Privacy Policy

This Privacy Policy describes how ClearCycle (“ClearCycle”, “we”, “us”, or “our”) collects, uses, stores, and shares information when you use our website (clearcycle.in), platform (app.clearcycle.in), or services. It is designed to comply with India's Digital Personal Data Protection (DPDP) Act 2023, IRDAI data handling guidelines, and applicable international data protection standards.

1. Who this policy applies to

This policy applies to:

• Hospital administrators and billing staff who access the ClearCycle platform on behalf of their organisation.
• Doctors who receive approval requests via SMS/OTP as part of the 3-gate claim workflow.
• Website visitors who browse clearcycle.in.
• Patients whose de-identified health information is processed as part of insurance claim submissions made by empanelled hospitals. Patients are not direct users of the platform; their data is submitted by and under the responsibility of the hospital.

2. What data we collect

2.1 Hospital account data

When a hospital signs up or pilots ClearCycle, we collect: hospital name, address, registration number, contact person name, email address, phone number, and payment information.

2.2 Platform usage data

We collect logs of actions taken within the platform: claim created, coding reviewed, claim approved, submission status, appeal generated. These logs form the 7-year audit trail required by IRDAI guidelines.

2.3 Clinical and patient data

To process insurance claims, hospitals submit: patient name, Aadhaar or policy number (as required by the insurer), date of birth, diagnosis codes, procedure codes, discharge summary excerpts, investigation reports, and TPA pre-authorisation references.

ClearCycle processes this data as a data processor acting on instructions from the hospital (the data fiduciary under DPDP Act 2023). We do not use patient clinical data for any purpose other than claim processing, audit trail maintenance, and improving our AI coding models (only with explicit hospital consent and always in anonymised form).

2.4 Website data

When you visit clearcycle.in, we collect standard web analytics data: pages visited, time on page, referring URL, approximate location (country/city), and device type. We use this data to improve the website.

3. Legal basis for processing (DPDP Act 2023)

We process personal data on the following bases:

• Consent: For marketing communications and non-essential analytics cookies. You may withdraw consent at any time.
• Contract: For processing account data and platform usage data to deliver the service you have contracted.
• Legitimate interest: For security monitoring, fraud prevention, and product improvement (using anonymised aggregate data).
• Legal obligation: For maintaining the 7-year claim audit trail per IRDAI regulations.

4. Data storage and security

• All data is stored on AWS ap-south-1 (Mumbai). Patient data never leaves India.
• Data in transit is encrypted with TLS 1.3.
• Data at rest is encrypted with AES-256.
• Access is role-based: billing staff can only see claims for their hospital; doctor OTP approval creates an immutable log entry.
• We conduct annual security audits and maintain SOC 2 Type II certification (in progress).

5. Data sharing

We share data with:

• TPA portals (Star Health, ICICI Lombard, etc.) as required to submit claims on behalf of hospitals.
• NHCX as required for digital claims exchange under IRDAI mandate.
• AWS as our cloud infrastructure provider (standard DPA in place).
• Anthropic (Claude AI) for AI-assisted coding and appeal letter generation (data processed under Anthropic's Enterprise DPA; patient data sent only as de-identified clinical text).

We do not sell personal data to third parties. We do not share data with insurance companies for underwriting purposes.

6. Your rights (DPDP Act 2023)

Individuals whose data we process have the right to: access their data, correct inaccurate data, erase their data (subject to legal retention obligations), and nominate a representative to exercise these rights on their behalf. To exercise these rights, contact us at gauravhira24@gmail.com.

For patients whose data was submitted by a hospital: your primary relationship is with the hospital. We will cooperate with hospitals to fulfil patient rights requests.

7. Cookies

We use essential cookies (required for the platform to function) and optional analytics cookies. A cookie consent banner on our website allows you to accept or reject non-essential cookies. You can change your preference at any time by clearing your browser's localStorage.

8. Data retention

• Claim audit trails are retained for 7 years per IRDAI guidelines, then deleted.
• Account data is retained for the duration of the contract plus 2 years.
• Website analytics data is retained for 24 months in aggregate form only.

9. Changes to this policy

We may update this policy as regulations change or we add new features. Material changes will be notified to active hospital accounts by email at least 30 days before they take effect. The current version is always available at clearcycle.in/privacy.

10. Contact

Data Protection queries: gauravhira24@gmail.com
Phone: +91 91632 36777
ClearCycle