SSAyush processes personal and patient data solely to provide hospital management software to the hospital that entered it. The hospital is the data fiduciary; SSAyush is the data processor acting on its instructions.

Data is stored in ap-south-1 (Mumbai) and is not replicated outside India. Access by SSAyush staff is limited to what is needed to operate and support the service, and every such access is recorded.

Patient data is never sold, shared, brokered, or used to train models. A hospital may request export or deletion of its data at any time, and SSAyush will comply within thirty days.

Questions about this policy go to the grievance officer named on the grievance page.