Privacy Policy

1. Data Fiduciary & Overview

Toshiko Health Private Limited ("we", "us", or "our") acts as the Data Fiduciary for the personal and clinical health data collected through the OncoCare oncology platform (www.oncocare.tech). We are committed to safeguarding user confidentiality and complying with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and Ayushman Bharat Digital Mission (ABDM) standards.

2. Categories of Information We Collect

• Account & Contact Information: Name, phone number, email address, physical address, and user profile role (patient, caregiver, oncologist, or hospital admin).
• Clinical & Health Information: Cancer indication, staging, chemotherapy regimen, daily patient-reported outcome measures (PROMs), CTCAE toxicity grades, uploaded laboratory CBC reports, and DICOM radiology imaging summaries.
• ABDM Health Identifiers: Ayushman Bharat Health Account (ABHA ID), ABHA address, and electronic consent logs.
• Payment & Billing Data: Transaction amount, billing address, invoice number, and Zoho Payments transaction reference IDs. We do NOT store raw credit card numbers, debit card PINs, or CVV codes on our servers.

3. Payment Processing & Financial Security

Commercial transactions on our platform are processed securely by Zoho Payments, an authorized payment aggregator in India. Zoho Payments adheres to the highest industry standards, including:

• PCI-DSS Level 1 Compliance: Ensures sensitive cardholder data is securely tokenized and handled strictly within certified card-network vaults.
• End-to-End Encryption: All transaction requests utilize TLS 1.3 / 256-bit encryption.
• RBI Aggregator Norms: Compliance with Reserve Bank of India tokenization and two-factor authentication (2FA) mandates.

4. Purpose & Lawful Basis of Processing

We process personal and health data strictly for legitimate clinical and commercial purposes:

• To enable real-time remote chemotherapy symptom monitoring and emergency toxicity alerts for oncologists.
• To facilitate multi-disciplinary Tumor Board case reviews and evidence-based clinical consensus reports.
• To verify identity via OTP and authenticate authorized healthcare practitioners.
• To process subscription payments and generate statutory tax invoices in Indian Rupees (INR).
• To maintain compliance with the ICMR 2023 Ethical Guidelines for AI in Healthcare.

5. Patient Consent & ABDM Data Sharing

Personal health records are never shared without explicit electronic consent. Through the ABDM Consent Manager framework, patients maintain granular control to grant, view, or revoke clinical record access granted to specific oncologists or hospitals at any time.

6. Data Storage & Retention

All clinical and customer data is hosted in secure, isolated AWS cloud infrastructure located in compliance with Indian data sovereignty guidelines. Data is protected using AES-256 encryption at rest and strict role-based access control (RBAC). Data is retained only as long as necessary to fulfill healthcare continuity, clinical record retention mandates under the National Medical Commission regulations, and applicable tax laws.

7. Your Statutory Rights under DPDP Act, 2023

Under the DPDP Act, you have the right to:

• Access & Summary: Request a summary of personal data being processed.
• Correction & Erasure: Request correction of inaccurate information or deletion of non-essential personal data.
• Withdrawal of Consent: Withdraw previously granted consent for future non-statutory data processing.
• Grievance Redressal: Register complaints with our designated Grievance Officer or the Data Protection Board of India.

8. Statutory Grievance Redressal Officer

In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, the contact details of our Grievance Officer are: