The terms we work to.

1. Who is who

We, us, Aevantos means Aevantos, a sole proprietorship in Gujarat, India, which provides Swasthyaayu. The proprietor’s name and address are stated on each order and invoice we issue to you.

You means the organisation (clinic, pharmacy, laboratory, imaging centre or hospital) that creates a Swasthyaayu workspace, and the person who accepts these terms for it. By creating an account, or by using the service, you confirm you are authorised to bind that organisation.

Members are the people you give a login to. Patients are the people whose records you keep in the service.

For patient records, you decide why and how the data is used and we process it for you: you are the data fiduciary and we are your data processor under the Digital Personal Data Protection Act, 2023 and the rules made under it, as they come into force.

2. The service

Swasthyaayu is web and iPhone software for keeping an organisation’s operational records: patients, appointments, prescriptions, diagnostic orders and reports, inventory and billing. Access inside a workspace is limited by the role each member holds, and successful list reads and new records are written to an activity log with the acting member and role.

Each organisation plan, hospitals included, includes up to five user logins, the owner included.

What the service does not do, today:

• It does not use artificial intelligence. No model is called and no patient data is sent to a model provider.
• It does not connect to ABDM. An ABHA address can be recorded as typed, and nothing is exchanged with ABDM.
• It does not take payments. Billing records are kept by hand; there is no payment gateway.
• It does not share a patient’s record with another organisation unless that patient’s consent for the share has been recorded in the product.

Swasthyaayu is in early access. It is provided as it is, and features may be added, changed or removed. We will not remove a feature in a way that stops you reading your own records without telling you first.

3. Accounts and access

Sign-in is by password and a code from an authenticator app. Accounts are required to enrol an authenticator, and email is used to reset a password, never as a second factor. Authenticator secrets are stored encrypted and backup codes are stored hashed, so we cannot read or reissue them.

Keep logins personal. One login, one person. You are responsible for what is done under your members’ logins, and for removing a member’s access when they leave. An invitation you send expires after seven days.

A member can close their own account from the Security page. That ends their sign-in, removes their memberships and clears their name from the staff record. It does not delete clinical or activity-log records, which stay with the organisation (see section 6).

4. Your responsibilities

• You have the right to collect and enter the patient information you put in, and you give patients any notice and obtain any consent that the law requires of you.
• You keep records accurate and use the roles to give each member only the access their work needs.
• You keep your own legal and professional registrations, and meet the retention and record-keeping rules that apply to you.
• You do not misuse the service: no attempts to reach another organisation’s data, to break or overload it, or to use it for anything unlawful.
• You tell us promptly at the address in section 12 if you suspect a login has been compromised.

5. No medical advice

Swasthyaayu is record-keeping and coordination software. It does not diagnose, prescribe, choose a drug or dose, triage or advise on treatment, and nothing it shows is a clinical recommendation. Every clinical decision is made by the practitioner, who remains responsible for it. It is not a route to emergency help.

6. Patient data: what, where, who, how long

What is collected.

• Account data: email address, display name, sign-in and second-factor state, organisation membership and role.
• What your members enter about patients: demographics, appointments, prescriptions, diagnostic orders and reports, inventory and billing records, and an ABHA address if you type one.
• The activity log: who did what, in which role, to which record. It does not copy the clinical content that was returned.
• Invoice branding files you upload, such as a logo.
• Enquiries sent through the website: name, email, organisation, phone, city and message, with the IP address, browser and referring page of the request.
• Page-view analytics on the public pages only. They are not loaded on the workspace, security, owner or administration pages.

Where it is stored. Records are held in a managed PostgreSQL database run by Neon, on Amazon Web Services, and the application is hosted on Vercel. This page does not state the country of storage. If your obligations require your data to be held in a particular country, ask us in writing before you enter patient data and we will tell you where it is held in our reply.

An encrypted copy of the database is taken each day and kept for 90 days at a second provider (GitHub). Deleted data can therefore persist in those copies until they expire.

