What we collect, and what you can do about it.

What we collect, and when

Nothing is collected from you if you only read the pages. There are two places where you can give us personal data, and both are things you choose to do.

The first is the walkthrough enquiry form. It asks for:

• Your name — so we know who we are replying to
• Your role — so we bring the right person to the conversation
• Your work email — to reply to you and confirm we received the enquiry
• Your phone number — optional — only if you would rather we called
• Your hospital or group, and city — to understand who is asking
• Your hospital’s size and information system — so the walkthrough is relevant rather than generic
• Anything you type in the message box — whatever you choose to tell us
• Your IP address — held in memory for sixty seconds to stop the form being abused, then discarded. It is never stored or logged.

The chat assistant

The second is the chat assistant in the corner of the page. Whatever you type into it is sent through OpenRouter to an available third-party AI model provider to generate the reply. The selected provider can vary, and this processing takes place outside India. We do not store the conversation and we do not log it — it exists only for as long as the exchange takes.

So please do not put patient information, health details or anything confidential into it. It is there to answer questions about the product, and a question about the product never needs those. If you want to discuss something specific to your hospital, use the enquiry form or email us and you will be talking to a person.

This is a deliberate distinction worth being clear about: the AI inside DPDP Shield is self-hosted and processes hospital data without it leaving the deployment. The assistant on this marketing site is not the same system, and does not touch any hospital’s data.

Why we collect it

The specific purpose is to respond to your enquiry and arrange a product walkthrough. That is all.

We do not use it to build a profile, we do not sell it, we do not share it with anyone for their own purposes, and we will not add you to a marketing list from this form.

What this lets us do for you

Providing us this information enables us to:

• Reply to you — within one working day
• Schedule a walkthrough — of the platform, shaped around your hospital rather than a generic demo
• Bring the right people — a DPO or a security engineer, depending on what you asked about
• Answer accurately — knowing your information system, so we do not promise a connector we do not have

Cookies and tracking

This site sets no advertising or analytics cookies, and there are no third-party trackers on it. We do not use Google Analytics or anything comparable.

The only browser storage we use is a single entry that remembers you have already seen the opening animation, so you are not shown it twice. It is not used to identify or follow you, and there is therefore no cookie banner to click through.

How long we keep it

We keep an enquiry for as long as the conversation it started is live, and for twelve months afterwards so we can pick up a thread you left open. After that it is deleted.

If you ask us to delete it sooner, we will, unless we are required to keep something — in which case we will tell you what and why.

Who else can see it

Our own team, and our email provider, which transmits the enquiry to us and sends your confirmation. That provider processes it only to deliver the message. Details of where it operates are in the "Where your data goes" section below, because we would expect you to ask.

Where your data goes

Two different answers, and the distinction matters.

Patient data in a hospital running DPDP Shield stays in India. In on-premise and hybrid deployments it never leaves the hospital’s own servers; in our cloud it sits in AWS Mumbai. Our AI runs self-hosted, so no patient data is ever sent to an external model provider. That is a design commitment, not a preference.

A business enquiry from this form is different, and we would rather say so than let you assume otherwise. It is delivered by a third-party email service whose infrastructure is outside India, so your name, email and what you wrote in the form transit that service in order to reach our inbox. The chat assistant works the same way, sending what you type to an AI provider outside India. No patient data is involved in either.

If you would prefer not to send business-contact details through a non-Indian provider, write to us directly instead — the address is at the bottom of this notice, and an email straight to us takes the same path as any other email you send.

Your rights, and how to use them

Under the Digital Personal Data Protection Act, 2023 you may ask us for a copy of the personal data we hold about you, ask us to correct or complete it, ask us to erase it, withdraw a consent you have given, and nominate someone to exercise these rights for you if you are unable to.

To do any of these, write to our Data Protection Officer at hello@promptly.co.in. Tell us what you want and we will act on it. We will not ask you to justify the request.

Withdrawing your consent stops us processing your enquiry further. It does not undo a conversation that has already happened.

If you are not satisfied

Tell our Data Protection Officer first, at hello@promptly.co.in. We are required to respond, and we would rather fix it than have it escalated.

If you are still not satisfied, you have the right to complain to the Data Protection Board of India. You can do this yourself, directly. You do not need our permission, our involvement, or our help.