Privacy Policy

1. Who we are

WecareXM is an experience-management platform for hospitals and clinics, operated by the WecareXM team (“WecareXM”, “we”, “us”) from Bengaluru, India. Hospitals and clinics (“customers”) use WecareXM to collect feedback from the people they care for, manage incidents and service requests, and act on what they learn.

This policy covers two things: the data we handle inside the platform on behalf of customers, and the data we collect ourselves through this website.

2. Our role under Indian data-protection law

For data inside a customer’s WecareXM tenant, the customer is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 and we are its Data Processor. The customer decides what is collected, informs patients and staff, obtains any consent the law requires (including parental consent for children), answers requests from the people whose data it holds, and notifies the Data Protection Board when the law requires. We process that data only on the customer’s instructions under a written agreement, and we support the customer in meeting those duties.

For this website, and for people who contact us about WecareXM, we are the Data Fiduciary ourselves. Sections 8 and 9 explain what we collect and how to reach us.

3. Data we process for customers

Customers decide what enters their tenant. Typically this is feedback and survey responses, contact details a patient chooses to share, staff user accounts, and operational records such as tickets, incident reports and visit logs. Feedback about healthcare can include health-related information, so we treat everything in a tenant as confidential.

Each customer’s data lives in its own database. It is never shared with, or visible to, another customer. We do not use customer data for advertising, do not sell it, and do not use it to train AI models.

4. Google account data (Google Business Profile)

A customer administrator can connect a unit’s Google Business Profile listing to WecareXM so that public Google reviews of that listing appear alongside the customer’s other feedback. When they do, WecareXM asks for permission through Google sign-in (OAuth) to:

• read the email address of the Google account used to connect;
• list the Business Profile accounts and locations that account manages, so the administrator can choose the listing that belongs to the unit;
• read the public reviews of the chosen listing: star rating, review text, reviewer display name and profile photo, dates, and the business’s own reply, together with the listing’s average rating and review count.

How we use it. We store the connecting account’s email address and the chosen listing, and once an hour we fetch new and changed reviews for that listing. Each review is stored and shown inside that customer’s tenant as a feedback record from the source “Google Reviews”, so the customer can see unreplied negative reviews, rating trends and the topics reviewers mention next to its other feedback. If the customer has enabled WecareXM AI, the review text (only the text, not the reviewer’s name or photo) is analysed for sentiment and topics in the same way as other written feedback, and may lead the platform to open an internal ticket for the customer’s team. Section 6 lists the providers involved.

What we do not do. We only read from Google. We do not post, edit or delete reviews or replies, do not contact reviewers, do not use Google data for advertising, do not use it to train AI models, and do not share it with anyone except the sub-processors in section 6 that host or analyse it for the customer.

Reviewers. Review content is what the reviewer published publicly on Google. In WecareXM it is visible only to the customer that owns the listing. Reviewers control their review through their own Google account.

Tokens and disconnecting. The access and refresh tokens Google issues are stored encrypted and are used only by the automated sync. A customer administrator can disconnect the listing at any time from the Google Reviews page in WecareXM. Disconnecting asks Google to revoke WecareXM’s authorisation, stops all syncing and deletes the stored tokens. Access can also be removed directly from the Google account at myaccount.google.com/permissions. Reviews already imported stay in the customer’s tenant as feedback records until the customer deletes them.

WecareXM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Security

Data moves between browsers, the platform and Google over TLS. Credentials and third-party tokens are encrypted at rest. Access to customer data within our team is limited to staff who need it to operate and support the service. We take daily backups and remove old copies on a rolling schedule.

If we become aware of a breach affecting a customer’s data, we notify that customer without undue delay with what we know, so that the customer can meet its own notification duties.

6. Sub-processors and where data is processed

We use a small number of service providers to run WecareXM. They act on our instructions and may not use the data for their own purposes.

AI providers receive only the text needed for the analysis, not names or contact details, and we do not use customer data to train AI models. Where a provider is outside India, the transfer is made in accordance with the DPDP Act and the customer’s agreement with us. We update this table when providers change.

7. Retention and deletion

We keep a customer’s data for as long as its agreement with us is active and as long as the law requires. Customers can delete individual records inside the platform. When the agreement ends, tenant data is returned or deleted as the agreement sets out, and then drops out of backups on the rolling schedule in section 5.

8. This website

This website is a static marketing site. It sets no cookies and runs no analytics or advertising trackers. Our web host keeps standard server logs (IP address, page requested, browser) for security and troubleshooting, for a limited period.

If you email or call us, or ask for a demo, we keep your name, contact details and message so that we can respond and follow up about WecareXM. We do not add you to marketing lists without asking. You can ask us at any time to see, correct or delete what we hold about you.

9. Your rights and who to contact

If your data is held in a hospital’s or clinic’s WecareXM tenant, that customer controls it: please contact the customer directly, and we will help them respond.

For anything about this website, this policy, or how we handle your contact details, write to our Grievance Officer:

We respond to grievances within the time the applicable law requires.

10. Changes

We update this policy when the platform changes. The date at the top shows the current version, and material changes are also notified to customers through their usual account contact.