Privacy Policy

1.Scope of this policy

This policy covers two things, and treats them differently because the law does:

• This website, qlinilab.com — principally the demo booking form. For data collected here, we decide why and how it is used, so we are the Data Fiduciary.
• Data inside the QliniLab product — patient details, test orders, samples, results and reports that a laboratory records in its QliniLab account. That data belongs to the laboratory. The laboratory is the Data Fiduciary, and we process the data only on its instructions, as its Data Processor. Section 6 explains what that means in practice.

2.Who we are

QliniLab is a product of Qlinio Private Limited (“Qlinio”, “we”, “us”), CIN U62011KL2026PTC105151, registered at 2/1149/I 100, Hilite Business Park, Tower 2, Iringallur, Kozhikode, Kerala 673014, India. The same company makes Qlinikit, clinic software, and Qlini, the patient app.

3.What this website collects, and why

When you book a demo

• Your name — to identify the booking and address you during the demo.
• Your phone number — to reach you about the appointment.
• Your email address — to send the verification code, the confirmation and the meeting link.
• A one-time verification code — to confirm the email address is yours, so nobody can book in your name.
• Your lab’s name and city — optional, so the demo fits the kind of lab you run.

This enables one thing: scheduling and running a demo, with the confirmation and reminder that go with it. Booking a demo does not add you to a marketing list.

Technical data

• Your IP address and standard request information — recorded by our hosting infrastructure as part of serving the site. When you use the demo form, your IP address is also used to limit how often the form can be submitted and passed to our booking service for the same purpose, so the form cannot be used to flood anyone with codes.

When you simply browse

We count page views with Vercel Web Analytics, served from this site’s own domain. It sets no cookies, cannot follow you to other websites, and builds no profile of you. Visitors are counted with a temporary hash that is discarded within a day, so even we cannot tell that two visits came from the same person.

Prices on this site

Plan prices are fetched by our server from our own billing system. Showing them involves no data about you.

4.Cookies

This website sets no cookies. It needs none to work and loads no third-party tool that would set one, so there is no consent banner to dismiss. If that ever changes, we will ask for your consent before the tool loads and list every cookie here.

5.What this website does not do

These are facts about how the site is built, and you can check each one in your browser’s network inspector:

• No session recording, no heatmaps, no advertising pixels and no retargeting.
• No third-party scripts, fonts or media — the site’s Content-Security-Policy blocks anything not served from our own domain.
• We do not sell personal data or share it with data brokers, and we make no automated decisions about you.
• We never ask for health data on this website. Please do not put patient details or test results into the demo form — we will delete any we receive.

6.Lab and patient data inside QliniLab

When a laboratory uses QliniLab, its staff record personal data about patients and others, typically: patient name, age, sex and contact details; the referring doctor; tests ordered; sample details; results, reference ranges and flags; verified reports; and bills and payments. Laboratory staff accounts hold their name, contact details and role.

The laboratory decides what is recorded and why. We commit to the following:

• On instructions only. We process this data only to provide QliniLab to the laboratory, under our agreement with it — never for our own purposes.
• Never sold, never advertised to. We do not sell patient data, use it for advertising, share it with data brokers, or use it to train AI models.
• Separated by account. Every laboratory’s data is kept separate from every other customer’s, and every request is checked against the account it belongs to.
• Access set by the lab. Inside an account, the laboratory decides which staff can see and do what, by role.
• Kept out of side channels. Patient details are kept out of our application logs, error reports and caches, and notifications use generic wording (“a report is ready”) rather than names or results.
• Our staff stay out. We do not look at patient records in a laboratory’s account except where that is needed to fix a problem the laboratory has reported, to keep the service secure, or where the law requires it.
• Partner labs on the lab’s instruction. When a laboratory sends a sample to a partner lab through QliniLab, the details that test needs go to that partner because the laboratory chose to send them.
• Export and deletion. A laboratory can ask us for an export of its data, and when it leaves, we delete its data or hand it back as our agreement with it sets out — subject to any record the law requires to be kept.

7.If you are a patient

If you had a test at a laboratory that uses QliniLab, the laboratory holds your records, and it is the right place to ask for a copy of a report, a correction, or deletion. We cannot release a report to you directly, because we cannot verify on the laboratory’s behalf that you are entitled to it.

