Privacy Policy

Website, portals, OPD and Meta/WhatsApp integration · Updated September 9, 2026

This Privacy Policy explains how Smart Kare Solutions collects, uses, stores and shares personal information through smartkaresolutions.com, the HMS Portal, OPD workspace, super-admin portal and the Meta/WhatsApp integration described below. It applies to website visitors, account owners, staff and people whose information is entered by a healthcare organization.

For privacy questions or requests, contact info@smartkaresolutions.com.

1. Our role and your healthcare organization

Smart Kare Solutions manages information used to operate its website, customer accounts, support and platform security. When a hospital or clinic enters patient or staff information into its workspace, that organization determines the care-related purposes and is responsible for its authority to collect and use that information. We process workspace information to provide and support the service for that organization. Its own privacy notice and applicable service agreement also govern its use of your records.

2. Information we process

• Registration and account information: organization and owner names, email address, phone and country calling code, official account ID, address and location, website, date of birth, gender, optional profile information, profile photograph, plan, team size, trial dates and any discount offer applied.
• Patient and visit information entered by your organization: patient name and UHID, family or guardian details, age, date of birth, gender, blood group, contact and address details, emergency contact, medical history, allergies, visits, consultation fees, payment status, vital signs, clinical notes, diagnoses, prescriptions and uploaded case documents.
• Staff and support information: staff directory details, roles, support ticket subject and description, attachments, status and responses.
• Authentication and security information: password hashes, temporary verification information, session identifiers, IP-derived rate-limit identifiers and audit records of platform administration, service changes and temporary administrator access. Web hosting and application logs may contain IP addresses, request details, timestamps and errors.
• Meta integration information: business and WhatsApp account identifiers, administrator-supplied connection credentials, message-template content and metadata, and template status events, as explained in section 4.

Trial registration does not collect card numbers or process online payments. A healthcare organization can separately record consultation charges and payment status in OPD.

3. Why we use information

We use information to verify and authenticate accounts, create and operate workspaces, maintain patient and visit records at the organization's direction, display clinical catalogues, administer trials and selected plans, respond to support requests, manage authorized integrations, detect misuse and investigate security issues. Platform administrators can access organization information for administration and support; temporary access to an organization account is recorded in the audit log.

We do not sell personal information or use patient records or Meta Platform Data for advertising. We use Meta data only for the integration functions described in this policy. Where applicable law requires consent or another legal basis, processing is subject to that requirement; healthcare organizations must establish the appropriate authority for the records they enter.

4. Meta and WhatsApp Business integration

The current integration is an administrator-managed WhatsApp Business template manager. It does not offer Facebook Login, import Facebook profiles or friend lists, or automatically send WhatsApp messages to patients.

• Information supplied by an administrator: Meta business ID, WhatsApp Business Account ID, phone number ID, API version, access token, app secret and webhook verification token. Credentials authenticate authorized API requests and verify webhook events; they are not displayed as plain text in the settings response.
• Information exchanged with Meta: template names and IDs, language, category, text headers, body text, variable examples and footers. When an administrator submits, synchronizes or deletes a template, the relevant identifiers and content are exchanged with Meta's Graph API. Do not put real patient information or other sensitive information in template examples.
• Information received and stored: template content and review status returned by Meta, and verified template-status webhook events. Stored event records contain template identifiers, status and receipt time. Incoming webhook payloads are checked to identify relevant events; the current handler does not retain incoming patient chat messages as conversation records.
• Purpose and access: to create and manage templates, obtain review results, synchronize template status and record which organizations may use a template. Access is limited to authorized platform administration and the relevant integration functions.

Meta processes information it receives under its own applicable terms and Privacy Policy. This policy does not replace or override Meta's terms or policies. Requests concerning data held by Smart Kare Solutions can be made using the deletion instructions below; deleting our copy does not by itself delete records held independently by Meta.

5. Approximate location, cookies and browser storage

Forms with automatic location suggestions send your connection IP address to IPWhois to suggest country, state or province, city and calling code. This is approximate IP-based location, not GPS tracking. Successful suggestions are cached in your session for up to 30 minutes and you can correct them manually. Confirmed location fields are stored with the applicable registration or patient record.

Essential session cookies support sign-in, verification and request security. Browser local storage remembers your selected light/dark theme and, if you choose “Remember username” on the super-admin login, that username. It does not store your password. You can clear these preferences through your browser or deselect the remember option. Blocking essential cookies can prevent sign-in. The current application does not install advertising or third-party analytics trackers.

6. Sharing, hosting and international processing

Information may be available to your healthcare organization's authorized users, authorized Smart Kare platform administrators, and hosting, infrastructure and email providers needed to run the service. Meta receives the integration data described above, and IPWhois receives the IP address used for location suggestions. We may disclose information when required by law or where necessary to address fraud, security incidents or the protection of legal rights.

Processing locations depend on the hosting region and the providers used by your organization and Smart Kare Solutions; information may be processed outside your country. Contact us for information about the hosting arrangement relevant to your account. We do not promise that records remain in a particular country unless that is part of your service agreement.

7. Retention and security

Account and workspace records are retained while needed to provide the service and meet applicable legal, contractual, clinical-record or security obligations. Expiration of a seven-day trial does not automatically delete its records. Healthcare-record retention depends on the responsible organization's requirements; account, support, audit and integration records may have different retention needs. We assess deletion requests against those obligations and remove information that no longer needs to be retained.

Email verification codes expire after 10 minutes. Session and temporary access information expires according to its security purpose. A browser-saved username or theme remains until you change or clear it. If backup copies exist, removal from active records may precede removal as backups are replaced; necessary retained copies are not intended for ordinary service use.

Controls include password hashing, authorization checks, separate organization access, protected file downloads, request verification, audit records and encryption of stored Meta connection secrets. These controls do not mean every stored field is encrypted. No system can guarantee absolute security; keep credentials private and notify us of suspected unauthorized access.

8. Access, correction and other choices

You may request access to, correction of, or deletion of your personal information by contacting us. Depending on applicable law, you may also have rights to receive a copy, restrict or object to certain processing, withdraw consent where processing depends on it, or complain to a competent privacy authority. We may need to verify your identity or authority before acting and will respond within applicable legal time limits.

Account owners can update available profile fields in the portal. For patient records, contact the hospital or clinic that maintains your record first; it determines whether a correction or deletion is appropriate and legally permitted. You can also contact us and identify the organization so we can help route the request. Withdrawal of consent does not undo lawful processing already completed.

9. Data-deletion requests

Anyone whose information is processed by Smart Kare Solutions can request deletion, including people who cannot sign in. No account login is required to send a request.

1. Email info@smartkaresolutions.com with the subject Data deletion request.
2. Provide your name, a contact email, the relevant organization or clinic, and enough information to identify the account or records concerned. For Meta/WhatsApp integration data, identify the business or WhatsApp account or template where known, and describe which information you want removed. Do not send passwords, access tokens, app secrets or complete medical documents.
3. We will verify the requester's identity and authority using information appropriate to the request. If the records are controlled by a healthcare organization, we will coordinate with that organization or direct you to its responsible contact.
4. We will explain the outcome and any information that must be retained, including the reason. Deletion may be limited by clinical-record retention duties, legal requirements, security needs or another applicable obligation. Requests are handled within applicable legal time limits; emailing a request does not instantly erase a workspace.

You may request deletion of information received through Meta as well as information supplied directly to us. Removing or revoking a Meta connection stops future access using that connection but does not automatically remove previously stored data. Ask us to remove those stored records too. For data independently held by Meta, use Meta's own privacy controls or request process.

Account deletion can remove access to the service. Healthcare organizations should arrange any required record handover before requesting deletion. These are data-deletion instructions, not an automated Meta deletion callback.

10. Children and dependent patients

The website and administrator portals are intended for authorized healthcare and business users, not for children to create their own administrator accounts. A healthcare organization may enter records about children or dependent patients where it has the necessary authority and safeguards. A parent or guardian seeking access, correction or deletion should contact the treating organization, or contact us for assistance identifying the responsible workspace.

11. Updates and contact

We update this policy when our services or data practices change and show the revision date on this page. Material changes will be communicated through an appropriate service notice. New uses of information remain subject to applicable notice and consent requirements.

Smart Kare Solutions — Privacy enquiries
info@smartkaresolutions.com
smartkaresolutions.com