Privacy Policy
Last updated: September 6, 2026 · Effective for: pedianex.co.in and the PediaNex clinical application
PediaNex is a pediatric EMR used by clinics to manage patient records, including children's health information. This policy explains what we collect, why, and what rights you have. If you're a parent or guardian, your clinic (not PediaNex) is usually the one who decided to use this software to manage your child's records — see "Our role vs. your clinic's role" below.
1. Who we are
Aaditya Bhatnagar, an individual/sole proprietor trading as "PediaNex" ("PediaNex," "we," "us"), based in Rajasthan, India, operates the PediaNex pediatric EMR platform. This policy covers pedianex.co.in and the PediaNex web application used by clinics, doctors, staff, and parents/guardians.
2. Our role vs. your clinic's role
For patient health records: the clinic you visit is the data controller — they decide what patient information is recorded and why. PediaNex acts as a data processor, storing and processing that information on the clinic's behalf, under a data processing agreement with the clinic.
For clinic staff accounts, billing contacts, and website/walkthrough inquiries, PediaNex is the data controller.
If you're a parent with questions about your child's specific medical record, please contact your clinic directly first — they control that data and are best placed to respond. Contact us if your clinic is unable to help, or for anything related to the parent portal itself.
3. What we collect
| From | What |
|---|---|
| Clinic staff / doctors | Name, role, phone number, login credentials, usage activity within the app |
| Patient records (entered by clinic staff) | Child's name, date of birth, sex, guardian contact details, growth measurements, vaccination history, diagnoses, prescriptions, visit notes, uploaded documents |
| Parents/guardians (via the parent portal) | Patient ID and date of birth used to look up records; no separate account or password is created. Phone number, for one-time-password (OTP) verification via our SMS provider, MSG91 |
| Website visitors | Name, role, and number of doctors, if you submit the "Book a walkthrough" form (sent via WhatsApp, not stored on our servers) |
| Automatically (marketing website only) | Basic device/browser information via standard web server logs. In addition, the marketing website uses Google Analytics 4 to record pages viewed, approximate location (city/country level, derived from a truncated IP address), device and browser type, referring source, and a small number of interaction events — specifically, clicks on our WhatsApp and phone links and submissions of the "Book a walkthrough" form. Where you reached us from a Google advertisement, this also allows us to see that the visit came from that ad. This applies to pedianex.co.in only; the clinical application does not run analytics or advertising trackers, and no patient health data is ever collected by, or passed to, these tools. |
4. How we use this information
- To provide the clinical record-keeping, growth-charting, vaccination-tracking, and prescription features clinics use PediaNex for
- To deliver prescriptions and certificates to parents via WhatsApp, at the clinic's instruction
- To operate the parent portal lookup feature
- To maintain security, prevent misuse, and debug issues with the platform
- To respond to walkthrough requests and support inquiries
- To understand how visitors find and use our marketing website, and to measure whether our advertising reaches pediatric clinics who find PediaNex useful — using website analytics data only
- We do not sell personal or patient data, and do not use patient health data for advertising, under any circumstances
5. Sharing with third parties
We share data with the following categories of third parties, only as needed to run the service:
- Cloud hosting/storage provider — Firebase (Google), which currently hosts the application and patient data. We are migrating towards a setup using a self-managed VPS with Supabase for the core database, with Firebase retained for PDF generation/storage. See Firebase's Privacy and Security in Firebase
- MSG91 — our SMS provider, used to send one-time passwords (OTPs) for parent portal phone verification. Only the phone number and OTP are shared for this purpose; see MSG91's Privacy Policy
- WhatsApp (Meta Platforms, Inc.) — prescriptions, certificates, and walkthrough messages are delivered via WhatsApp's messaging infrastructure at the clinic's or your instruction. Message content passes through WhatsApp/Meta's systems; see WhatsApp's Privacy Policy
- Google Analytics and Google Ads (Google LLC) — used on the marketing website (pedianex.co.in) only, to measure site traffic and the effectiveness of our advertising. Google receives the website usage information described in section 3, and may use cookies or similar identifiers to do so. Google is not given access to the clinical application or to any patient health data. See Google's Privacy Policy and how Google uses information from sites that use its services
- Legal or regulatory bodies — only if required by applicable law, or to protect the rights, safety, or property of PediaNex, our clinics, or their patients
We do not share patient health data with any third party for their own marketing or research purposes.
6. Data security
Every clinical page sits behind a signed session, and records are held in access-controlled cloud storage on Firebase (Google), which encrypts data in transit and at rest by default. Access to patient data within a clinic account is limited to that clinic's authorized staff.
No system is completely secure, and we cannot guarantee absolute security of data transmitted to or stored by the platform.
7. Data retention
Patient records are retained for as long as the clinic maintains an active PediaNex account. The specific retention period for an individual patient's record is set by the treating doctor at the time it is saved, with the patient's (or guardian's) consent, and may vary by clinic and by case. Clinics may request deletion of their account and associated data at any time, subject to any legal retention obligations that apply to health records.
8. Children's data
PediaNex's core purpose is storing children's health records on behalf of their treating clinic, at the direction of the child's parent or guardian and the clinic. Children themselves do not create accounts or interact directly with PediaNex — the parent portal is accessed by parents/guardians using information the clinic provides them. We do not knowingly collect data directly from children, and we apply the same access controls and security measures to children's records as to any other patient data, consistent with the additional care such data warrants under the DPDP Act, 2023.
9. Your rights
Under the Digital Personal Data Protection Act, 2023, and subject to its exceptions, you have the right to:
- Request a summary of the personal data we (or your clinic, for health records) hold about you
- Request correction or updating of inaccurate or incomplete data
- Request erasure of data no longer needed for the purpose it was collected, subject to legal retention requirements for health records
- Withdraw consent where processing is based on consent, without affecting processing already carried out
- Nominate another individual to exercise these rights on your behalf in case of death or incapacity
- Lodge a complaint with the Data Protection Board of India if you believe your rights have been violated
To exercise any of these rights regarding patient records, contact your clinic first. For anything else, contact us using the details below.
10. Cookies
The marketing website (pedianex.co.in) uses Google Analytics 4, which sets cookies (or similar browser identifiers) to recognise returning visits and measure how the site is used. Where a visit arrives from one of our Google advertisements, Google may also set cookies used to measure the effectiveness of that ad. These are analytics and advertising cookies, not strictly necessary ones, and they are used only for the purposes described in sections 3 and 4.
The site also loads fonts from Google Fonts, which may involve a connection to Google's servers.
The clinical application sets no analytics or advertising cookies. It uses a session cookie/token required for you to stay logged in — this is strictly necessary and not used for tracking. Patient health data is never used for advertising or shared with advertising services under any circumstances.
You can block or delete cookies through your browser settings, and you can prevent Google Analytics from collecting your data using Google's browser opt-out add-on. Blocking these cookies does not affect your ability to use the site or the application.
11. Changes to this policy
We may update this policy as the product evolves, particularly as we move from single-clinic use to a multi-practice product. Material changes will be reflected here with an updated "Last updated" date, and where required by law, we will notify affected clinics directly.
12. Grievance Officer & contact
As required under Indian law, you may contact our Grievance Officer for any privacy-related complaint or query:
Aaditya Bhatnagar
Email: ablabs.business@gmail.com
WhatsApp: +91 73573 97888