If you write to us, we will pass your request to the laboratory concerned, and tell you we have done so.

8.Our lawful basis

For data collected on this website, we rely on your consent, which you give by submitting the demo form after reading this notice, and on the provisions of the DPDP Act permitting processing for a purpose you have voluntarily provided your data for. You can withdraw consent at any time by writing to [email protected]; if a demo is already scheduled, we may contact you once to cancel it.

For data inside QliniLab, the laboratory, as Data Fiduciary, is responsible for having a lawful basis to record it and for giving patients notice.

9.Who we share it with

We share personal data only with the following, and only as far as each needs it:

• Our own booking service, part of the Qlinikit platform and operated by us, which handles demo bookings.
• An email delivery provider, to send verification codes and booking emails.
• Hosting, database and storage providers, who run the website and the product on our instructions.
• Professional advisers or a public authority, where the law or legal process requires disclosure.

Each provider is bound by contract to process personal data only on our instructions and to protect it.

10.Transfers outside India

Some of these providers — principally hosting and email delivery — may store or process data on infrastructure outside India. Such transfers are made in accordance with Section 16 of the DPDP Act, 2023, which permits transfer other than to countries restricted by notification of the Central Government.

11.How long we keep it

• Demo bookings — 24 months from the appointment, then deleted.
• Server logs — 90 days.
• Data inside QliniLab — for as long as the laboratory’s account is active, then as our agreement with the laboratory sets out. Laboratories often have their own legal duty to keep reports for a period; that duty is theirs to decide and tell us about.

We delete sooner if you withdraw consent or ask for erasure, unless the law requires us to keep the record.

12.How we protect it

• Encryption in transit — this site and the product are served only over HTTPS.
• Encryption at rest for the product’s database, file storage and backups.
• Account separation, and role-based access inside every account.
• Access to production systems limited to the people who need it to run the service.
• Rate limits and verification codes on forms and sign-in, so they cannot be abused in your name.

No system is perfectly secure, and we do not claim otherwise. What we commit to is that a failure will be handled as set out below, not concealed.

13.Your rights

Under the DPDP Act, 2023 you have the right to:

• Access — a summary of the personal data we hold about you and how we process it.
• Correction and completion — of inaccurate, incomplete or outdated data.
• Erasure — unless the law requires us to keep it.
• Withdraw consent — at any time, as easily as you gave it.
• Grievance redressal — to complain to us and receive a response.
• Nominate — someone to exercise these rights for you in the event of your death or incapacity.

Exercising any of these is free. For records a laboratory holds about you, these rights are exercised with the laboratory — see section 7.

14.How to exercise your rights

Write to our Grievance Officer at [email protected], or by post at 2/1149/I 100, Hilite Business Park, Tower 2, Iringallur, Kozhikode, Kerala 673014, India, and tell us which right you want to exercise. We may ask a question to confirm your identity first, so that we never disclose your data to someone else.

We respond within 30 days. The statutory outer limit for grievances is 90 days; ours is shorter and is the one we hold ourselves to.

15.Complaining to the Data Protection Board

If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India. Raising it with us first is ordinarily expected, but does not limit your right to approach the Board.

16.Children

This website is for laboratories and healthcare businesses, and we do not knowingly collect personal data from anyone under 18 through it. Laboratories may record tests for children inside QliniLab; obtaining a parent or guardian’s consent for that is the laboratory’s responsibility as Data Fiduciary. We never track, profile or advertise to anyone.

17.If there is a data breach

If a personal data breach affects data collected on this website, we will inform the Data Protection Board without delay and tell you directly — what happened, what data was involved, what we are doing, and what you can do — with a fuller report to the Board within 72 hours, as the Rules require.

If a breach affects data inside QliniLab, we will tell the affected laboratory without delay and give it the information it needs to inform the Board and its patients.

18.Changes to this policy

When this policy changes we will update the effective date at the top of this page and, for any material change, contact customers and people who have booked demos directly. See also our Terms of Service.

19.Contact

The Grievance Officer
Qlinio Private Limited
2/1149/I 100, Hilite Business Park, Tower 2, Iringallur, Kozhikode, Kerala 673014, India
[email protected]