Privacy Policy

Introduction & Scope

CanTRAC is a breast cancer patient management platform developed and operated by OneHeal Technologies Pvt. Ltd., registered at 3rd Floor, Property No. 55, Gadaipur, Near Westend Marg, South Delhi, Delhi – 110030.

This Privacy Policy explains how we collect, use, store, and protect personal and health-related information submitted through the CanTRAC platform, including the mobile application, physical diary scanning system, and web dashboard.

By using CanTRAC, you agree to the terms of this Privacy Policy. This policy applies to all users — patients, doctors, clinic assistants, vendors, and administrators.

Information We Collect

We collect the following categories of information:

Patient Information (collected via diary scanning):

• Name, age, sex, UHID (Unique Hospital ID), NCI number
• Contact details: phone number, address
• Health information: investigation schedules and results, treatment plans (NACT, surgery type, radiotherapy), chemotherapy status, surgery admission dates
• Diary page images (scanned photographs of physical diary pages)

Doctor & Clinic Staff Information:

• Name, professional registration details, email address
• Hospital/clinic name and location
• Login credentials (passwords stored as bcrypt hashes — never in plain text)

Usage Data:

• Pages visited, features used, timestamps of diary uploads
• Device type, browser, IP address (for security purposes only)

How We Use Your Information

We use collected information exclusively for:

• Providing the CanTRAC diary tracking service to patients and their treating doctors
• Extracting structured clinical data from scanned diary pages using AI processing
• Sending notifications to doctors and assistants about patient updates, missed appointments, and critical flags
• Generating clinical reports and analytics for treating physicians
• Improving the accuracy of our AI data extraction models (using anonymised data only)
• Complying with applicable Indian laws and healthcare regulations

We do not use patient data for marketing, advertising, or sale to third parties.

Data Sharing & Disclosure

Patient data is shared only with:

• The patient's registered treating doctor on the CanTRAC platform
• Authorised clinic assistants assigned by the treating doctor
• OneHeal Technologies technical staff, solely for platform operation and support

We may disclose information if required by:

• A valid court order or government directive under applicable Indian law
• Medical emergency situations where disclosure is necessary to protect patient safety

Data Security & Storage

• All data is stored on secure cloud servers within India
• Data transmission is encrypted using TLS 1.3
• Passwords are hashed using bcrypt — never stored in plain text
• Diary page images are stored with access control — only the patient's treating team can view them
• Data retention: Diary images are retained for 1 year from activation. Structured records are retained for 2 years. After these periods, data is deleted or anonymised per our retention policy.
• Regular security audits are conducted by our engineering team

Patient Data Rights

Under applicable Indian law and as a matter of our policy, patients have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Request correction of inaccurate records
• Deletion: Request deletion of your data (subject to medical record retention requirements)
• Portability: Request your data in a machine-readable format
• Withdrawal of consent: Stop using the platform at any time

To exercise these rights, contact our Grievance Officer (details below).

Cookies & Tracking

The CanTRAC web dashboard uses:

• Essential cookies: Required for login session management
• Preference cookies: Storing your dark/light mode preference
• No advertising cookies, no third-party tracking pixels

You can clear cookies via your browser settings. Clearing essential cookies will log you out.

Contact & Grievance Officer