What we hold, and what we do with it

Who we are, and whose data this is

Two different relationships, and the difference decides everything below.

1. Ygeia is clinic software made by CbyZero, a sole proprietorship registered in India.
2. Our customer is the clinic. The clinic decides what to record about its patients and why; under the Digital Personal Data Protection Act, 2023 the clinic is the Data Fiduciary and Ygeia is the Data Processor acting on its instructions.
3. That is why a patient asking us to see, correct or delete their record is directed to their clinic. We hold the data on the clinic's behalf and we do not decide what happens to it.
4. We also hold ordinary account data about clinic staff — name, email, role — because somebody has to be able to sign in.

What the software holds

Everything a clinic records in it, which is most of a medical record.

1. Patient identity and contact details: name, date of birth, phone, email and preferred language.
2. Clinical content: visit notes, prescriptions, lab orders, referrals, vitals, conditions and allergies, and uploaded documents such as reports and scans.
3. Billing: invoices, payments and receipts.
4. Voice recordings, where a clinician uses the scribe and the patient has given consent for that specific recording.
5. An audit trail of who opened which patient record, and of every document handed out of the clinic. Those rows name the patient by internal identifier and never carry the patient's name or any clinical text.

Where it is processed

India, and the exceptions are named rather than implied.

1. The application, the database and the file storage all run in Google Cloud's Mumbai region (asia-south1).
2. Speech-to-text runs on Sarvam AI, in India.
3. Note generation runs on Google Gemini through Vertex AI in asia-south1, in India.
4. Email is sent through SendGrid, which is operated outside India. What leaves the country is the recipient's address and the message itself — which is why those messages carry no clinical detail and no amount.
5. Mobile notifications go through Firebase Cloud Messaging. The payload is an identifier and nothing else: no name, no clinic, not even the type of event. The phone fetches the message over the ordinary authenticated connection and composes the sentence itself.
6. WhatsApp messages go through Meta, which is operated outside India. What leaves the country is the patient’s phone number and the message — and where a clinic sends a document, the document itself, which is a clinical record rather than a bare notification. It is uploaded to Meta for delivery and is not sent as a link, so no address exists that would open that record for anybody holding it.
7. No clinic can use WhatsApp yet. The channel is built and has been tested to a real number, and it is named here because it has carried real data rather than because a clinic can switch it on.

The app tells each clinic, in its own Settings, exactly which step runs where and whether it is inside India. If a provider is ever changed, that screen changes with it — and so does this page.

How long it is kept

Clinical records are kept; recordings expire; the clinic sets the rest.

1. Voice recordings are deleted automatically. The default is 30 days from the note being signed, the clinic may set anything from 1 to 180 days, and the number the patient was told is the number that applies. The transcript and the note survive; the audio does not.
2. Uploaded documents are kept indefinitely unless the clinic sets a retention window, and a window cannot be shorter than three years — the Indian Medical Council (Professional Conduct) Regulations, 2002 require that much.
3. The audit trail is not swept, because 'prove nobody read this before it was deleted' is a question asked after the record has gone.
4. If a clinic stops using Ygeia, its data is not deleted automatically. Ask us and we will tell you what we hold and agree what happens to it.

Who can see it

The clinic's own staff, by role — and a deliberately small number of us.

1. Every record belongs to exactly one clinic, and no clinic can read another's. A request for a record outside your clinic is answered as if it does not exist.
2. Within a clinic, access follows role. The front desk cannot read clinical notes; a pharmacist sees the prescription being dispensed and the allergies that make dispensing safe, and no chart.
3. Our own operator console holds no patient-identifiable data at all — not by permission, but by having no endpoint that returns any. It is reachable only from an allowlisted address.
4. Engineers can reach the production database to operate the service. That access is not routine and is not used to read charts.

What we do not do

Shorter than the list of what we do, and more useful.

1. We do not sell data, share it with advertisers, or use it for advertising.
2. We do not train artificial-intelligence models on patient data.
3. We do not read charts to build products.
4. We do not put patient names or clinical text in application logs.
5. We do not send anything to a patient that they have not agreed to receive.

Security

What is configured, not what sounds reassuring.

1. Traffic is encrypted in transit, and the database refuses unencrypted connections.
2. Data at rest is encrypted by Google Cloud.
3. Signing in is handled by Firebase; the browser holds no long-lived credential, and a staff member who is deactivated loses access on their next request rather than when a token expires.
4. Backups are taken daily and retained for seven days.

We hold no security certification — no ISO 27001, no SOC 2. Saying otherwise would be the easiest sentence on this page to write and the least true.

Your rights, and how to use them

Through your clinic, because your clinic decides.

1. If you are a patient: ask your clinic to see, correct or delete what it holds about you. They can print your complete record from Ygeia in a few seconds, and they can correct it.
2. If your clinic needs help answering such a request, they can ask us and we will help them.
3. If you are a clinic and want to know what we hold, or want it removed, write to us.
4. We will not answer a request from a patient to delete a clinical record directly, because we are not the ones entitled to decide that — and because medical records are subject to retention rules that exist to protect the patient.

Contact

One address, read by a person.

1. Write to hello@ygeia.in.
2. Ygeia is made by CbyZero, a sole proprietorship registered in India.