Inaimed is a clinical coordination workspace operated by Forge IT Systems, Chennai, Tamil Nadu, India ("we", "us", "our"). This policy explains what personal data we process, why, on whose instructions, and what rights you have.
1. Scope of this policy
This policy covers the Inaimed web application at medflow.forgeitsystems.com, its installable progressive web app, and the backend services that support them (together, the "Service").
It applies to two groups of people whose data reaches the Service, and the distinction matters because our legal role is different for each:
- Users — the clinicians, nurses, administrators and support staff who hold an Inaimed account.
- Patients — the individuals whose care a clinic coordinates using the Service. Patients do not hold accounts and do not interact with the Service directly.
Where a clinic has signed a separate agreement or data processing addendum with us, that agreement prevails over this policy to the extent of any conflict.
2. Our role: Data Fiduciary and Data Processor
Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the organisation that determines the purpose and means of processing is the Data Fiduciary; an organisation that processes data on a Fiduciary's behalf is a Data Processor. We occupy both roles depending on the data:
| Data | Data Fiduciary | Our role |
|---|---|---|
| Patient records, clinical notes, messages, tasks and attachments entered into a clinic's workspace | The clinic, hospital or practice that operates the workspace | Data Processor, acting only on the clinic's instructions |
| User account data we collect to create and secure logins, and the operational logs we keep to run the Service | Forge IT Systems | Data Fiduciary |
This means that if you are a patient and want to see, correct or delete your records, the clinic treating you is the right place to start — it holds the relationship with you and the lawful basis for the data. We will support any such request a clinic passes to us, and you can also contact us directly using the details in section 11 and we will route your request.
3. What data we process
| Category | Examples | Where it comes from |
|---|---|---|
| Account and identity data | Full name, work email address, profession or role, hashed password, workspace memberships and role (owner, admin, member), invite codes | Provided by you at signup, or by your clinic administrator when they invite you |
| Patient data | Patient name, age, unique patient identifier, admission date, bed or ward, treating consultant, discipline, diagnosis, clinical summary, next action, contact phone number, archive status | Entered by clinic Users |
| Clinical coordination content | Channel and direct messages, patient-linked discussions, tasks and their status history, task conversations, personal to-dos, notes | Created by clinic Users in the course of using the Service |
| Uploads | Files and images attached to messages, tasks or patient records — which may include reports, scans and photographs | Uploaded by clinic Users |
| Technical and session data | Authentication tokens, IP address, browser and device type, timestamps, error diagnostics | Generated automatically when you use the Service |
| Notification data | Web push subscription endpoints and keys, notification preferences | Created when you enable notifications in your browser |
| Usage and activity data | Workspace activity feed entries and aggregate usage counts shown in the analytics dashboard (7, 30 and 90 day windows) | Derived from your use of the Service |
Patient data and clinical content will routinely include information about a person's health. We treat all of it as sensitive and restrict access accordingly, as described in section 8.
4. Why we process it
We process personal data only for the following purposes:
- Providing the Service — authenticating you, showing you your clinic's patients, channels and tasks, delivering messages and notifications, and storing the content you create.
- Keeping the Service secure — detecting and investigating unauthorised access, abuse or data loss, and maintaining audit records of changes made to clinical data.
- Supporting you — diagnosing faults you report and responding to your questions.
- Operating and improving the Service — understanding aggregate usage so we can fix what is slow or confusing. Where we can answer a question with aggregate or de-identified figures, we use those instead of identifiable data.
- Meeting legal obligations — responding to lawful requests and retaining records we are required to keep.
We do not sell personal data, rent it, share it with data brokers, use it for advertising or profiling, or use patient data or clinical content to train machine-learning models.
5. Lawful basis and consent
For User account data, where we act as Data Fiduciary, we process data on the basis of your consent given at signup and, for security and audit records, for the legitimate uses permitted under the DPDP Act and to perform our agreement with your clinic.
For patient data, where we act as Data Processor, the lawful basis is the clinic's. The clinic is responsible for obtaining any notice or consent the DPDP Act and applicable medical regulations require from its patients before entering their data into the Service, and for confirming that it is permitted to use a third-party coordination tool for that purpose. We rely on the clinic's instruction that it has done so.
