Privacy Policy

Last updated 31 October 2026

Swar is made by Mysa Technology Pvt Ltd (“Mysa”, “we”, “us”). This policy covers the Swar hospital platform (app.swar.health), used by hospitals, clinics and their staff; the Swar patient app (patient.swar.health and the Android app); and this website (swar.health). It explains what personal data each of them handles, who processes it and where, how long it is kept, and your rights under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

1. Who is responsible for your data

• Patients’ clinical records (registration details, visits, consultations, prescriptions, lab reports, invoices): the hospital or clinic that treats you decides why and how they are processed. For these records the hospital is the data fiduciary, and Mysa processes them on the hospital’s behalf as its data processor. Requests about your medical record go to the hospital; we help hospitals answer them.
• Your patient-app account (your mobile number, family profiles, settings) and this website: Mysa is the data fiduciary.
• Hospital staff accounts: the hospital decides who has access and what they do; Mysa runs the accounts for the hospital and keeps sign-in and security records to protect the service.

2. What we collect

On the hospital platform

• Staff accounts: name, work email, the roles the hospital gives you, and professional details you add (title, registration number, qualifications, specialty); if you sign in with Google, your Google account identifier. Sign-in codes are stored only as one-way hashes and expire after 10 minutes.
• Patients’ records, entered by the hospital: name, age or date of birth, sex, phone number, hospital number (MRN), visits and queue tokens, vitals, consultation notes, diagnoses, prescriptions, lab orders and reports, payments recorded at the desk, and emergency alerts.
• Dictation: the audio of a dictated consultation is sent for speech-to-text and is not stored by Swar; the resulting transcript is stored with the consultation.
• Photos and files: a photographed registration slip is read to fill in the form and is not stored (the details read from it are); lab report files and chemist invoice files are stored with the record.
• Activity and diagnostics: a record of key actions (for example who finalized a prescription), usage counts, and error reports (the signed-in user, the page, the error and the browser).

In the patient app

• Your mobile number (to sign in); for each family profile, name, date of birth, sex, relationship, and an ABHA number if you choose to enter one.
• The hospitals you link to, appointments, queue tokens, and feedback you give after a visit.
• Medicines you save, with a small thumbnail of the pack photo.
• A push-notification subscription, only if you turn alerts on.
• Emergency alerts: if you raise one and allow location, your location is sent with the alert, stored with it, and visible to that hospital’s staff.

On this website

• What you type in the demo form (name, hospital, role, phone, email, message) and which page you sent it from.
• Your IP address, kept for about 30 days, to limit repeated submissions.
• No analytics, advertising or tracking cookies. Your light/dark theme choice is kept in your own browser.

We do not sell personal data and do not use it for advertising.

3. How we use it

• To run the service for hospitals: registration, queues, consultations, prescriptions, labs, pharmacy, billing.
• To show patients the records their hospitals share with them, and to send the notices they ask for.
• To sign people in, keep accounts secure, investigate errors and abuse, and meet legal obligations.
• To answer demo requests and talk to hospitals that ask us to.

4. AI in Swar

Swar uses AI to save doctors typing. Its output is a draft or a suggestion: a doctor reviews every prescription before it is finalized, and no decision about anyone is made automatically.

• Speech-to-text and read-outs run on Sarvam AI. Audio is sent to Sarvam for transcription and not stored by Swar.
• Drafting the prescription runs on Anthropic’s Claude, outside India. Before the transcript is sent, Swar removes the patient’s name, hospital number, email addresses, phone numbers and other long numbers from it. Matching dictated medicines to the hospital’s formulary sends the medicine names, doses, diagnosis and symptoms, without identity details.
• Reading photos (registration slips, lab report images, and medicine packs in the patient app) also runs on Claude, outside India. A photo is sent as it is, so it may include the details printed on it.
• Doctor Assist runs on Google’s Gemini in Google Cloud’s Mumbai region. During a live consultation it receives what is said, the patient’s age and sex, and known allergies, conditions, medicines and lab results; the patient’s name and hospital number are not sent as fields, but anything said aloud is part of what it hears. Its guideline searches are recorded with the search text, so the sources it cites can be checked.

5. Who processes data for us, and where

We use these providers, under contract, only for the purposes shown. Swar’s data is stored in India; the processing marked “United States” takes place outside India, as the DPDP Act permits.

We also share data with the hospitals you link to (patient app), and with authorities where the law requires it. Swar never shows one hospital’s records to another.

6. How we protect it

• All connections are encrypted (HTTPS).
• Each hospital’s records are separated from every other hospital’s inside the database, not only in the app.
• Staff see only what their role needs.
• Mysa’s own platform administrators cannot open patients’ clinical records. For support they can see a limited patient directory (name, the last four digits of the phone number, how many hospitals are linked), and that access is restricted and logged.

7. How long we keep it

• Clinical records are kept for the hospital while it uses Swar and as long as medical-records law requires; the hospital decides on correction or erasure.
• Patient-app account: until you delete it (Profile → Delete account, or see Delete your account). Deleting it removes your profiles, hospital links, saved medicines, sign-in codes and notification settings. Appointments, feedback and emergency alerts you already sent stay with the hospital, no longer tied to your account; an emergency alert keeps the location and call-back number you sent with it.
• Error reports and rate-limit records are deleted after about 30 days. The record of key actions is kept to protect the service and meet legal obligations.
• Demo requests are kept until you ask us to delete them.
• Our database provider keeps daily backups, which roll over on its schedule.

8. Your choices and consent

• A hospital is linked to your patient-app account only when you confirm it.
• To remove a hospital link or withdraw consent, write to ag@swar.health; you can also delete your account at any time.
• Location and notifications are used only if you allow them, and you can turn them off on your device.

9. Your rights under the DPDP Act

You can ask for a summary of your data and who it was shared with, have it corrected, completed or erased, have a grievance addressed, and nominate someone to exercise these rights for you. For your clinical records, contact the hospital — it is the data fiduciary — or write to us and we will pass your request on and help. We respond within the time the law sets.

10. Children

A profile for someone under 18 must be created and managed by a parent or lawful guardian, who consents on the child’s behalf.

11. Changes to this policy

We will post any change here with a new “last updated” date and, where it matters, tell you in the app first.

12. Contact and grievances

Grievance Officer: Arpit Golechha
Mysa Technology Pvt Ltd, 910, Elite Magnum, Near Bhuyangdev Cross Roads, Ahmedabad, Gujarat – 380052
ag@swar.health