Privacy policy

OncoSync is operated by OneHeal Technologies Private Limited, a company incorporated in India (CIN U62099DL2025PTC446323), with its registered office at Property No. 55, 3rd Flr, Saidulajab, Nr. Westend Marg, Gadaipur, South West Delhi, New Delhi, Delhi, India, 110030.

We play two different roles, depending on whose data it is.

1. (a)For visitors to this website, people who contact us or request a demo, and people who hold an OncoSync account (including clinicians, MDT coordinators, administrators and specialists on the Clinical Intelligence Network), we decide why and how the data is used. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the Data Fiduciary for this data.
2. (b)For patient information and other clinical records that a hospital, clinic or healthcare professional (our "Customer") enters into OncoSync, we process the data only on that Customer's instructions. The Customer is the Data Fiduciary and we are its Data Processor. Our Data Processing Agreement sets out exactly what we may and may not do with that data.

If you're a patient and want to know how your information is used, or want to exercise your rights over it, please contact the hospital or clinic treating you. If you write to us instead, we'll pass your request to them and help them respond.

When you visit the website. Our servers automatically record technical information needed to deliver the site and keep it secure: your IP address, browser and device type, the pages you request, and the date and time. We don't use advertising or analytics cookies. The site stores two small items in your browser's local storage: your display theme, and, if you sign in, your session so you stay signed in. The website's fonts load from Google Fonts, which means your browser connects to Google's servers and Google receives your IP address.

When you contact us or request a demo. Your name, hospital or organisation, work email, phone number, country, hospital size and anything you write in your message.

When you hold an account. Your name, work email, phone number, role, organisation and specialty; your sign-in and two-factor authentication details; and a record of your activity on the platform (what you viewed, created or changed, and when). The activity record is part of the clinical audit trail and can't be switched off.

When you join the Clinical Intelligence Network as a specialist. In addition to the above: your medical registration number and the council that issued it, qualifications, CV, licence and registration documents, specialties and experience, consultation rates, availability, ratings, and the bank account and tax details (such as PAN and GSTIN) we need to pay you and meet our tax obligations.

Patient and clinical data we process for Customers. Identity and demographic details, health identifiers such as the ABHA number, insurance details, emergency contacts, medical history, examination findings, investigation, imaging, pathology and genetic reports, diagnoses and staging, MDT discussions and decisions, treatment plans, regimens and doses, radiation plans, follow-up visits and outcomes. This is sensitive health data, and we handle it only as described in section 1.2(b).

Website and enquiries: to reply to you, arrange and run demos, send information you've asked for, and keep the website secure. We'll only send you marketing emails if you've opted in, and every one of them has an unsubscribe link.

Accounts: to provide the platform, verify who you are when you sign in, keep the audit trail, protect the service from misuse, give you support, send service and security notices, and manage billing.

Specialists: to check your credentials before you can be invited to any case, show your profile to hospitals on the network, run engagements and payouts, keep tax records, and maintain ratings.

Legal and safety: to comply with the law, respond to lawful requests from authorities, and enforce our agreements.

Improving the service: we look at how features are used (for example, which screens are opened and how long pages take to load) to fix problems and improve OncoSync. We use this information in de-identified or aggregated form wherever we can.

What we don't do. We don't sell personal data. We don't use patient data for advertising or for any purpose of our own. We don't use one Customer's patient data to train models or build features for anyone else. Any use of de-identified data for research or product development happens only with the Customer's written agreement and within the law.

Where we're the Data Fiduciary, we process personal data either with your consent or for a legitimate use permitted by Section 7 of the DPDP Act. For example, when you voluntarily give us your details for a specific purpose, such as booking a demo, or when the law requires us to keep a record.

When we ask for your consent, we'll tell you what we're asking for and why. You can withdraw it at any time by writing to us or, for marketing emails, by clicking unsubscribe. Withdrawing consent doesn't affect what we did before you withdrew it, but we may no longer be able to provide a service that depends on it.

Until the DPDP Act and the Digital Personal Data Protection Rules, 2025 are fully in force, we also comply with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

For patient data, the Customer is responsible for having a lawful basis, giving patients the required notices and obtaining any consents, including for sharing a case with an external specialist. Where patient records relate to children, Customers that are clinical establishments or healthcare professionals process them to provide health services, as the DPDP Rules permit.

If you're in the European Union or the United Kingdom, we rely on your consent, on performing a contract with you or your organisation, or on our legitimate interest in running and securing our services. If you're in the Kingdom of Saudi Arabia, we process your data in line with the Personal Data Protection Law.

We share personal data only in the following situations:

1. (a)Service providers who host or help run OncoSync for us under written contracts that require them to protect the data and use it only for our instructions. These include Amazon Web Services for hosting and storage, and the other providers listed in our sub-processor list at oncosync.health/subprocessors. We tell Customers before we add or replace a sub-processor that handles patient data.
2. (b)Inside the platform, as users direct. For example, when a hospital invites a specialist onto a case, that specialist sees that case and nothing else.
3. (c)Professional advisers such as lawyers and auditors, under a duty of confidentiality.
4. (d)Authorities, where the law requires it: for example, a court order, the Data Protection Board of India or CERT-In. If a request concerns a Customer's patient data, we'll tell the Customer unless we're legally prevented from doing so.
5. (e)A change of ownership. If OneHeal is merged or acquired, personal data may pass to the new owner, who must protect it as this policy describes. We'll let you know before that happens.

OncoSync runs on Amazon Web Services. Data for Customers in India is stored in the AWS Asia Pacific (Mumbai) region. For Customers outside India, data is stored in the region agreed in their order form, so that local data-residency rules can be met.

Some service providers, such as our email provider, may process limited data outside India. The DPDP Act allows this except to countries the Government restricts, and we'll follow any such restriction. Wherever data goes, it stays protected by the contracts described in section 5.

Under the DPDP Act, you can ask us for:

1. (a)a summary of the personal data we hold about you and how we process it, and who we've shared it with;
2. (b)correction, completion or updating of inaccurate or incomplete data;
3. (c)erasure of data we no longer need, unless the law requires us to keep it;
4. (d)a response to any grievance about how we handle your data; and
5. (e)recording of a person you nominate to exercise these rights on your behalf if you die or become incapacitated.

You can also withdraw consent at any time, as described in section 4.2.

To exercise a right, write to our Grievance Officer (section 12). We may need to confirm your identity first. We'll respond within 30 days. If you're not satisfied with our response, you can complain to the Data Protection Board of India.

If you're in the EU or UK, you also have the right to object to or restrict processing, to data portability, and to complain to your data protection authority.

If you're a patient, please make your request to your hospital or clinic, as explained in section 1.3.

We protect data with safeguards appropriate to health information. These include encryption in transit and at rest, role-based access scoped by specialty, site and case, two-factor authentication on clinician accounts, an audit trail of activity on every patient record, personal data kept out of application logs, regular backups, and access for our own staff limited to those who need it, under confidentiality obligations.

No system is perfectly secure. If a breach affects your personal data, we'll inform you and the relevant authorities, including the Data Protection Board of India and CERT-In, as the law requires. If it affects a Customer's patient data, we'll inform that Customer promptly so they can meet their own obligations.