Privacy Policy

Who is responsible for your data

Ospia is the trading name of Ospia Technologies, which is the Data Fiduciary for the personal data described here. You can reach us at support@ospia.in.

What we collect, and when

We collect personal data in only three situations.

• When you request a demonstration. The form on our demo page asks for your name, work email, phone number, role, hospital, city, approximate bed count, your current system, and anything you choose to tell us in the message field. You provide all of it deliberately; none of it is inferred or purchased.
• When you subscribe to our newsletter. We store the email address you give us, and the fact and time of your subscription.
• When you simply read the site. We use Cloudflare Web Analytics, which is cookieless and collects aggregate page-level statistics. It does not set cookies, does not fingerprint you, and does not track you across other websites. That is why this site has no cookie banner: there is nothing to consent to.

We do not collect health data, patient data, or any special category of personal data through this website. We do not buy contact lists, and we do not scrape personal data from anywhere.

Why we use it

Demo requests are used to contact you about your enquiry and to prepare a relevant demonstration. Newsletter addresses are used to send the newsletter you asked for. Analytics is used to understand which pages are useful. That is the whole of it — we do not use your data for automated decision-making or profiling, and we do not sell it to anyone, ever.

Our lawful basis is your consent, given when you submit a form or subscribe. You can withdraw it at any time, and withdrawing is as easy as giving it.

Who processes it on our behalf

We keep the list of processors short on purpose. Each one handles data only on our instructions.

• Formspree — receives and forwards demo-request form submissions.
• Brevo — sends our newsletter and holds the subscriber list.
• Cloudflare — cookieless website analytics.
• Render and Neon — hosting and database for our internal marketing systems.

Some of these providers operate servers outside India. Where personal data is transferred outside India, we do so in accordance with the DPDP Act and any restrictions notified under it.

Our LinkedIn Page and other social channels

We publish content on our own LinkedIn Page and other public channels. Our publishing tools have access only to our own Page: they post content we have written and approved, can remove a post we published, and read the aggregate follower count of our own Page for internal reporting. They do not access member profiles, connections, messages, or any personal data about the people who follow or interact with us.

When you interact with us on a social platform, that platform's own privacy policy governs the data it holds about you. We do not control it.

How long we keep it

We keep demo-request data for as long as needed to respond to your enquiry and for any resulting business relationship, and we delete it when it no longer serves that purpose. Newsletter subscriptions are kept until you unsubscribe. When you unsubscribe we retain your email address on a suppression list — the sole purpose of which is to make sure we never email you again.

Your rights

Under the DPDP Act, 2023, you have the right to:

• ask what personal data of yours we hold and how we are using it;
• have inaccurate or incomplete data corrected, completed or updated;
• have your data erased when it is no longer needed;
• withdraw consent at any time;
• nominate another person to exercise these rights on your behalf if you are unable to; and
• raise a grievance with us, and escalate to the Data Protection Board of India if we do not resolve it.

To exercise any of these, email support@ospia.in. Every newsletter also carries a one-click unsubscribe link in its footer, which takes effect immediately and needs no explanation.

Grievance redressal

If you are unhappy with how we have handled your personal data, write to support@ospia.in. We aim to respond within 7 days. If we do not resolve it to your satisfaction, you may escalate to the Data Protection Board of India.

Security

We hold as little personal data as we can, for as short a time as we can. Data in our own systems is encrypted in transit and at rest, and access is limited to the people who need it. No system is perfect, and we will not claim otherwise — if a breach ever affects your data, we will notify you and the Data Protection Board as the Act requires.

Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top. Material changes will be notified to newsletter subscribers directly.