Legal Last updated 2026
Privacy Policy
How Shwastik Tech Solutions Pvt Ltd handles personal and health data. Written to be read, not to be survived.
The short version
- For patient data, you are the data fiduciary and we are a processor acting on your instructions.
- Aadhaar numbers and OTPs are never stored — not in the database, not in logs, not in error reports.
- Data is stored and processed in India and is not transferred outside it.
- Records received under consent are purged on the erasure date carried by the consent artefact.
- We do not sell data, and we do not use patient data to train models.
01Who we are
Shwastik Tech Solutions Pvt Ltd operates the Swastik ABDM Connector at https://abdm.swastik.ai. For data you send us about your patients, you are the data fiduciary and we are a data processor acting on your instructions. For your own account details, we are the fiduciary.
02What we collect
Account data
- Name, work email, phone number and job title of the people who sign in
- Organisation name, contact details and registration details you provide
- Authentication data: password hashes, session tokens, two-factor secrets
- Sign-in times and IP addresses, for security and audit
Health data, processed on your behalf
- ABHA numbers and addresses of patients you register
- Your own patient references, demographics and contact numbers
- Care contexts and the clinical documents attached to them
- Consent artefacts, and records received under them
What we deliberately do not keep
Aadhaar numbers and OTPs are never stored. They are encrypted with ABDM’s public key in memory, forwarded, and discarded. They do not appear in our database, our logs or our error reports.
03Why we process it
- To provide the service — performing the ABDM operations you call
- Legal obligation — the audit trail ABDM and Indian health regulation require
- Security — detecting abuse, rate limiting, investigating incidents
- Billing — counting API usage against your plan
We do not sell data. We do not use patient data to train models. We do not use it for advertising.
04Consent
Health information moves only under a consent artefact granted by the patient through ABDM’s consent manager. We enforce its scope: date range, health information types, and revocation. When a patient revokes consent, access stops immediately rather than at the artefact’s natural expiry.
05How long we keep it
| Data | Retention |
|---|---|
| Records received under consent | Until the erasure date on the consent artefact, then purged automatically |
| ABHA enrolment sessions | Purged within 24 hours of expiry |
| Audit events and API logs | Retained for the period ABDM compliance requires |
| Account data | For the life of the account, then deleted on request |
06Where it lives
Data is stored and processed in India. Sub-processors are limited to infrastructure providers operating in Indian regions. Patient data is not transferred outside India.
07How it is protected
TLS 1.2+ in transit, Fidelius end-to-end encryption for health information between providers, field-level encryption at rest with rotating keys, tenant isolation enforced in the data layer, and redaction of identifiers from logs. The detail is on the security page.
08Your rights
Under the Digital Personal Data Protection Act 2023 you may request access to, correction of, or erasure of your personal data, and may withdraw consent. Patients exercise rights over their health records through their ABDM PHR application, which is where consent is granted and revoked. For anything else, email abdm@swastik.ai.
09Breach notification
If a personal data breach occurs we will notify the Data Protection Board of India and affected organisations without undue delay, with what we know, what we are doing, and what you should do.
10Changes
Material changes will be notified to account holders by email before they take effect. The date at the top of this page reflects the last revision.
11Contact
Privacy queries and grievances: abdm@swastik.ai, Shwastik Tech Solutions Pvt Ltd, India.