Privacy Policy

1. Introduction

Tevana Health ("we," "our," or "us") is committed to protecting the privacy and security of personal information and protected health information (PHI) entrusted to us by our clients and their patients. This Privacy Policy explains how we collect, use, disclose, and safeguard information in connection with the Tevana Health electronic health record (EHR) platform and related services.

This policy applies to all users of the Tevana Health platform, including healthcare providers, clinic administrators, and patients accessing the patient portal. By using our services, you agree to the practices described in this policy.

2. Information We Collect

2.1 Healthcare Provider Information

When a healthcare organization subscribes to Tevana Health, we collect:

• Organization name, address, and contact information
• Medical license and registration numbers
• Billing and payment information
• Administrator and user account credentials (encrypted)
• Usage data and platform interaction logs

2.2 Patient Health Information

Through the EHR platform, healthcare providers enter and store patient information including:

• Demographic information (name, date of birth, contact details)
• Clinical data (medical history, diagnoses, medications, lab results, imaging)
• Insurance and billing information
• Appointment and visit records
• Communications between patients and providers through the portal

Tevana Health processes this information as a data processor on behalf of healthcare providers, who act as the data controller. Patient data is subject to the applicable health data regulations of the jurisdiction in which the healthcare provider operates.

2.3 Technical Data

We automatically collect technical information when you use our platform, including IP addresses, browser type, device identifiers, log data, and session activity. This information is used for security monitoring, service improvement, and troubleshooting.

3. How We Use Information

We use collected information to:

• Provide, operate, and maintain the Tevana Health platform
• Process and facilitate health information exchange in compliance with local regulations (Nabidh, Malaffi, ABDM, etc.)
• Automate insurance claim submission and billing workflows
• Generate analytics and reporting for healthcare providers
• Provide customer support and technical assistance
• Maintain security, detect fraud, and ensure platform integrity
• Comply with legal and regulatory obligations
• Improve our AI models and clinical decision support tools (using de-identified, aggregated data only)

4. Data Sharing & Disclosure

We do not sell personal or health information. We may disclose information in the following limited circumstances:

• Health Information Exchanges: As required for regulatory compliance (e.g., Nabidh, Malaffi, ABHA), patient data is transmitted to authorized national health information systems in accordance with provider configuration and applicable law.
• Sub-processors: We engage trusted third-party service providers (cloud infrastructure, security monitoring) under strict data processing agreements that prohibit independent use of your data.
• Legal Requirements: We may disclose information when required by law, court order, or government authority, and will notify affected parties where legally permitted.
• Business Transfers: In the event of a merger or acquisition, data may be transferred with appropriate notice and subject to this policy.

5. Data Residency & International Transfers

Tevana Health maintains region-specific data residency to comply with local regulations:

• UAE: All patient data for UAE-based clients is hosted exclusively on servers located within the United Arab Emirates, complying with applicable data sovereignty requirements.
• India: All patient data for India-based clients is hosted on servers located within India, in compliance with applicable Indian data protection law.
• Other Regions: Data residency requirements for other markets are configured at the time of implementation in accordance with local law.

6. Security

We implement industry-leading security measures including:

• End-to-end encryption for all patient health records in transit and at rest
• SOC 2 Type II certified infrastructure
• HIPAA-compliant technical and administrative safeguards
• Multi-factor authentication for all administrative accounts
• Regular penetration testing and vulnerability assessments
• Role-based access controls and comprehensive audit logging
• 24/7 security monitoring and incident response protocols

7. Data Retention

We retain healthcare provider account information for the duration of the service agreement and for a period thereafter as required by applicable law. Patient health records are retained in accordance with the medical record retention laws applicable to the jurisdiction of the healthcare provider. Upon contract termination, we provide data export functionality and securely delete or return data as specified in the service agreement.

8. Your Rights

Depending on your jurisdiction, you may have rights regarding your personal information, including the right to access, correct, or request deletion of your data. Healthcare providers should direct patient data requests to their primary care provider in the first instance. For inquiries about your rights or to submit a data request, contact us at privacy@tevanahealth.com.

9. Cookies & Tracking

Our platform uses strictly necessary cookies to maintain session security and authentication. We do not use advertising cookies or third-party tracking technologies on clinical platform pages. Our public marketing website uses analytics cookies with the option to opt out.

10. Children's Privacy

The Tevana Health platform is a clinical tool used by healthcare professionals. Where patient records relate to minors, healthcare providers are responsible for ensuring appropriate consent has been obtained from parents or legal guardians in accordance with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active subscribers of material changes by email no less than 30 days before the change takes effect. Continued use of the platform following notification constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, data requests, or to report a concern, please contact our Data Protection Officer:

• Email: privacy@tevanahealth.com
• UAE: dpo-uae@tevanahealth.com
• India: dpo-india@tevanahealth.com
• General: hello@tevanahealth.com