Privacy notice

Version 2 · 31 October 2026 · payments through Razorpay in every country

This notice explains what Hospita keeps about patients, the people who visit hospita.si and the people who use the Hospita apps, why, who sees it and what you can do about it.

In short. Each hospital, clinic and diagnostic centre keeps its own records of the patients it treats, and decides how they are used; Hospita runs the software that keeps them. You are one person on Hospita: you give your details once and see your visits, prescriptions and reports from every place in your own app. Nothing passes from one hospital to another on its own; your record is shown to a doctor or a place elsewhere only when you allow it, for as long as you allow it, and you see every look. Hospita does not sell personal data and does not use it for advertising.

1. Who we are, and who decides

Hospita is software for hospitals, clinics and diagnostic centres, provided by the company that operates Hospita ("Hospita", "we"). How to reach us is in section 10 and on the Contact page.
The records a hospital keeps about the patients it treats (visits, prescriptions, test results, notes, payments) are the hospital's. The hospital decides why and how they are used and answers for them; it is the controller of that data (in India, the data fiduciary; in the United States, the covered entity). Hospita processes them on the hospital's behalf, under the Data processing terms. For questions about a hospital's records, ask the hospital first; we help it answer.
Your Hospita person and your own app: the details you give once (name, date of birth, gender, phone number, the people on your number), what you record in your health diary, and the permissions you give to share your record are kept by Hospita for you. For these, Hospita is the controller.
Visitors to hospita.si and the people who register a hospital or work in one: Hospita is the controller of their account and contact details.

2. What we keep about you, and why

What	Why	On what basis
Your name, date of birth, gender, phone number and the people booked on it	To book visits and tests for the right person, to confirm the number is yours with a code, and so that a hospital on Hospita can book you without another form	Your consent and the service you ask for; for a hospital's own records, the hospital's basis
Visits, prescriptions, test requests and results, documents, follow-ups and messages	To give and record your care at the hospital that treats you, and to show them to you in your app	The hospital's basis for providing health care (in the EU, Article 9(2)(h) GDPR); your explicit consent where the law asks for it
What you write in your health diary (vitals, medicines, symptoms, vaccines, medical ID, emergency contacts)	So you can keep and see it, and share it when you choose	Your explicit consent, which you can take back by deleting it
The permissions you give to share your record, and every look at it	To show your record only to whom you allow, and to show you who looked	Your explicit consent; our legal duty to keep a record of access
Payments and refunds (amount, status, the gateway's reference)	To take the fee, refund it as the terms say, and keep accounts	The contract with you; legal duties on accounts and tax
Messages to the hospital's assistant	To answer you, book, and hand over to a person when you ask	The service you ask for
Staff accounts: name, email, phone, role, the hospitals a doctor works at, sign-ins and changes	To give each person access to what their work needs, at one hospital at a time, and to keep the audit trail	The contract with the hospital; our legitimate interest in keeping the service secure
Technical records: the address a request came from, the device, times, errors	To keep the service running and secure, and to stop misuse (for example, too many sign-in codes)	Our legitimate interest in security; legal duties to keep certain records

Hospita does not decide anything about your care. The AI in Hospita suggests and summarises for the doctor, who decides; it does not diagnose or treat, and no decision with legal or similar effect about you is made by it alone.

3. Your record at each hospital, and your own app

Each place keeps its own records. A hospital sees only the patients it treats, and only through people signed in at that hospital.
In your Hospita app (after a code to your phone) you see your visits, prescriptions and reports from every place you use, and everyone booked on your number. A child's or a parent's record on your number is shown to you as the person who books for them; if they should see their own, they can use their own number.
A diagnostic centre that a hospital sends you to sees your name and phone number only once you book there, and the result it records goes to you and to the doctor who asked for the test.

