Privacy Policy
How we protect your information

This Privacy Policy explains how Ancoda Labs ("Ancoda", "we", "us", or "our"), the developer of DANTA-Med, collects, uses, shares, and protects personal information when you visit danta-med.ancodalabs.com (the "Website"), use the DANTA-Med mobile app for iOS and Android (the "App"), or contact us about DANTA-Med.

It also explains, at a high level, how we handle clinical information when a hospital or clinic uses the DANTA-Med clinical scribe service (the "Service"). The processing of patient data within the Service is also governed by the written agreement between Ancoda and each healthcare facility.

By using the Website, you acknowledge that you have read and understood this policy. If you do not agree with it, please do not use the Website or submit information to us.

Information you give us

When you submit the deployment request form on our contact page, or email us, we collect:

• Your name and email address
• The name of your hospital or clinic
• Your approximate daily patient load
• Any message or other details you choose to include

Please do not include patient information or other sensitive health data in the contact form or in general enquiries.

Information collected automatically

Like most websites, our hosting infrastructure automatically records basic technical information when you visit, such as your IP address, browser type, device type, the pages you request, and the date and time of your request. This information is kept in server logs used for security, troubleshooting, and keeping the Website running reliably.

The Website does not currently use analytics, advertising, or tracking cookies. See our Cookie Policy for details.

Information processed through the Service

When a healthcare facility uses DANTA-Med, the Service processes consultation audio, transcripts, and the clinical notes generated from them, together with the account details of authorized clinical staff (such as name, role, facility, and login credentials).

Information collected through the App

When a doctor uses the App, we collect:

• Account details: name, email address, password (stored only in hashed form), or the name, email, and profile picture from Sign in with Apple or Google sign-in if you choose those options
• Professional details: license number, specialization, hospital or clinic, and the profile photo, logo, letterhead, and signature you choose to upload
• Consultation data: the audio you record with the microphone when you start a consultation, the transcript produced from it, the clinical notes and prescriptions generated and edited by you, and the patient details you enter (such as name, patient ID, age, gender, and weight)
• Device data: a device identifier used to keep you signed in, and a push notification token used to tell you when a note is ready

The App uses the microphone only while you are recording a consultation, and the camera or photo library only when you choose to add an image. The App does not use advertising or third-party tracking.

We use the information we collect to:

• Respond to your enquiries, schedule demonstrations, and discuss pilot programs or deployments
• Provide, operate, maintain, and support the Service for healthcare facilities that use it
• Keep the Website and Service secure, and detect and prevent abuse, fraud, or unauthorized access
• Diagnose technical problems and improve the performance of the Website
• Comply with our legal obligations and enforce our agreements

We do not sell your personal information, and we do not use it for third-party advertising.

Within the Service, the healthcare facility decides what patient information is collected and how it is used. The facility acts as the data controller, and Ancoda processes patient data on the facility's behalf and under its instructions.

• Consultation audio: in our standard cloud setup, audio is stored securely in our cloud storage so that it can be processed, replayed by the doctor, and reprocessed if needed. Only the doctor and authorized staff of their facility can access it, and it is kept in line with the facility's agreement and instructions.
• On-premise deployments: when a facility chooses our local server setup, audio, transcripts, and records are processed and stored on the facility's own infrastructure and do not leave the building.
• Access control: only authorized clinical staff can access patient notes, with role-based permissions set by the facility.
• AI processing: to produce transcripts, clinical notes, and prescriptions, consultation audio, transcripts, and the patient details entered for the consultation are processed by a third-party AI service provider acting on our behalf. The App explains this and asks the doctor for permission before any consultation data is sent, and the doctor can withdraw that permission at any time in the App's settings. Without it, the App does not record or process consultations.
• No model training without permission: we do not use identifiable patient data to train or improve our AI models unless the facility has expressly agreed to it in writing.

Healthcare facilities are responsible for informing patients about the use of DANTA-Med during consultations and for obtaining any consent required by applicable law. Patients who have questions about their records should contact the facility that treated them in the first instance.

We share personal information only in the following limited circumstances:

• Service providers: trusted vendors that help us run our business, such as website hosting, cloud infrastructure, and email delivery. They may use the information only to provide services to us and must protect it.
• AI service provider: a third-party AI service provider processes consultation audio, transcripts, and patient details entered for a consultation, only to generate transcripts, clinical notes, and prescriptions for the doctor, and only after the doctor has given permission in the App. The provider acts on our instructions under a contract, may not use the data for its own purposes or sell it, and is required to protect it to the same or an equal standard as described in this policy.
• Authentication and notifications: if you choose Sign in with Apple or Google sign-in, those services confirm your identity; we use a cloud messaging service to deliver push notifications. They receive only what is needed for that purpose.
• Healthcare facilities: clinical notes and related data are made available to the facility that generated them and its authorized staff.
• Legal requirements: when we believe disclosure is required by law, regulation, court order, or a valid request from a public authority.
• Protection of rights: when necessary to protect the rights, property, or safety of Ancoda, our users, patients, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy's protections continuing to apply.

We keep personal information only for as long as we need it for the purposes described in this policy:

• Enquiries and related correspondence are kept for as long as needed to respond and manage our relationship with you, and then deleted or anonymized.
• Server logs are kept for a limited period for security and troubleshooting.
• Clinical records within the Service are kept in line with the facility's agreement and instructions, and in line with medical record-keeping laws that apply to the facility.

Deleting your App account

You can delete your account at any time in the App, under Settings > Delete Account. Deleting your account signs you out on all devices, ends your access, and removes your sign-in details. Clinical records you created, such as consultations, prescriptions, and patient details, are part of the facility's medical records and are kept as described above where the law or the facility's agreement requires it. You can also ask us to delete your information by emailing info@ancodalabs.com.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and role-based permissions. For facilities with strict data residency needs, we offer on-premise deployment so records stay on the facility's own servers.

No method of transmission or storage is completely secure. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities as required by law.

Depending on the laws that apply to you, including Nepal's Individual Privacy Act, 2075 (2018), you may have the right to:

• Ask for access to the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete your information, subject to legal record-keeping requirements
• Object to or ask us to restrict certain processing
• Withdraw consent at any time where we rely on consent, including your permission for AI processing, which you can withdraw in the App's settings

To exercise any of these rights, email us at info@ancodalabs.com. We may need to verify your identity before responding. Requests about patient records held within the Service will be referred to, or handled together with, the relevant healthcare facility.

Ancoda is based in Nepal. Some of our service providers may process information in other countries. Where this happens, we take reasonable steps to make sure your information stays protected as described in this policy. Facilities that need all data to stay in their own premises can choose our on-premise deployment.

The Website is intended for healthcare professionals and organizations and is not directed at children. We do not knowingly collect personal information from children through the Website. Information about minor patients processed through the Service is handled under the facility's instructions and applicable law.

The Website links to third-party sites and platforms, such as Instagram, LinkedIn, and Facebook. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page and, where the changes are significant, provide additional notice. Your continued use of the Website after an update means you accept the revised policy.

If you have questions or concerns about this Privacy Policy or how we handle personal information, please contact us:

Ancoda Labs
Kathmandu, Nepal
Email: info@ancodalabs.com