1.Scope & our role
This policy covers two distinct relationships:
(a) Patient data uploaded by hospitals — we are the processor
When a hospital, clinic or diagnostic centre ("Customer") uses Iqwex, the Customer is the data fiduciary / data controller for all patient data, clinical records and personal data uploaded into its tenant. Enstrics LLP acts as a data processor, processing such data only on the Customer's instructions and as needed to provide the Service. If you are a patient with questions about your medical records, please contact your hospital directly — we cannot release patient data without the Customer's authorisation.
(b) Information about hospital staff and website visitors — we are the controller
Enstrics is the controller for the limited information we collect directly: hospital-staff account information, support communications, and information collected from visitors to our marketing website (iqwex.com). This policy describes how we handle that information.
2.Information we process
Account & staff information
- Name, work email, role, department, mobile number (where provided)
- Login credentials (passwords are stored only as one-way salted hashes)
- Multi-factor authentication tokens, session metadata
- Audit logs of actions taken inside the Service
Customer Data uploaded into the Service
- Patient demographics, ABHA IDs (where the Customer chooses to capture them), allergies, vitals, diagnoses, prescriptions, lab orders and reports, billing records, and other clinical or operational data the Customer enters
- Files and attachments uploaded by Authorised Users
- Configuration data: tariffs, formularies, departments, schedules, etc.
Technical data
- IP address, user agent, device type, time-zone, page navigation logs
- Application telemetry: error logs, performance metrics, request traces
Communications
- Support tickets, emails, chats, and any information you choose to share with us
3.How we use information
- To provide, operate, and maintain the Service for the Customer
- To authenticate users and enforce role-based access controls
- To detect, investigate and prevent fraud, abuse, and security incidents
- To provide customer support and respond to enquiries
- To bill, invoice, and collect fees
- To improve the Service through aggregated, de-identified analytics
- To comply with legal obligations and respond to lawful requests
We do not sell personal data, and we do not use Customer Data (including patient data) to train AI models for any third party. Internal product improvement is performed using only aggregated and de-identified telemetry.
5.How we protect information
Iqwex is hosted on Microsoft Azure, which maintains globally recognised certifications (including ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3 and others). Within that environment, Enstrics implements:
- Tenant-level isolation of Customer Data;
- TLS encryption of all data in transit between clients and the Service;
- Encryption at rest on Azure SQL and Azure Storage using platform-provided mechanisms (e.g., Transparent Data Encryption, Storage Service Encryption);
- Automated backups using Azure-native backup with point-in-time restore, retained for the standard retention configured in our environment;
- Role-based access controls for application users and stricter controls (with multi-factor authentication) for production access by Enstrics personnel;
- Audit logging of user activity inside the application;
- Patching & vulnerability management on operating systems, runtimes and dependencies;
- Secret management using Azure-managed secret stores;
- Hashed passwords with industry-standard one-way hashing — Enstrics personnel cannot read user passwords.
6.Limits of our responsibility & breach handling
- Enstrics is not liable for unauthorised access, loss or disclosure of information caused by cyber-attacks, hacking, ransomware, social engineering, zero-day vulnerabilities, or unauthorised acts of third parties (including Authorised Users of the Customer) — beyond what arises from Enstrics's gross negligence or wilful misconduct.
- Enstrics is not liable for loss of data or disruption arising from natural disasters, fires, floods, earthquakes, pandemics, war, terrorism, civil unrest, regional power or telecom outages, or other Force Majeure events.
- Enstrics is not liable for outages, faults, or service-level breaches by Microsoft Azure or other third-party platforms on which the Service depends.
- Enstrics is not liable for data loss caused by accidental deletion, mis-configuration, or weak security practices on the Customer's side.
If we become aware of a security incident affecting Customer Data within Enstrics's reasonable control, we will use commercially reasonable efforts to investigate, contain and remediate, and to notify the affected Customer in line with applicable law. The Customer, as the data fiduciary, is responsible for any onward notifications to patients, regulators or other authorities. The full liability framework is set out in our Terms & Conditions.
7.Data retention & deletion
We retain Customer Data for as long as the Customer's subscription is active and for a reasonable period thereafter (typically thirty (30) days) to enable export, after which we will delete or anonymise the data from production systems in line with our retention policy and applicable law. Backup copies may persist for a defined retention window before they are recycled in the normal course of business. Account information for hospital staff is retained for the duration of the engagement plus any period required by law.
8.Your rights
Subject to applicable law (including the Digital Personal Data Protection Act, 2023 in India), you may have rights to access, correct, update, or request deletion of your personal data, withdraw consent, or lodge a complaint with the regulator.
- Patients: please direct requests about your medical records to the hospital that holds them. Enstrics, as a processor, will support the hospital in fulfilling its obligations.
- Hospital staff & website visitors: contact support@iqwex.com with your request. We may need to verify your identity before acting.
10.Children's data
The Service is intended for hospital staff and adult patients. Where a hospital captures records of minors as part of patient care, this is done under the hospital's own consent and lawful-basis framework. Enstrics does not knowingly market the Service to children.
11.International transfers
Customer Data is hosted in Microsoft Azure data-centre regions selected by Enstrics, defaulting to a region within India where available. Limited operational data (such as support communications and aggregated telemetry) may be processed outside India by sub-processors, subject to appropriate safeguards.
12.Changes to this policy
We may update this Privacy Policy from time to time. The latest version will always be posted on this page with an updated effective date. Material changes will be communicated through the Service or by email to the Customer's primary contact.
13.Contact us
For privacy questions, requests, or concerns:
- Enstrics LLP
- Trivandrum, Kerala 695572, India
- Email: support@iqwex.com
- Company-level: contact@enstrics.com