Your patients’ records are yours. We don’t sell data, we don’t run ads, and on the clinic edition we never receive a patient’s record at all. We earn our money from software licences — nothing else.
This policy explains what AshuLabs (“we”, “us”) collects through this website, klinikflow.in, and through KlinikFlow — both the clinic edition installed on a clinic’s computer and KlinikFlow Cloud at app.klinikflow.in — how we use it, and the choices you have. It is written in plain English on purpose.
1. This website
klinikflow.in sets no cookies, runs no analytics or advertising scripts, and has no forms. Like every web server, ours writes a short log of each request — the address it came from, the page, the browser — used only to keep the site running and secure, and deleted on a rolling cycle. Its typeface is loaded from Google Fonts, which sees your browser’s address when it does.
2. The clinic edition
KlinikFlow’s clinic edition keeps a clinic’s patient records on the clinic’s own computer. We never receive them. The clinic is the sole controller of its patient data and decides who is given a login.
The daily check-in
If the clinic agrees — it is asked at first-run setup, and can turn it off at any time in Settings — KlinikFlow tells us once a day, while that computer is online, that the copy is in use. Each check-in carries only a random install number created on that computer, the KlinikFlow version, the operating system, and whether the copy is on trial, licensed or expired. It never carries a patient, a bill, a doctor, the clinic’s name or any record. It is counted in our own self-hosted analytics at analytics.ashulabs.com, which works out the approximate location (country and city) from the internet connection and does not keep the address itself. We use it only to know how many copies are in use, which versions, and where.
Other connections
Otherwise KlinikFlow uses the internet only for what the clinic turns on: WhatsApp or SMS sending through the clinic’s own accounts, and checking for updates. Speaking a consultation is heard on the clinic’s own computer; no recording leaves it.
3. KlinikFlow Cloud
- A clinic on KlinikFlow Cloud keeps its records on our servers in India. Each clinic’s data is kept apart from every other’s, encrypted in transit and backed up.
- The clinic remains the controller of its patients’ data; we process it only to run KlinikFlow for the clinic, never for research, analytics, marketing or any other purpose.
- We do not look at a clinic’s records. Support sees a clinic’s settings only when its owner allows it, for a set time, and never a patient’s record; every look is in the clinic’s own log.
- ABDM: a patient’s records are shared with or fetched from other providers only when the patient consents in their own health app. Aadhaar is used for the one-time code and never stored.
- A clinic leaving KlinikFlow Cloud can export its records first.
4. Our customers’ details
When a clinic asks us for a demo, a licence or a plan, we keep what it gives us to do that: names, email and phone, the clinic’s name and billing address, the computer’s code a licence is made for, and our correspondence. Payments are taken by a payment gateway; we never store a full card number, CVV or bank login, only the transaction reference.
5. Data sharing
We do not sell, rent or trade anyone’s data. Period.
We share data only with a payment gateway to take a payment, with the hosting providers that run our servers (bound to confidentiality and acting only for us), and where the law, a court or a government authority requires it — telling you where we are allowed to. We use no advertising networks, data brokers or cross-site tracking.
6. WhatsApp
If you message us on WhatsApp, or ask us to message you there, your number, profile name and the messages pass through WhatsApp, which is operated by Meta under its own privacy terms. We message only those who asked us to, never for advertising, and stop when you reply STOP. Email and phone always remain open.
Messages a clinic sends its own patients from KlinikFlow go from the clinic’s own phone or business account; the clinic is responsible for them, and KlinikFlow sends only to patients recorded as having agreed.
7. Your rights
You can ask us for a copy of the personal data we hold about you, to correct it, or to delete it (unless we must keep a record by law, such as an invoice), and you can withdraw consent to messages at any time. Write to app@klinikflow.in; we reply within 30 days.
A patient asking about their own records should ask their clinic, which holds them. KlinikFlow gives the clinic the tools to answer — to see, correct or erase a patient’s data within the law.
8. How long we keep things
- Customer and licence records: while you are a customer, and afterwards as long as tax and audit law asks.
- A closed KlinikFlow Cloud account: deleted within 90 days of closing, after the clinic has had the chance to export.
- Backups: overwritten on a rolling cycle and not used for anything else.
- WhatsApp conversations: no longer than 24 months after the last message, unless the law or an open dispute needs them.
9. Changes
When this policy changes, the date above changes. A change that matters is told to customers by email or in KlinikFlow, and KlinikFlow asks the clinic to accept its privacy statement again.
10. Contact us
- Email: app@klinikflow.in
- Phone: +91 76766 64374
- AshuLabs, Bengaluru, India · AshuLabs’ privacy policy covers our other products