6. What clinics are responsible for
Because the clinic is the Data Fiduciary for patient data, these responsibilities sit with the clinic and not with us:
- Giving patients the notice and obtaining the consent that applicable law requires.
- Deciding which staff receive accounts, what role each one holds, and removing access promptly when someone leaves. All members of a workspace can currently see all patients and channels within that workspace — so membership is the access control, and clinics should grant it accordingly.
- Keeping patient data accurate and up to date, and deciding what may be entered at all.
- Responding to requests from its patients to access, correct or erase their data.
- Handling its own notifiable breaches where these arise from the clinic's own use of the Service, with our assistance.
8. How we protect data
We maintain technical and organisational measures appropriate to the sensitivity of clinical data, including:
- Encryption in transit — all traffic between your device and our services is served over TLS.
- Authenticated, expiring sessions — access requires a signed token that expires and is renewed through a separate refresh token, so a stale token cannot be replayed indefinitely.
- Workspace isolation — every clinical record is scoped to a single workspace, and requests are validated against the workspace before data is returned or written.
- Role-based administration — member management, workspace settings and analytics are restricted to owners and administrators.
- Audit records — changes to clinical data are logged, so a record can be traced to the account that changed it.
- Password protection — passwords are stored only as salted hashes and are never recoverable by us or visible to your administrator.
No system is perfectly secure. If we become aware of a personal data breach we will notify the Data Protection Board of India and affected clinics as the DPDP Act requires, and give clinics the information they need to meet their own notification duties.
9. How long we keep data
We keep data for as long as a clinic's workspace is active, because the clinic — not us — decides how long its clinical records should be retained. Specifically:
- Patient data and clinical content is retained until the clinic deletes it or ends its agreement with us. Archiving a patient hides the record from everyday views; it does not delete it.
- Account data is retained while your account exists. Where you leave a workspace, your name may remain attached to messages, tasks and audit records you created, so that the clinical history stays intelligible.
- Operational and security logs are kept for as long as needed to investigate incidents and meet legal obligations.
On termination, we will return or delete a clinic's data as that clinic directs, and will delete our copies within a reasonable period afterwards, except where we are required by law to retain them. Clinics that need a committed retention or deletion schedule should agree one with us in writing.
10. Your rights
Subject to the conditions in the DPDP Act, you have the right to:
- Access — obtain a summary of the personal data we process about you and the processing activities involved.
- Correction and completion — have inaccurate or incomplete data corrected, completed or updated.
- Erasure — have your personal data erased where it is no longer needed for the purpose it was collected for and we are not required to retain it.
- Grievance redressal — raise a grievance with us about how we handle your data, and escalate to the Data Protection Board of India if you are not satisfied with our response.
- Nomination — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
To exercise any of these, write to us at the address in section 11. We will verify your identity before acting, and will respond within the period the DPDP Act prescribes. If your request concerns patient data held in a clinic's workspace, we will forward it to that clinic as the Data Fiduciary and tell you that we have done so.
11. Contact and grievance redressal
For any privacy question, data-subject request or grievance, contact our Grievance Officer at foundersoffice@forgeitsystems.com, or write to Forge IT Systems, Chennai, Tamil Nadu, India.
Please put "Privacy" or "Grievance" in the subject line so your message is routed correctly. If we cannot resolve your grievance, you may escalate it to the Data Protection Board of India.
13. Children's data
The Service is for healthcare professionals, and accounts may only be held by adults. We do not knowingly create accounts for anyone under 18.
Patient records entered by a clinic may relate to children. Where they do, the clinic as Data Fiduciary is responsible for obtaining verifiable consent from a parent or lawful guardian as the DPDP Act requires, and must not use the Service to track children or target them in any way.
14. Where data is processed
We aim to process and store clinical data on infrastructure located in India. Some service providers that support the Service — for example error diagnostics or email delivery — may process limited data outside India. Where that happens we rely on contractual protections with those providers and transfer only to countries not restricted by the Central Government under the DPDP Act.
Clinics with a data-localisation requirement should raise it with us before deployment so we can confirm in writing where their data will reside.
15. Changes to this policy
We may update this policy as the Service and the law develop. The "last updated" date at the top of this page always reflects the current version.
Where a change materially reduces your rights or materially changes how we use personal data, we will give notice to clinic administrators — by email or in the application — before it takes effect. Continuing to use the Service after a change takes effect means you accept the updated policy.