Legal information
Privacy information
How this corporate website, private staff dashboard and company enquiries handle information.
Effective 17 October 2026
Who we are and what this notice covers
Hexala Solutions Private Limited operates this corporate website to explain our company, brands and product direction, and help people contact us. This notice covers this website, its private staff dashboard and related company enquiries and applications. It does not represent that every illustrated healthcare feature is live. Separate notices and agreements must explain the data processing in any healthcare product before you use it.
Hexala is responsible for the purposes and means of processing that it determines, including its corporate enquiries and administration. Where a healthcare organisation determines the purposes and means of processing patient records and Hexala acts only on its documented instructions, Hexala acts as its processor for that activity under the applicable agreement. A separate activity that Hexala determines for its own purposes must be identified and assessed separately. Contract labels do not override actual processing or applicable law.
Information you choose to share
You can browse the public website without creating an account. If you email us, we receive the name, contact details, message and attachments you choose to send. Company and partnership enquiries are used to respond and manage the relevant conversation. Job applications are used to assess your application and contact you about opportunities you have agreed to discuss.
The contact form prepares an email link in your email application. Careers prepares a downloadable email draft that can include the resume you select. These tools do not automatically send your message or upload your application to our website server. We receive it only when you send the email. Your email provider also processes the message under its own policies.
Please do not send patient records, prescriptions, medical histories, identity documents or unnecessary sensitive information through these corporate enquiry and careers tools. Product screenshots contain demonstration information.
Technical information and staff accounts
Hosting, network and security providers may process IP addresses, browser information, requested pages, request times and error information to deliver and protect the website. We do not install visitor analytics scripts or advertising trackers.
Authorised staff account records include usernames, roles, account status and salted one way password hashes. We do not store their plaintext passwords. Authentication sessions use restricted cookies and protected session records. Sessions expire after 30 minutes of inactivity or eight hours at most. A username or password change revokes that account's existing sessions. Public visitors do not need a staff account or authentication cookie.
Purposes and consent
We use information to deliver and secure the website, manage authorised staff access, answer enquiries, review applications, handle complaints, prevent misuse and meet applicable legal obligations. Information will be used for the disclosed purpose and with the consent or other authority required by applicable law. Acceptance of Terms is not blanket consent to health data processing.
If a healthcare product collects health information, it must first explain the information, purpose, recipient and relevant choices for that action. Optional marketing choices must be separate. We do not collect patient records through this corporate website and do not sell personal information.
Providers and brand roles
HealthPro Partners, ZoCure and ZoCure Business are brands operated by Hexala, rather than separate recipient companies. Authorised Hexala personnel may access information only for the purposes explained here. Independent Providers receive information only for a disclosed purpose and with the consent or other authority required by law.
Where Hexala processes patient records on a healthcare organisation's documented instructions, the agreement and product notice must identify that role, the organisation responsible for the processing purpose and how to exercise relevant rights. A contract label does not remove obligations that apply to Hexala's actual activities.
Service providers and processing locations
We use Cloudflare for website delivery and security, Supabase for the private website administration database and storage, and email providers for company communications. The current website administration database is hosted in Mumbai. Network delivery, support and email processing may involve other locations; this is not a promise that all processing stays in India.
We restrict access to personnel and service providers who need it for the relevant purpose and use contractual and technical safeguards where required. We may disclose information to comply with law, respond to a lawful request, protect rights or investigate misuse. Any business transfer involving personal information remains subject to applicable law and safeguards.
Retention and deletion
We retain each category only for its documented business purpose and applicable legal or recordkeeping requirements, or a justified legal hold. We review records that are no longer needed for deletion or anonymisation. Backups may remain until their normal replacement or expiry. You may ask about retention of a specific message or application at [email protected].
Online storage does not justify keeping clinical records forever. Medical record retention depends on the provider, record type and applicable law and must be described for the relevant healthcare product. We will explain any applicable legal reason for refusing an erasure request.
Security and incidents
The website uses HTTPS, restricted staff permissions, password hashing and private administration storage. Access and authentication controls help prevent unauthorised use. No system can guarantee absolute security. This notice does not promise that every device, file, email or separate product is encrypted in every circumstance.
If a relevant incident occurs, we will investigate, take appropriate action and notify the authorities and affected people as required by the law applicable at that time. Report concerns to [email protected] without sending passwords or additional sensitive records.
Children and people acting for others
The corporate enquiry and careers tools are intended for adults. Do not use them to submit a child's medical records. A separate healthcare product that offers child or dependent profiles must verify the required authority and consent before enabling the relevant processing. Caregiver status alone does not prove legal guardianship. Contact us if a child's information has been sent through this corporate website in error.
Your choices and requests
You can choose whether to email us, clear browser preferences and ask us to stop optional follow up communications. To request access, correction or deletion of information, withdraw a consent you gave or raise a privacy concern, email [email protected] with the subject Privacy request. We may request proportionate information to verify your identity and authority.
Requests are handled under applicable law and any retention requirements. Rights that depend on a legal provision apply when that provision is in force and applicable. For records controlled by a healthcare organisation, the relevant product notice must identify the organisation and request process. You may use a competent statutory complaint mechanism where available.
Cookies and browser storage
The public website stores a privacy notice preference in your browser to remember that you dismissed the notice. It stays until you reset it or clear browser storage. Cookie settings lets you reset that preference. Motion follows your device's reduced motion setting; a separate website motion preference is not stored.
Authorised staff receive a secure restricted session cookie after sign in. It is cleared by signing out and expires as described above. Clearing a public privacy preference does not itself sign staff out. The website does not install analytics or advertising cookies. If optional tracking is introduced, the notice and choices will be updated and any required consent obtained before activation.
Grievance Officer and privacy contact
Naveen Venkatesh, Grievance Officer. Hexala Solutions Private Limited, Plot No. 2, Rajarajan Street, Ekkaduthangal, Chennai - 600032, Tamil Nadu, India. Email: [email protected]. Business phone: +91 9087074999.
We will acknowledge general complaints within 24 hours and ordinarily resolve them within 15 days. Any shorter or otherwise mandatory deadline applicable to the matter takes precedence. You may also contact a competent regulator, consumer forum or court. Reporting a concern to us does not waive that right.
Changes to this notice
This notice will be updated when the website's practices or applicable requirements change. The effective date is shown above. Material changes affecting an ongoing relationship will be communicated where required. Any new purpose requiring consent will be presented for the relevant choice rather than assumed from continued website browsing.
Contact Hexala
