Privacy Policy
- We collect what is needed to run the software: your account and clinic details, the patient records your clinic enters, and security information such as device and IP address.
- Patient records belong to the clinic. We store and process them only to provide the Service.
- We never sell personal data and use no advertising or tracking cookies.
- Card, UPI and bank details are handled by Razorpay — we never see or store them.
- You can ask to access, correct or delete your data at info@brahmhomeo.com.
This summary is for convenience only. The full text below is what applies.
1. Who we are
Brahm RX is operated by Brahm InnerBrain Technologies Pvt. Ltd. ("we", "us", "our"), working with Brahm Homeopathy. This policy explains how we handle personal information when you use Brahm RX at https://rx.brahmhomeopathy.com or through our installable app.
It applies only to the Brahm RX Service. Other websites of Brahm Homeopathy have their own privacy policies.
2. Our role and the clinic's role
- Clinic and user accounts. For information about the clinics and people who sign up and use the Service, we decide how it is used and are responsible for it.
- Patient records. Information about patients is entered by clinics, who decide what is recorded and why. For that information the clinic is responsible to the patient, and we process it on the clinic's behalf to provide the Service. Patients should direct requests about their records to their clinic first (see section 10).
3. Information we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a one-way hash), role, language and theme preferences, optional two-factor authentication settings. | You, when you register or update your profile. |
| Clinic | Clinic name, contact email and phone, logo, plan, settings. | The clinic administrator. |
| Patient records | Patient name, age, sex, phone number, address; questions answered in the prescriber and the resulting remedy suggestions; medicine, potency, dose, notes, follow-up dates; fees and payments recorded by the clinic. | Clinic staff, while treating the patient. |
| Security and device | A device identifier stored in a cookie and in browser storage, browser and device type (user agent), IP address, approximate city derived from the IP address, sign-in times, list of trusted devices, and device-change count. | Collected automatically when you sign in and use the Service. |
| Activity | Audit records of important actions (for example creating, changing or deleting records) with the user, time, IP address and browser; number of searches used. | Collected automatically. |
| Billing | Plan purchased, invoice number, amount, taxes, payment status and the payment reference issued by Razorpay. Not card, UPI or bank account details. | You and Razorpay, when you buy or renew a plan. |
| Communications | Support tickets and messages you send us. | You. |
We do not intentionally collect more patient information than the clinic enters, and we do not ask for Aadhaar or other government identity numbers.
4. How we use information
- To provide the Service — run the prescriber, keep patient records, manage clinics, users and plans.
- To keep accounts secure — enforce the one-device policy, send sign-in verification codes and new-device alerts, detect misuse, and keep audit records.
- To bill you — process payments, issue invoices and meet tax and accounting obligations.
- To communicate — send service emails such as verification codes, password resets, security alerts and replies to support requests.
- To improve the Service — study how the prescriber is used (for example which questions are answered and how often no clear remedy is found) so we can improve questions and content. Where we do this across clinics we use aggregated information that does not identify patients.
- To meet legal obligations and to protect our rights and users.
We do not use patient records for advertising, and we do not sell personal data to anyone.
5. Cookies and browser storage
We use only what the Service needs to work. There are no advertising, analytics or third-party tracking cookies.
| Name | Type | Purpose |
|---|---|---|
| Session cookie | Cookie | Keeps you signed in. |
| XSRF-TOKEN | Cookie | Protects forms against cross-site request forgery. |
| brx_did | Cookie and browser storage | Identifies your device for the one-device security policy, so re-signing in on the same device is not counted as a new device. |
| brx_theme, brx_accent, brx_lang, brxExplain | Browser storage | Remember your theme, colour, language and "Samjhao" preference. |
The installable app stores copies of static files such as styles, scripts and images so it loads faster. It does not store pages containing patient or account information.
6. Who we share information with
We share information only as needed to run the Service:
- Razorpay — processes payments. Payment details you enter go directly to Razorpay under its own privacy policy.
- Email delivery provider — sends verification codes, alerts and other service emails.
- Hosting provider — stores the database and runs the Service.
- IP geolocation service — when you sign in, your IP address is sent to a third-party lookup service (ip-api.com) to find an approximate city for security alerts.
- Your clinic — clinic administrators can see the activity and records of their clinic's users.
- Legal requirements — where required by law, court order or a government authority, or to protect the safety of any person.
- Business transfer — if our business is reorganised, merged or sold, information may transfer to the new owner, who must keep protecting it under this policy.
Our staff access clinic or patient records only when needed to provide support, fix a problem, or meet a legal obligation.
7. How we protect information
- Connections to the Service are encrypted with HTTPS.
- Passwords are stored only as one-way hashes; we cannot see your password.
- Each clinic's data is separated so that one clinic cannot see another's records.
- Access inside a clinic is controlled by roles, and optional two-factor authentication is available.
- Sign-ins are limited to one active device, with verification and alerts for new devices.
- Important actions are recorded in audit logs.
No system is completely secure. If a breach affecting your personal data occurs, we will inform affected users and the authorities as required by law. Please help by keeping your password private and your devices secure.
8. How long we keep information
- Account, clinic and patient records — while the clinic's account is active.
- After an account is closed — on request we provide a copy of the clinic's records; the records are then deleted or anonymised within a reasonable period, unless we must keep them longer by law. Clinics may have their own legal duty to retain medical records and should keep their copy accordingly.
- Invoices and payment records — for as long as tax and accounting laws require.
- Security and audit logs — for as long as needed to protect accounts and investigate misuse.
9. Your rights
Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may:
- ask what personal data we hold about you and receive a copy;
- ask us to correct or complete inaccurate data (most profile details you can edit yourself);
- ask us to delete your data, where we are not required to keep it;
- withdraw consent you have given, which will not affect processing already carried out;
- nominate another person to exercise these rights in the event of your death or incapacity;
- raise a grievance with us, and if it is not resolved, with the Data Protection Board of India.
Email info@brahmhomeo.com from your registered email address. We may ask you to confirm your identity before acting on a request.
10. Information for patients
If your details were recorded by a clinic that uses Brahm RX, that clinic decides what is recorded and is responsible for your records. Please contact the clinic to see, correct or delete your information. If the clinic cannot help, you may write to us and we will pass your request to the clinic and assist where we can.
11. Children
The Service is for adults (18+) working in clinical practice; children may not create accounts. Clinics may record information about patients who are minors; the clinic is responsible for obtaining consent from a parent or guardian where the law requires it. If we learn that a child has created an account, we will delete it.
12. Where information is processed
Information is stored on our hosting provider's servers. Some service providers, such as the payment gateway, email provider or IP geolocation service, may process information on servers outside India. Where that happens we rely on those providers' safeguards and transfer information only as permitted by Indian law.
13. Changes to this policy
We may update this policy when the Service or the law changes. The current version is always on this page with its last-updated date. We will notify you in the app or by email before significant changes take effect.
14. Contact and Grievance Officer
For privacy questions, requests or complaints:
Grievance Officer
Brahm InnerBrain Technologies Pvt. Ltd.
Email: info@brahmhomeo.com
We aim to acknowledge grievances promptly and resolve them within the time required by law.