01Introduction

Catalyst Healthcare Software ("Catalyst", "we", "us" or "our") respects your privacy. This Privacy Policy explains what personal data we collect when you visit our website, contact us, request a demo or quote, apply for a job, or use our Hospital Management Software (HMS), and how we use, store, share and protect that data.

This policy is prepared in line with applicable Indian law, including the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). By using our website or services, you agree to the practices described here.

02Who We Are

Catalyst Healthcare Software was established in 2007 in Vadodara, Gujarat, India. We develop and support Hospital Management Software for clinics, nursing homes, diagnostic centres and multispeciality hospitals.

• For data collected through this website (enquiries, quotes, job applications), Catalyst is the Data Fiduciary and decides how that data is used.
• For hospital and patient data entered into Catalyst HMS by our clients, the healthcare facility is the Data Fiduciary and Catalyst acts as a Data Processor on its behalf (see Section 07).

03Information We Collect

Information you give us directly:

• Enquiry, contact and quote forms: name, email address, phone number, hospital or organisation name, city, subject and the message or requirements you share.
• Demo requests: contact details, facility type, number of beds or users, and preferred date and time.
• Job applications: name, contact details, resume/CV, qualifications, work experience and any other details you include in your application.
• Communication: emails, calls, WhatsApp messages and support tickets you send to us.

Information collected automatically:

• IP address, browser type, device type, operating system and approximate location (city/region).
• Pages visited, time spent on pages, referring website and links clicked.
• Cookie and similar identifiers, as explained in Section 06.

We do not ask website visitors for sensitive information such as health records, bank details, passwords or government ID numbers through this website. Please do not share such details in our enquiry forms.

04How We Use Your Information

We use your personal data only for clear and lawful purposes, including to:

• Respond to your enquiries, prepare quotes and schedule product demos.
• Deliver, implement, maintain and support our software for clients.
• Send service-related updates such as renewals, upgrades, maintenance notices and invoices.
• Send information about new features, modules or offers, only where you have agreed to receive it. You can opt out at any time.
• Evaluate job applications and contact shortlisted candidates.
• Understand how visitors use our website so we can improve content, speed and user experience.
• Protect our website and systems from fraud, spam, misuse and security threats.
• Comply with legal, tax, accounting and regulatory obligations.

We do not sell, rent or trade your personal data to anyone.

05Consent & Legal Basis

We process your personal data on the basis of:

• Consent: when you submit a form, apply for a job or subscribe to updates. You may withdraw your consent at any time by writing to us. Withdrawal does not affect processing already carried out before it.
• Legitimate uses permitted by law: such as performing a contract with a client, keeping records required by law, or responding to a lawful request from a government authority.

06Cookies & Analytics

Cookies are small text files stored on your device when you visit a website. We use them to keep the website working properly and to understand how it is used.

• Essential cookies: needed for basic website functions such as page navigation and form submission.
• Analytics cookies: we use Google Analytics, which may be loaded through Google Tag Manager, to collect information such as pages visited, time on site, device type and approximate location. This data is aggregated and helps us improve the website. It is not used to identify you personally.

Google processes this data under its own privacy policy. You can learn more at How Google uses information from sites that use its services, and you can opt out using the Google Analytics Opt-out Browser Add-on.

You can also block or delete cookies through your browser settings. Some parts of the website may not work correctly if essential cookies are disabled.

07Hospital & Patient Data in Catalyst HMS

Our clients use Catalyst HMS to manage patient registrations, OPD/IPD records, EMR, billing, pharmacy, laboratory, radiology and related information ("Client Data"). Client Data may include sensitive health information about patients.

• Client Data belongs to the healthcare facility. The facility is responsible for obtaining patient consent where required and for the accuracy of the data it enters.
• Catalyst processes Client Data only on the client's instructions and only to provide installation, hosting (where applicable), support, maintenance, backup, data migration and upgrade services.
• Our team accesses Client Data only when it is necessary for a support or service request, and only by authorised staff bound by confidentiality obligations.
• Where the software connects with ABDM / ABHA, Client Data is exchanged according to the consent framework and standards set by the National Health Authority.
• We never use Client Data for marketing, and we never sell or share it with third parties for their own purposes.

Patients who wish to access, correct or delete their health records should contact the hospital or clinic that holds their records. We will support our clients in responding to such requests.

08Sharing & Disclosure

We share personal data only when needed and only with:

• Service providers who help us run our business, such as web hosting, cloud servers, email, SMS/WhatsApp messaging and analytics providers. They may use the data only to provide services to us.
• Integration partners such as ABDM, Tally, WhatsApp, PACS, laboratory machine interfaces and payment gateways, when a client enables those integrations.
• Authorised implementation partners working with us on a client project, under confidentiality obligations.
• Government or law enforcement authorities when required by law, court order or legal process.
• A successor entity in case of a merger, acquisition or restructuring, subject to the same privacy protections.

Some service providers may store or process data on servers located outside India. Where this happens, we take reasonable steps to ensure the data is protected and that the transfer is permitted under Indian law.

09Data Security

We use reasonable technical and organisational safeguards to protect personal data from unauthorised access, loss, misuse or alteration, including:

• SSL/TLS encryption for data sent through our website.
• Role-based access control and password-protected user accounts in our software.
• Regular data backups and restricted access to servers.
• Confidentiality obligations for our employees and partners.

No method of transmission or storage is 100% secure. In the event of a personal data breach, we will take prompt steps to contain it and will notify affected clients, individuals and authorities as required by law.

10Data Retention

We keep personal data only for as long as it is needed for the purpose it was collected, or as required by law.

• Enquiry and quote data: kept while we discuss your requirement and for a reasonable period afterwards for follow-up and records.
• Client account and billing data: kept for the duration of the agreement and as required by tax and accounting laws.
• Job applications: kept for up to 12 months for future openings, unless you ask us to delete them sooner.
• Client Data in HMS: kept as set out in the client agreement, and returned or deleted at the end of the agreement on the client's request.

11Your Rights

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and how it is used.
• Correct or update inaccurate or incomplete personal data.
• Erase personal data that is no longer needed, unless we must keep it by law.
• Withdraw consent for processing based on consent, including marketing messages.
• Nominate another person to exercise your rights in case of death or incapacity.
• Raise a grievance with our Grievance Officer (Section 15). If you are not satisfied with our response, you may approach the Data Protection Board of India.

To exercise any of these rights, write to support@catalystsoftware.in. We may ask you to verify your identity before acting on your request.

12Children's Privacy

Our website and services are meant for healthcare organisations and professionals. We do not knowingly collect personal data from anyone under 18 years of age through this website. If you believe a child has shared personal data with us, please contact us and we will delete it.

Patient records of minors entered into Catalyst HMS are handled by the healthcare facility, which is responsible for obtaining verifiable consent from a parent or lawful guardian where required.

13Third-Party Links

Our website may contain links to third-party websites such as Facebook, X (Twitter), LinkedIn and Google Maps. We are not responsible for the privacy practices or content of these websites. Please read their privacy policies before sharing any personal data with them.

14Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services or in the law. The revised version will be posted on this page with an updated "Last updated" date. Where changes are significant, we may also notify clients by email.

15Grievance Officer & Contact

If you have any questions, concerns or complaints about this Privacy Policy or how we handle your personal data, please contact our Grievance Officer. We will acknowledge your request promptly and respond within the time required by applicable law.

Please also read our Terms & Conditions and Disclaimer.