SwasthaHub — Privacy Policy
We collect only the information needed to book and manage your in-person care at Dipesh Health Care Clinic. We protect it with encryption and strict access controls, and we never sell it, rent it or use it for advertising. This Privacy Policy explains what we collect, why, who can see it, how long we keep it and how you control it.
Effective date
October 5, 2026
Last updated
October 5, 2026
Data controller
Dipesh Health Care Pvt. Ltd., Udaypur, Nepal
Apps covered
SwasthaHub (patients) and SwasthaHub Team (doctors and staff), Android and iOS
Phone
+977 985-1118621
General email
info@dipeshhealthcare.com.np
Privacy contact
dpo@dipeshhealthcare.com.np
1. Who We Are
1.1 SwasthaHub and SwasthaHub Team are owned and operated by Dipesh Health Care Pvt. Ltd. ("we", "us", "our"), a registered company that operates Dipesh Health Care Clinic, a licensed medical clinic in Udaypur, Nepal.
1.2 We are the data controller for personal data processed through the Apps. This means we decide how and why your data is used and are responsible for protecting it.
1.3 We have appointed a privacy contact (Data Protection Officer) who oversees this policy. You can reach them at dpo@dipeshhealthcare.com.np.
2. Scope of This Policy
2.1 This policy applies to personal data collected through:
- the SwasthaHub patient app;
- the SwasthaHub Team app for doctors and authorised staff;
- our web pages related to the Apps; and
- phone, email and in-person communication with us about the Apps.
2.2 It does not cover:
- paper records kept at the Clinic, which follow the Clinic's own record-keeping procedures; or
- third-party websites or services linked from the Apps, such as payment gateways, which have their own privacy policies.
3. Our Privacy Commitments
Commitment
What it means for you
No selling
We never sell, rent or trade your personal or health data to anyone.
No advertising
We show no third-party ads and never use your data for advertising or marketing profiles.
Minimum data
We collect only what is needed to provide the service.
Need-to-know access
Only Clinic staff involved in your care can see your health data, and every access is logged.
Encryption
Your data is encrypted in transit and at rest.
Your control
You can view, correct, export and delete your data at any time.
Transparency
We tell you clearly who processes your data and why.
4. Information We Collect from Patients (SwasthaHub)
4.1 Information you give us
Category
Data
Purpose
Required?
Identity
Full name, date of birth, gender
Create your account; identify you at the Clinic
Yes
Contact
Mobile number, email, address
Login (OTP), confirmations, reminders, refunds
Mobile number: yes. Email and address: optional
Health information
Medical history, allergies, current medicines, reason for visit
Help your doctor prepare for your in-person visit
Optional, but helps your care
Uploaded documents
Lab reports, prescriptions, scans and other files you choose to upload
Store your records in one place
Optional
Dependants
Name, date of birth, gender and relationship of family members you add
Book and manage their appointments
Only if you add dependants
Support messages
Messages, emails and call notes
Resolve your requests
Only if you contact us
Feedback
Ratings and comments
Improve our services
Optional
4.2 Information created when you use the service
Category
Data
Purpose
Appointment records
Appointment ID, doctor, department, date, time, status, cancellation and reschedule history
Manage your bookings
Clinical records
Consultation notes, diagnoses, prescriptions and reports added by Clinic staff after your in-person visit
Your care and your own reference
Payment records
Transaction ID, amount, date, payment method type, status, refund status
Confirm bookings, issue receipts, process refunds
4.3 Information collected automatically
Category
Data
Purpose
Device information
Device model, operating system, app version, language
Compatibility and troubleshooting
Log and security data
IP address, login times, failed login attempts
Protect your account and detect fraud
Crash and performance data
Crash reports and diagnostic logs, without health data
Fix bugs and keep the app stable
Notification token
A device token for push notifications
Send reminders and updates
Location (optional)
Approximate or precise location, only when you allow it
Show directions to the Clinic
4.4 Information we do not collect
We do not collect:
- your contacts, call logs or SMS messages;
- your browsing history or activity in other apps;
- advertising identifiers for tracking;
- your full card number, CVV, wallet PIN or bank password; or
- biometric data. If you enable fingerprint or Face ID login, verification happens on your device and we never receive your biometric information.