4. Sharing your record: only with your permission

You can let a doctor, a hospital or a diagnostic centre see your record, for a time you choose. You can take the permission back at any time; it ends by itself when its time ends.
Every look is recorded and shown to you: who looked, from which place, and when.
Hospita checks the registrations and licences that a diagnostic centre gives it and shows "Hospita Verified" while they are in date. This is a check of papers, not an authorisation; before you give a sample, check that the centre is approved by the authorities where you live. The centre answers for its tests and reports, and your doctor for your care.

5. Who else sees it: the services we use

We share personal data only as far as each service needs it, under contracts that bind it to keep it confidential and secure:

Payment gateways (Razorpay, for cards from any country, UPI, net banking, wallets and PayPal; PayPal itself where a hospital takes PayPal into its own account): your card, bank or wallet details go to the gateway, never to Hospita or the hospital.
Messages: WhatsApp (Meta Platforms), text-message providers and email delivery, for codes, confirmations, reminders and reports being ready.
An AI model provider, for the assistant and for the suggestions shown to doctors. It receives what each task needs (for the assistant, the conversation and the booking details; for a doctor, the prescription, the report or the visit asked about) and is bound to use it only to answer.
Hosting and back-ups, where the data is kept.
Video visits run directly between your browser and the doctor's. A connection service helps the two browsers find each other and sees only network addresses; nothing of the call is recorded.
Authorities and courts, when the law requires it, and only what it requires.

The current list of these services is in the Data processing terms. Some are in other countries than yours. Where the law of your country limits sending personal data abroad, we use the safeguards it requires (in the EU and the UK, the European Commission's standard contractual clauses or an adequacy decision). Patient data is kept in: the region named in the Data processing terms.

6. How long we keep it

A hospital's records are kept for as long as the hospital uses Hospita and as long as the law on medical records requires it to keep them; the hospital decides. When a hospital leaves Hospita, its records are handed back and then deleted as the Data processing terms say.
Your Hospita person and your health diary are kept until you ask us to delete them, apart from what a hospital must keep about your care.
A sign-in code works for 5 minutes. Technical records are kept only as long as they are needed to run the service and keep it secure, or to look into misuse.
Payment records are kept as long as the law on accounts and tax requires.

7. Your rights and how to use them

Depending on the law where you live, you may ask to see your data and get a copy of it, to correct it, to delete it, to limit or object to its use, to take back a consent (without affecting what was done before), to move it to another provider, and to name someone to act for you. You may also complain to your data protection authority (in India, the Data Protection Board of India; in the EU, the authority of your country; in the UK, the ICO).

For a hospital's records, ask the hospital; it decides, and Hospita helps it answer within the time the law sets.
For your Hospita person, your diary and your permissions, ask us at the address in section 10. We answer within one month (or the shorter time your law sets) and may ask you to prove who you are.
You can see, change and delete most of it yourself in your Hospita app.

8. Keeping it safe

How Hospita keeps patient data safe is on the Security page: each hospital's records are its own, staff sign in at one hospital at a time, passwords are kept only as one-way hashes, patients sign in with a code to their own phone, card details stay with the payment gateway, calls are not recorded, and every change is recorded. If a breach puts your data at risk, the hospital or we tell you and the authority as the law requires.

9. Children, cookies and this website

Children's records are kept by the hospital that treats them and are booked by a parent or guardian on their number.
hospita.si keeps no tracking or advertising cookies. It keeps your choice of language on your device. Its fonts are loaded from Google Fonts, which sees your device's address when they load.
Each hospital's own website on Hospita is published by the hospital, which answers for it (see the Website terms for hospitals).

10. Contact

Privacy and data requests: not yet published.
Grievance officer: not yet named, not yet published.
The company that operates Hospita, address not yet published.

11. Changes to this notice

When this notice changes, the new version is published here with its date, and earlier versions stay available on request. A change that affects how your data is used is told to you in your app before it applies.

Revisions

Version	Date	What changed
1	28 October 2026	First version.