Enquiry notifications are sent through Resend, an email provider, and contain the details of the enquiry. Patient data is not sent to it.

Who can see it.

• Your members, to the extent their role allows. Roles are enforced by the application; the database itself does not separate organisations with row-level security, so we say so plainly.
• No other organisation, unless a patient’s consent to that specific share has been recorded in the product.
• Aevantos staff do not have patient records in the product. The administration console shows organisation-level counts, not records. Staff who run the database and its hosting can technically reach stored data in order to operate it; they are bound by confidentiality and we do not read patient records.
• The providers named above, only to host, store, back up or send what is described there.

How long it is kept.

• Clinical records stay with the organisation until you ask us to delete them. The service does not delete them automatically. It holds a table of minimum statutory retention periods (for example three years for an inpatient record and ten for a medicolegal record), and we will not delete a record before the minimum that applies to it.
• Activity-log records stay as long as the records they refer to, so there is always a record of who touched what.
• A closed member account leaves an anonymised staff entry, so that the activity log still points at someone.
• Enquiries are kept until you ask us to delete them.
• Backups expire after 90 days.

To ask what we hold about you, or for deletion, email us from the address on the account. See the Privacy page for the same information in short form.

If we become aware that personal data in your workspace has been accessed without authority, we will tell you without undue delay so that you can meet your own duties to patients and to the regulator.

7. Fees and payment

• The fees are on the Pricing page and are these, per organisation per month: clinic ₹1,499, lab ₹1,499, imaging centre ₹1,499, pharmacy ₹2,199, hospital ₹4,999. Patients are ₹101 one time, or ₹401 one time where a physical member card is required. These amounts exclude GST. Per-user pricing beyond the five included logins is not set and will be published or agreed in writing before it applies.
• Early access: no account has been invoiced yet. We will agree in writing the date from which a fee applies before it does, and never retroactively.
• Fees are invoiced in Indian rupees and are paid by bank transfer against our invoice, within the period stated on the invoice. We do not take payment cards or run a payment gateway.
• Fees exclude GST. We have applied for GST registration and it is not live. Until it is, our invoices carry no GSTIN, are not headed “Tax Invoice” and show no GST line. Once registration is live, GST at the rate in force will be added, shown separately, on invoices issued from that date. If you need input tax credit, tell us before you buy.
• If an invoice is unpaid after its due date and a written reminder, we may suspend access under section 9.

8. Liability

• We will provide the service with reasonable skill and care. We do not promise it will be uninterrupted or free of error.
• We are not responsible for clinical decisions, or for loss that arises from an entry made, or not made, by your members.
• We are not liable for indirect or consequential loss, or for lost profit, revenue or goodwill.
• Our total liability to you for all claims arising out of the service in any period of twelve months is limited to the fees you paid us for that period. Where you have paid nothing, our liability is limited to the extent the law allows.
• Nothing here limits liability that cannot lawfully be limited, including for fraud or wilful misconduct.

9. Suspension and termination

• You may stop using the service at any time by writing to us. Fees already invoiced remain payable.
• We may end this agreement on thirty days’ written notice.
• We may suspend access straight away if a login or workspace is being used in a way that threatens the security of other organisations’ data or breaks the law, and otherwise after written notice if you are in breach and do not put it right in a reasonable time.
• On ending, we will keep your records readable, and give you a copy on request, for thirty days, then delete what the retention periods in section 6 allow us to delete, subject to the backup period stated there. Records we must keep for longer are kept, and stay confidential.

10. Changes to these terms

We may change these terms. We will post the new version here with a new date, and tell the owner of each workspace by email at least thirty days before a change that reduces your rights takes effect. Continuing to use the service afterwards is acceptance.

11. Governing law

These terms are governed by the laws of India. The courts located in Gujarat have exclusive jurisdiction over any dispute arising from them or from the service. Before going to court, each side will first try in good faith to settle a dispute by writing to the other.

12. Contact

Questions about these terms, a data request, or a suspected compromise: info@aevantos.com. Other routes are on the Contact page.