Privacy Policy

This policy explains how CareLoop ("we," "us") handles data when a hospital ("client") uses CareLoop's WhatsApp-based patient feedback and grievance service, and when a patient interacts with CareLoop on behalf of that hospital.

1. Who controls the data

The hospital is the data controller for its patients' personal data. CareLoop acts as a data processor, sending messages and recording responses on the hospital's instruction. CareLoop does not decide why a patient is contacted — the hospital's discharge desk confirms consent before any patient is messaged.

2. What we collect

• Patient name, phone number, and discharge details entered by hospital staff
• Patient responses sent over WhatsApp (CSAT scores, complaint category, free-text messages)
• Timestamps for every message sent, delivered, and replied to
• Hospital staff phone numbers used for the discharge desk, grievance officer, and owner roles

3. Why we collect it

To send the CSAT question, route low scores to the grievance officer, send review invitations, and produce the monthly report described on our pricing page. We do not use patient data for any purpose the hospital has not instructed.

4. Consent

No patient is messaged unless hospital staff confirm consent at the point of discharge. A patient can opt out at any time by replying to any CareLoop message, and that opt-out is honoured immediately and permanently for that phone number.

5. Retention

Message logs and consent records are kept for as long as the hospital's contract with CareLoop is active, plus a reasonable period afterward to support audits, unless the hospital instructs deletion sooner and applicable law allows it.

6. Who we share data with

Data passes through WhatsApp Business Platform (Meta) as the messaging channel, and through our email provider for hospital staff support communications. We do not sell patient data, and we do not share it with any third party for marketing.

7. Security

Every event is written to an append-only log that cannot be edited or backdated, by hospital staff or by us. Access to hospital data is limited to what is needed to operate the service.

8. Your rights

Patients in India have rights under the Digital Personal Data Protection Act, 2023, including the right to access, correct, and request erasure of their personal data, and to withdraw consent. Requests should go to the hospital first, since the hospital is the data controller; write to info@careloop.app if you need help reaching them.

9. Changes to this policy

We'll update the date at the top of this page when this policy changes, and note material changes here.

10. Contact

Questions about this policy: info@careloop.app.