Play Services and Apple Push Notification service — platform integrity checks and notification transport.
• SMS and email gateways — one-time passwords, appointment reminders and system alerts.
• Google Analytics and Google Tag Manager — website measurement only; not deployed inside customer production environments.

Customers under an active agreement may request the current sub-processor list, including any planned additions, by writing to the address in Section 18.

11. How we protect information

• Encryption in transit using TLS, and encryption at rest for stored data and backups.
• Role-based access control with least-privilege defaults, and multi-factor authentication on administrative and support accounts.
• Immutable audit logging of record access and privileged actions, available to the customer.
• Separated development, staging and production environments, with no live clinical data used for testing.
• Scheduled backups with restoration testing, patch management, and periodic vulnerability assessment and penetration testing.
• Confidentiality undertakings and security training for every employee and contractor with system access.
• A documented incident response process. If a breach affects personal data we control, we notify the Data Protection Board of India and the affected individuals as the law requires; where the data belongs to a customer, we notify that customer without undue delay so they can meet their own obligations.

No system is immune to every risk. Keep your credentials confidential, enable multi-factor authentication, and tell us promptly if you suspect an account has been compromised.

12. Where data is stored

Personal data processed through our products and website is stored on servers located in India. A limited set of technical data — crash traces, push notification tokens and aggregated analytics — may be processed outside India by the providers named in Section 10, restricted to countries not barred by the Central Government and covered by contractual safeguards. Customers with data residency requirements beyond this may arrange them through their agreement with us.

13. How long we keep data

• Customer data in a live system — retained for the term of the agreement, under the retention rules the customer configures. Clinical, employment and procurement records carry statutory minimums that the customer is responsible for setting.
• After an agreement ends — the customer may export their data during an agreed transition window, after which we delete or return it per the agreement.
• Enquiry and demo data — kept for up to twenty-four months from the last interaction, unless you ask us to erase it sooner or a contract results.
• Support tickets and correspondence — up to thirty-six months, for service history and dispute resolution.
• Security and audit logs — typically twelve months, longer where an investigation or legal hold requires it.
• Billing and tax records — for the period Indian tax and company law prescribes.

14. Your rights

Where Kōami is the data fiduciary, you may:

• Ask for a summary of the personal data we hold about you and how it is processed.
• Have inaccurate or incomplete data corrected or updated.
• Request erasure of data we no longer need for a lawful or contractual purpose.
• Withdraw consent you previously gave, as easily as you gave it. Withdrawal applies going forward and does not undo lawful processing already carried out.
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Raise a grievance with us, and escalate to the Data Protection Board of India.

Exercising a right costs nothing and will not result in reduced service. Where Kōami is a processor, forward your request to the hospital or clinic holding your records — we will assist them in fulfilling it.

15. Account and data deletion requests

To delete an account or associated data, write to info@koami.in or call +91 94745 65506. Include the application or product name, the registered email or phone number, your organisation, and enough detail for us to verify your identity.

We acknowledge requests within seven working days and aim to complete them within thirty days. Two limits apply: records a hospital customer controls can only be deleted on that customer's instruction, and records that statute requires us to preserve are locked against further use rather than erased, then deleted once the retention period expires.

16. Children's data

Our website and applications are built for healthcare professionals and administrators, not for children, and we do not knowingly collect data directly from anyone under eighteen for our own purposes. Paediatric records do appear in customer clinical systems; there, the treating hospital is responsible for obtaining verifiable parental or guardian consent and for ensuring no tracking or targeted advertising is directed at a child. If you believe a child's data reached us outside that context, contact us and we will delete it.

17. Changes to this policy

The current version always lives at koami.in/legal/privacy with its effective date at the top. Minor clarifications take effect on publication. For changes that materially affect how we handle your data, we will give notice in advance through an in-app message, email or SMS to registered contacts, and through our customer success team for organisations under agreement.

18. Contact and grievance redressal

Our Grievance Officer handles questions about this policy, requests to exercise your rights, and complaints about how we processed your data.

We acknowledge every grievance within seven working days and target resolution within thirty days. If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

See also our Terms of Service.