Privacy Policy

1. Who we are

Relaso Billing Pro is operated by Relaso. For the account data of our own customers we act as a data fiduciary under the DPDP Act and as a controller under the GDPR. For the data your business puts into the platform — your customers, invoices and contacts — you are the controller and we act as your processor, on your instructions, under the terms of our Data Processing Agreement.

2. What we collect and why

We do not sell personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects.

3. Health data

Customers using the diagnostics module may record clinical information about patients, including medical history. This is special category data under GDPR Article 9 and sensitive personal data in practice under the DPDP Act. Where it is processed, it is encrypted at rest, restricted to users who need it, and processed solely on the instructions of the customer who collected it. Customers using this module are responsible for obtaining explicit consent from their patients.

4. Cookies and similar technologies

We use strictly necessary storage to keep you signed in, which does not require consent. Analytics storage is used only if you accept it in the banner shown on your first visit, and you can change that decision at any time in Settings → Privacy & Data. Declining analytics does not limit any feature of the product.

5. How long we keep it

• Account data: for as long as your account is open.
• Analytics events: 400 days, then automatically deleted.
• Audit and activity logs: 730 days, then automatically deleted.
• Invoices and accounting records: retained for the statutory tax retention period, even after you close your account. See section 7.

6. Who else sees your data

We share personal data only with the processors we need to run the service, listed on our sub-processors page. Each is bound by contract to process data only on our instructions. We do not disclose personal data to anyone else except where the law requires it.

7. Your rights

You can exercise all of the following yourself in Settings → Privacy & Data, without contacting us:

• Access and portability (GDPR Art 15 and 20; DPDP S.11) — download a machine-readable JSON copy of your account data and the records you created.
• Correction (GDPR Art 16; DPDP S.12(1)) — edit your profile and organisation details directly.
• Withdrawing consent (GDPR Art 7(3); DPDP S.6(4)) — turn analytics or marketing off. Withdrawal is as easy as consenting and takes effect immediately.
• Erasure (GDPR Art 17; DPDP S.12(3)) — delete your account.

An honest limit on erasure: we cannot delete invoices, payments and accounting entries, because tax law requires us to keep them. When you delete your account we erase your name, email, credentials and marketing records, and unlink those financial records from your identity — but the records themselves remain. This is the legal-obligation exemption in GDPR Article 17(3)(b). Everything not covered by that exemption is erased.

Under the DPDP Act you may also nominate another individual to exercise your rights in the event of your death or incapacity (S.14), and you have the right to grievance redressal (S.13). Under the GDPR you may object to processing based on legitimate interests (Art 21) and lodge a complaint with your national supervisory authority.

8. Children

Relaso Billing Pro is business software and is not directed at children. We do not knowingly create accounts for anyone under 18. Consistent with DPDP Section 9, we do not carry out behavioural tracking or targeted advertising directed at children. If you believe a child has registered, contact the Grievance Officer below and we will delete the account.

9. Where your data is held

Our production systems and backups are hosted on dedicated servers in Mumbai, India, operated on our behalf by our infrastructure provider. Personal data of Indian data principals therefore stays in India.

If you are in the European Economic Area, your personal data is transferred to India. India is not the subject of a European Commission adequacy decision, so we rely on the Standard Contractual Clauses adopted by the Commission, together with a transfer impact assessment and the technical measures described in section 10. A copy of the clauses is available from the Grievance Officer on request. We will tell you in advance if the hosting location changes.

10. Security

Passwords are stored using bcrypt and are never recoverable. Two-factor secrets and clinical free-text are encrypted at rest. API credentials are stored as irreversible hashes. Every database query is scoped to your organisation at the data-access layer, so one customer’s records cannot be returned to another. Traffic is encrypted in transit with TLS. No system is perfectly secure, but these are the measures we consider appropriate under GDPR Article 32 and DPDP Section 8(5).

11. If there is a breach

If a personal data breach occurs we will notify the Data Protection Board of India and every affected individual as required by DPDP Section 8(6), and, where the GDPR applies, the relevant supervisory authority within 72 hours under Article 33 and affected individuals under Article 34.

12. Grievance Officer and contact

In accordance with Section 13(3) of the DPDP Act, the following person is responsible for answering questions and grievances about how we handle personal data. We aim to respond within 7 days and will in any event respond within the statutory period.

Angsuman Chakraborty
Grievance Officer & Data Protection Contact, Relaso
privacy@relaso.com

For general support, contact support@relaso.com. This notice is available in English; on request to the Grievance Officer we will provide it in any language listed in the Eighth Schedule to the Constitution of India.