Privacy Policy

What we collect, why we collect it, who it is shared with, and the rights you and your patients have.

Last updated 2 August 2026

1. Scope and roles

This policy explains how Dr Santosh Mahanwar, Miasma Homoeo Clinic, Shop No. 44, Sarda Central, Beed, Maharashtra, India (“Antipsora”, “we”) handles personal data in connection with the Antipsora platform.

Two distinct categories of data are involved, and our role differs for each:

  • Practitioner data — information about you, the registered practitioner. We act as the Data Fiduciary for this data.
  • Patient case data — the clinical information you enter about your patients. You act as the Data Fiduciary; we act as a Data Processor handling it strictly on your instructions.

2. What we collect

From you, the practitioner: your name, email address and profile picture as supplied by Google sign-in; an optional phone number; your subscription and billing status; and technical records such as log data and audit entries recording security-relevant actions on your account.

From you, about your patients: whatever you choose to enter into a case — typically name, age, sex, chief complaints, history of illness, family history, physical and mental generals, and laboratory findings. This is health information and is treated as sensitive personal data.

We do not collect payment card details. Card data is captured and processed directly by Razorpay within their own environment and never reaches our servers.

3. Automated analysis by third-party language models

Please read this section carefully and make sure your patients are informed of it.

The core function of Antipsora is automated case analysis. To provide it, the case text you enter is transmitted over an encrypted connection to OpenRouter, which routes it to a third-party large language model provider for processing. Search queries derived from your case are also used to retrieve passages from our reference corpus.

This means patient case content leaves our infrastructure and is processed by external providers. It is transmitted for the sole purpose of generating your analysis. We do not authorise these providers to use your content to train their models; however, their own terms and retention practices apply to data in transit through their systems, and we cannot give an absolute guarantee about the internal practices of every upstream provider.

You should minimise identifying details in case entries wherever the analysis does not require them, and you must ensure your patients have consented to this processing before you enter their information.

4. Why we process this data

  • to create and administer your account and authenticate you;
  • to store your cases and generate remedy analyses at your request;
  • to process subscription payments and prevent duplicate or fraudulent billing;
  • to maintain security, investigate misuse, and keep an audit trail of sensitive actions;
  • to provide support and respond to your enquiries; and
  • to comply with legal and regulatory obligations.

Our lawful basis is your consent (given when you accept these policies at registration) and the performance of our contract with you. For patient data, the lawful basis is that established by you as the treating practitioner.

5. Who your data is shared with

We do not sell personal data. We share it only with the service providers necessary to operate the platform:

  • Supabase — database hosting and authentication.
  • Vercel — application hosting and content delivery.
  • OpenRouter and the upstream model providers it routes to — automated case analysis, as described in clause 3.
  • Google — sign-in and identity verification.
  • Razorpay — payment processing and subscription management.

We may also disclose data where required by law, court order, or a lawful request from a public authority, and to establish or defend legal claims.

6. International transfers

Some of the providers listed above operate infrastructure outside India. Where personal data is transferred across borders, we rely on the safeguards offered by those providers, including contractual protections, and transfer only what is necessary to deliver the service.

7. Security

We apply technical and organisational measures including:

  • encryption of data in transit using TLS;
  • authentication through Google sign-in, with no passwords stored by us;
  • database access restricted to the application, with row-level security enabled and public API roles revoked;
  • strict per-account scoping so one practitioner can never read another's patients or cases;
  • a content security policy, origin checks on state-changing requests, and rate limiting; and
  • audit logging of security-relevant events.

No system can be guaranteed completely secure. If a breach affecting your data occurs, we will notify you and the relevant authority as required by law.

8. Retention

Case and patient data is retained while your account is active, so that you can access your clinical records. If you close your account we will delete or anonymise your data within a reasonable period, except where we are required to retain records — for example billing records kept for tax and accounting purposes. Audit logs are kept for a limited period for security purposes.

9. Your rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you have the right to access the personal data we hold about you, to have inaccurate data corrected, to request erasure, to withdraw consent, and to raise a grievance. Requests can be sent to genuinepracticalhomoeopathy@gmail.com.

Requests from a patient concerning their own case data should be directed to their treating practitioner, who controls that data. Where we receive such a request directly we will refer it to the relevant practitioner rather than act on it ourselves.

10. Cookies

We use only cookies that are strictly necessary to operate the platform — principally to keep you signed in and to protect against cross-site request forgery. We do not use advertising or third-party tracking cookies.

11. Children

Accounts are for qualified practitioners and are not available to anyone under 18. Where a practitioner enters case data concerning a minor patient, responsibility for obtaining the consent of a parent or lawful guardian rests with the practitioner.

12. Changes and contact

We may update this policy; the “last updated” date above reflects the current version, and we will notify you of material changes.

For any privacy question, or to contact our Grievance Officer, write to genuinepracticalhomoeopathy@gmail.com or Dr Santosh Mahanwar, Miasma Homoeo Clinic, Shop No. 44, Sarda Central, Beed, Maharashtra, India. See also our Terms of Service.