5. Information We Collect from Doctors and Staff (SwasthaHub Team)
Category
Data
Purpose
Professional profile
Name, photo, role, department, qualifications, council registration number
Create the account; show doctor profiles to patients
Contact
Work phone and email
Login and Clinic communication
Schedule
Working hours, availability and leave
Show bookable slots to patients
Activity and audit logs
Logins, records viewed, edits and exports, with date and time
Security, confidentiality and accountability
Clinical entries
Notes and prescriptions entered after in-person visits
Patient care; these become part of the patient's record
Device data
Device model, OS, app version, notification token
Security and notifications
A doctor's name, photo, qualifications, speciality and availability are shown to patients in the SwasthaHub app. Other Team data is visible only to the Clinic administration.
6. App Permissions
We ask for each permission only when you first use the related feature. You can change permissions at any time in your phone's settings.
Permission
App
Why we ask
If you refuse
Notifications
Both
Appointment confirmations, reminders, refunds and schedule updates
You can still see updates inside the app
Camera
Both
Photograph a report or document to upload
You can pick a file from your phone instead
Photos / files / storage
Both
Upload reports or save downloaded records
Upload and download will not be available
Location
SwasthaHub
Show directions to the Clinic
Directions will not be shown; booking still works
Biometric login
Both
Optional quick, secure login on your device
Use password or OTP instead
Internet
Both
Connect to our secure servers
The app cannot work offline
We do not use the microphone and do not access the camera or location in the background.
7. How We Use Your Information
We use personal data only for the purposes below:
- Account management: create and maintain your account, verify your identity and provide login security.
- Appointments: show availability, book, confirm, reschedule and cancel in-person visits.
- Care delivery: give your treating doctor and authorised staff the information they need to care for you in person.
- Records: let you view, store, download and share your own health records.
- Communication: send OTPs, confirmations, reminders, delays, cancellations and refund updates.
- Payments: process payments, issue receipts and handle refunds.
- Support: respond to questions, complaints and requests.
- Safety and security: detect, prevent and investigate fraud, misuse and unauthorised access.
- Improvement: analyse aggregated, de-identified usage to improve the Apps. Health data is never used for this.
- Legal compliance: meet obligations under Nepali law, including health, tax and record-keeping requirements.
We do not:
- sell or rent your data;
- use your data for advertising or marketing profiles;
- make automated decisions about you that have legal or similarly significant effects; or
- use your health data for research without your separate, explicit consent.
8. Legal Basis for Processing
We process your data on one or more of these bases:
Basis
Examples
Your consent
Registration; uploading documents; optional location access; promotional messages. You can withdraw consent at any time.
Providing the service you request
Booking appointments; sharing your record with your treating doctor; processing payments
Legal obligation
Keeping clinical and financial records; responding to lawful requests from authorities
Legitimate interest
Securing the Apps; preventing fraud; improving reliability, balanced against your rights
We follow the laws of Nepal, including:
- the Constitution of Nepal, Article 28 (right to privacy);
- the Individual Privacy Act, 2075 (2018) and its Regulations;
- the Public Health Service Act, 2075 (2018);
- the Electronic Transactions Act, 2063 (2008); and
- applicable Nepal Medical Council codes of ethics on patient confidentiality.
9. Who Can See Your Information
9.1 We never sell, rent or trade your personal or health data. We never share it with advertisers, data brokers, insurers, employers, pharmaceutical companies or marketing agencies.
