Privacy Policy

1. Introduction

Mera Clinic Space ("Mera Clinic Space," "we," "us," or "our") is a clinic management platform operated by Avega Tech LLP. Our services include the website at meraclinic.space, the Mera Clinic mobile application, and related tools that help healthcare clinics manage appointments, electronic health records (EHR), billing, analytics, online booking pages, and AI-assisted patient summaries.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our platform. It applies to clinic staff and administrators who register for an account, and to individuals who submit information through a clinic's public booking page or otherwise interact with our services.

We process personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDPA"), where applicable.

2. Who Is Responsible for Your Data

Clinic staff accounts. When you sign up as a clinic owner, doctor, or staff member, Avega Tech LLP acts as the data fiduciary for your account information.

Patient records. Clinics using Mera Clinic Space enter and manage patient health information on our platform. In most cases, the clinic is responsible for deciding why and how patient data is collected and used. We process that data on the clinic's behalf to provide the service. Patients who have questions about their medical records should contact their clinic first.

Online appointment requests. When you submit an appointment request through a clinic's booking page, your information is shared with that clinic and stored in our systems so the clinic can respond to your request.

3. Information We Collect

3.1 Clinic and staff account data

• Name, email address, phone number, and profile photo
• Authentication credentials and session data managed through our identity provider
• Clinic details such as name, address, phone, logo, specialty, timings, and treatment catalog
• Billing and subscription preferences configured in the platform
• Device push notification tokens when you use the mobile app

3.2 Patient and clinical data entered by clinics

Clinics may store the following types of information about patients in Mera Clinic Space:

• Identity and contact details (name, date of birth, gender, email, phone, address)
• Medical information (conditions, allergies, blood type, medications, clinical notes)
• Treatment history, prescriptions, and appointment records
• Uploaded files such as X-rays, reports, and consent signatures
• Invoice, payment, and ledger information related to patient care

3.3 Public booking and appointment requests

If you use a clinic's online booking page, we may collect your name, email, phone number, preferred appointment date and time, treatment selection, and any notes you provide.

3.4 Automatically collected information

• Device type, operating system, app version, and general usage logs
• IP address, browser type, and pages visited on our website
• Error reports and diagnostic data needed to maintain service reliability

4. How We Use Your Information

We use personal data to:

• Provide, operate, and maintain the Mera Clinic Space platform
• Authenticate users and enforce role-based access within each clinic
• Enable appointment scheduling, patient record management, billing, and reporting
• Process online appointment requests submitted to clinics
• Send service-related notifications, including push notifications on mobile devices
• Generate AI-assisted summaries of patient history when requested by authorized clinic staff
• Improve security, troubleshoot issues, and prevent fraud or misuse
• Comply with legal obligations and respond to lawful requests

We do not sell personal data, use patient data for advertising, or use patient data to train general-purpose AI models.

5. AI Processing

Mera Clinic Space offers optional AI-assisted analysis that summarizes a patient's clinical history for authorized clinic staff. When this feature is used, relevant patient information may be sent to Google Gemini for processing.

• AI processing is performed in the Mumbai, India region
• Data is used only to generate the requested summary for your clinic
• Patient data is not used to train or improve third-party AI models

6. Where Data Is Stored

We store clinic and patient data on infrastructure located in India. File attachments such as medical images and documents are stored in encrypted object storage. We take steps to ensure personal data does not leave India except where strictly necessary to deliver the service using processors that maintain equivalent safeguards.

7. Third-Party Service Providers

We use trusted third-party providers to operate our platform. These providers process data only on our instructions and for the purposes described in this policy:

• Clerk — user authentication and account management
• Google Gemini — optional AI summarization of patient records (Mumbai region)
• Firebase / Expo — mobile push notification delivery
• Cloud hosting and storage providers — database, application hosting, and encrypted file storage

We may also send transactional messages (such as email or SMS) through messaging providers when clinics enable those features.

8. Data Sharing

We may share personal data only in the following circumstances:

• With the clinic whose account you belong to, or whose booking page you use
• With service providers listed above, under contractual safeguards
• When required by law, court order, or government authority
• To protect the rights, safety, and security of our users, clinics, or the public
• In connection with a merger, acquisition, or sale of assets, with notice where required

We do not share patient health information with advertisers or data brokers.

9. Data Security

We implement administrative, technical, and organizational measures designed to protect personal data, including:

• Encryption of data in transit and at rest
• Role-based access controls and clinic-level data isolation
• Secure authentication and session management
• Monitoring and logging to detect unauthorized access

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us promptly.

10. Data Retention

We retain personal data for as long as your clinic maintains an active account or as needed to provide the service. Clinics may delete patient records within the platform subject to their own legal and professional obligations.

When an account is closed, we delete or anonymize data within a reasonable period, except where retention is required for legal, accounting, or dispute resolution purposes.

11. Your Rights

Depending on applicable law, including the DPDPA, you may have the right to:

• Access personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of personal data, subject to legal exceptions
• Withdraw consent where processing is based on consent
• Request data portability in a commonly used format, where applicable
• Lodge a grievance with our Data Protection Officer

Clinic staff can update most account information directly in the app or web dashboard. Patients should contact their clinic to exercise rights related to medical records. You may also contact us using the details below.

12. Mobile App Permissions

The Mera Clinic mobile app may request access to certain device features, including:

• Camera — to capture treatment photos and clinical attachments
• Notifications — to deliver appointment and service alerts

You can manage these permissions in your device settings. Denying a permission may limit related features but will not block core account access.

13. Children's Privacy

Mera Clinic Space is intended for use by healthcare clinics and authorized staff. Clinics may record information about minor patients as part of clinical care. We do not knowingly collect personal data directly from children under 18 through our marketing website or public booking pages without appropriate consent from a parent, guardian, or the treating clinic.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page and revise the "Last updated" date. Continued use of the service after changes become effective constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

We aim to respond to privacy requests within 30 days, or within the timeframe required by applicable law.