Privacy Policy

1. Who this policy covers

F-Assist is a clinic workflow platform for preparing and printing Form F, maintaining a clinic register, recording scan results, and helping authorised clinic staff file completed records on the Gujarat Government PC&PNDT portal.

For patient information entered into a Form F, the clinic decides why and how that information is processed. The clinic is ordinarily the Data Fiduciary, and F-Assist processes that information on the clinic's behalf as a Data Processor. F-Assist separately acts as a Data Fiduciary for information needed to operate accounts, provide support, secure the Service, and meet our own legal obligations.

If you are a patient, this policy describes the technology used by your clinic. Your clinic's own privacy notice and legal duties also apply.

2. Information we process

Clinic and account information

• Login email, authentication identifiers, and login-session information.
• If Google sign-in is chosen, the basic account information Google provides for authentication.
• Clinic name, address, PC&PNDT registration number, district, taluka, doctors, registration numbers, portal codes, referrers, and form defaults.
• Support messages and information supplied when asking us for assistance.

Form F and patient information

• Patient name in English and Gujarati, age, mobile and telephone number, postal address, village, district, taluka, and location.
• Relationship and relative details, number and ages of living children, last menstrual period, and weeks of pregnancy.
• Referring doctor, performing doctor, indications, procedure details, scan date, result, result-conveyance details, declaration details, and thumb-impression details where used.
• Register number, form status, print and upload timestamps, and the Government Form-F number returned after portal filing.

Device and temporary browser information

F-Assist uses browser storage for authentication sessions, returning from print preview, and remembering a dismissed reminder. The browser extension temporarily holds forms waiting to be filed in Chrome session storage. That queue is cleared when the browser session ends. We do not use advertising trackers, and we do not collect payment-card details.

3. How we use information

We process information only as reasonably needed to:

• authenticate clinic users and keep each clinic's workspace separate;
• create, validate, save, print, correct, cancel, restore, and review Form F records;
• issue the clinic's register numbers and show workflow status;
• recall eligible details for a returning patient when clinic staff enter the same mobile number;
• generate Gujarati-script names, while allowing clinic staff to review and correct the result;
• pass a completed record to the browser extension for clinic-directed filing on the Government portal;
• record the Government Form-F number and reconcile filing counts;
• secure, maintain, troubleshoot, and improve the Service; and
• comply with applicable law and respond to lawful requests.

We do not use patient information to advertise, build marketing profiles, or sell data.

4. When information is shared

We disclose information only for the purposes described below:

• The clinic and its authorised users. Staff linked to the same hospital workspace can access that clinic's records according to their account access.
• Supabase. F-Assist uses Supabase for authentication and managed database hosting.
• Cloudflare and Google Input Tools. When online Gujarati transliteration is used, the English name is sent through an F-Assist Cloudflare Worker to Google Input Tools. No other Form F fields are included in that transliteration request. If the service is unavailable, F-Assist uses an offline fallback.
• Gujarat Government PC&PNDT portal. At the clinic's direction, the browser extension fills the official portal using the clinic's active portal session. F-Assist does not ask for or store the clinic's portal password.
• Authorities or advisers. We may preserve or disclose information where required by law, legal process, a competent authority, or to protect the security and legal rights of patients, clinics, F-Assist, or others.
• Business transition. If the Service is reorganised, transferred, or acquired, information may transfer subject to appropriate confidentiality and legal safeguards.

Infrastructure providers may process information in locations where they operate. We use contractual, technical, and organisational safeguards and follow any transfer restrictions applicable under Indian law.

5. Storage and retention

Clinic and Form F records are stored in F-Assist's managed cloud database while needed to provide the Service, follow the clinic's lawful instructions, resolve disputes, protect the Service, and comply with applicable law. Authentication information may also remain for the life of the clinic account.

Rule 9 of the Pre-Conception and Pre-Natal Diagnostic Techniques Rules, 1996 generally requires the clinic to preserve case-related records, forms, and reports for at least two years, and longer when legal proceedings are pending. Where records are maintained electronically, the clinic is responsible for preserving any authenticated printed copy and other records required by law.

Deletion or account closure does not remove the clinic's statutory record-keeping duties. Records may be retained or placed on legal hold where required. Backup or security copies may remain for a limited period after operational deletion.

6. How we protect information

F-Assist uses HTTPS/TLS in transit, authenticated access, per-hospital database row-level security, limited browser-extension permissions, and one-way hashing for the optional clinic admin passcode. We also limit the extension's portal access to the Gujarat Government PC&PNDT domain.

No service can guarantee absolute security. Clinics must protect account credentials, restrict access to authorised staff, sign out on shared devices, keep browsers and extensions updated, and promptly report suspected unauthorised access.

If a personal-data breach occurs, we will investigate, take reasonable containment steps, notify affected clinics, and provide notices to individuals or authorities where required by applicable law.

7. Your choices and rights

Patients

Patients should contact the clinic that created the Form F to request access, correction, completion, updating, erasure, or grievance redressal. The clinic will assess the request under applicable data-protection law and the PC&PNDT record-retention rules. A lawful retention requirement may prevent immediate erasure.

Clinic account users

Clinic users may update clinic and Form F information in the Service while the relevant workflow state permits it. For account access, correction, closure, or privacy questions, contact F-Assist using the details below.

Consent and statutory processing

Where processing relies on consent, the individual may withdraw consent through the clinic. Withdrawal does not affect processing already carried out and may not stop processing that is required or authorised by law. The clinic is responsible for providing patient notices and obtaining any consent or other authority required for its use of F-Assist.

8. Contact and grievances

For questions about F-Assist's handling of information, account privacy, or a security concern, contact:

For a patient medical record, contact the clinic shown on the Form F. We may need the clinic's help to verify and complete a patient request because F-Assist does not independently establish the patient's identity or treatment relationship.

9. Changes to this policy

We may update this policy when the Service, our providers, or applicable law changes. We will update the date at the top and provide reasonable notice to clinics if a change materially affects how information is handled.