9.2 We disclose data only in the limited cases below:
Recipient
Data they receive
Why
Safeguards
Your treating doctor and authorised Clinic staff
The records needed for your care
To treat you in person
Role-based access; every access logged and audited
Cloud hosting provider
Encrypted data stored on its servers
To host the Apps and store data securely
Contract binding them to act only on our instructions; encryption
SMS and email delivery providers
Phone number or email and message text
To send OTPs, confirmations and reminders
Messages contain no detailed clinical information
Push notification service (e.g. Firebase Cloud Messaging, Apple Push Notification service)
Device token and notification text
To deliver in-app notifications
Notifications contain no detailed clinical information
Payment providers (e.g. Khalti, connectIPS, banks)
Amount, transaction reference, and the details you enter on their secure page
To process payments and refunds
Licensed by Nepal Rastra Bank; we do not see your PIN or password
Crash reporting service
Technical crash data without health information
To fix app errors
De-identified data only
Government, courts or regulators
Only what the law specifically requires
Legal obligation, court order or mandatory public health reporting
We disclose the minimum required and record each request
9.3 Service providers. Every provider that processes data for us is bound by a written agreement to keep it confidential, use it only to provide its service to us, apply appropriate security, and delete or return it when the service ends. They may not use your data for their own purposes.
9.4 Sharing at your request. If you ask us to send your records to another doctor, hospital, insurer or person, we will do so only with your written consent, for that specific purpose.
9.5 Family and dependants. The account holder can see records of dependants added to their account. Adult family members cannot see each other's records unless added as dependants with consent.
9.6 Business transfer. If Dipesh Health Care Pvt. Ltd. is merged, restructured or acquired, your data may transfer to the successor, which must continue to protect it under this policy. We will notify you in advance.
10. How We Protect Your Information
10.1 Technical safeguards:
- encryption in transit using TLS 1.2 or higher (HTTPS) for all communication between the Apps and our servers;
- encryption at rest (AES-256 or equivalent) for databases, health records and uploaded documents;
- secure login with OTP verification, with optional biometric unlock on your device;
- automatic session timeout after inactivity;
- secure, access-restricted servers with firewalls and intrusion monitoring;
- regular encrypted backups; and
- regular security updates and vulnerability testing.
10.2 Organisational safeguards:
- role-based access, so each staff member sees only what their role requires;
- logging and regular review of every record access and change;
- signed confidentiality agreements for all staff and service providers;
- privacy and security training for staff; and
- immediate removal of access when a staff member leaves.
10.3 What you can do. Keep your phone locked, never share your OTP, use the latest version of the app, and sign out on shared devices.
10.4 No method of transmission or storage is completely secure. We continually review and improve our protections.
11. Data Breach Response
If a security incident affects your personal data, we will:
- act immediately to contain it and secure our systems;
- investigate what happened and which data was affected;
- notify affected users without undue delay, explaining what happened, the likely impact and the steps we are taking;
- notify the relevant authorities where required by law; and
- take steps to prevent it from happening again.
12. Data Storage Location
12.1 Your data is stored on secure servers operated by our cloud hosting provider.
12.2 Where data is stored or processed outside Nepal, we ensure it is protected by contractual and technical safeguards that are at least equivalent to the protection described in this policy.
13. How Long We Keep Your Data
Data
Retention period
Account and profile data
While your account is active. Deleted within 14 days of a verified deletion request
Documents you uploaded yourself
While your account is active. Deleted within 14 days of a verified deletion request
Dependant profiles
While your account is active, or until you remove them
Clinical records created during in-person visits
For the period required by Nepali health regulations, then securely destroyed. After account deletion, removed from the Apps and kept only in restricted clinic archives
Payment and refund records
For the period required by Nepali tax and accounting law
Support communications
Up to 24 months after the request is closed
Security and audit logs
Up to 12 months, then deleted or anonymised
Backups
Overwritten on a rolling cycle of up to 30 days
Inactive accounts
After 3 years of no activity, we notify you and then delete the account if you do not respond within 30 days
Anonymised data that can no longer identify you may be kept for statistics.
14. Your Rights
You have the following rights over your personal data:
Right
What it means
How to use it
Access
Get a copy of the data we hold about you
In app: Profile → Privacy & Data, or email us
Correction
Fix inaccurate or incomplete data
In app: Profile → Edit Profile. Clinical corrections: ask your doctor or email us
Portability
Download your health records in a common format (PDF)
In app: Profile → Privacy & Data → Export My Records
Deletion
Delete your account and data
In app: Profile → Account Settings → Delete My Account, or see the Data Deletion Request Policy
Withdraw consent
Stop optional processing, such as location or promotional messages
Phone settings, or Profile → Notification Settings
Restriction and objection
Ask us to limit or stop certain processing
Email dpo@dipeshhealthcare.com.np
Complaint
Raise a concern with us or the authorities
Email dpo@dipeshhealthcare.com.np
14.1 We respond to requests within 7 working days. Complex requests may take up to 30 days, and we will tell you if so.
14.2 We may ask you to verify your identity before acting on a request, to protect your data.
14.3 Exercising your rights is free of charge.
15. Children's Privacy
15.1 The Apps are not intended for direct use by anyone under 18.
15.2 A parent or legal guardian may add a child as a dependant and manage the child's appointments and records. The guardian gives consent on the child's behalf.
15.3 We do not knowingly collect data directly from children. If we learn that a child under 18 has registered without guardian consent, we will delete the account promptly.
15.4 When a dependant turns 18, they may request their own account and the transfer of their records.
16. Cookies, Analytics and Tracking
16.1 The Apps do not use advertising cookies, advertising identifiers or cross-app tracking.
16.2 We use only essential technologies for:
- keeping you signed in securely;
- protecting against fraud and attacks; and
- crash reporting and performance monitoring.
16.3 Any usage analytics are aggregated and de-identified, and never include health data.
16.4 iOS: we do not track you across apps or websites owned by other companies, so the Apps do not request App Tracking Transparency permission.
17. Third-Party Links
The Apps may link to third-party services, such as payment gateways or map applications. When you leave the Apps, the third party's privacy policy applies. We are not responsible for their practices.
18. International Standards
We operate under Nepali law. We also design our privacy and security practices around recognised international principles, including those of the EU General Data Protection Regulation (GDPR) and the US HIPAA Security Rule, such as data minimisation, purpose limitation, encryption, access control and audit logging.
19. App Store Data Disclosures (Summary)
This summary matches our Google Play Data Safety section and Apple App Privacy details.
Question
SwasthaHub answer
Is data sold to third parties?
No
Is data used for advertising or tracking?
No
Is data encrypted in transit?
Yes
Can users request data deletion?
Yes, in app and by email or phone
Data types collected
Name, email, phone, address, date of birth, gender, health information, payment transaction info, photos and files (uploads only), approximate and precise location (optional), app activity, crash logs, device IDs
Data shared with third parties
Only with service providers processing on our behalf (hosting, messaging, notifications, payments), which app stores do not treat as sharing
Is collection optional?
Location, uploads, email and address are optional
Data linked to your identity
Contact info, health info, financial transaction info, user content
20. Promotional Communication
We send health camp, vaccination drive or clinic service announcements only if you opt in. You can opt out at any time in Profile → Notification Settings or by replying STOP to SMS, where supported. Opting out does not stop essential appointment messages.
21. Accuracy of Your Data
Please keep your details up to date. Accurate information helps your care and makes sure messages reach you.
22. Changes to This Policy
22.1 We may update this policy to reflect changes in law, our services or app store requirements.
22.2 We will notify you of material changes through the app, by email or by SMS before they take effect. Where required, we will ask for your consent again.
22.3 The "Last updated" date at the top shows the current version.
23. Complaints
If you have a concern about how we handle your data, contact our privacy contact first. We will acknowledge your complaint within 2 working days and aim to resolve it within 7 working days. If you are not satisfied, you may raise the matter with the relevant authority in Nepal.
24. Contact Us
Privacy contact (DPO)
dpo@dipeshhealthcare.com.np
General support
info@dipeshhealthcare.com.np
Phone
+977 985-1118621
Postal address
Dipesh Health Care Pvt. Ltd., Udaypur, Nepal
Support hours
Sunday to Friday, 9:00 AM – 5:00 PM (Nepal Time)
By using SwasthaHub or SwasthaHub Team, you confirm that you have read and understood this Privacy Policy.