Privacy Policy

We collect the following categories of personal data when you use SmartSupply:

• Identity data — your name, role (e.g., ward head, storekeeper, purchase manager), and ward assignment as provided by your hospital administrator.
• Voice recordings — audio submitted via WhatsApp for voice-order processing, collected only with your explicit, informed consent.
• Procurement data — ward indent requests, purchase orders, delivery confirmations, stock adjustments, and invoice records you create or approve.
• Usage data — session timestamps, action logs, and error traces used for system reliability and regulatory audit.

• To manage and fulfil hospital supply procurement requests across all roles in your organisation.
• To process voice-initiated orders and route them through the correct workflow on your behalf.
• To generate procurement analytics, spending reports, and supplier performance data for hospital administration.
• To maintain a complete audit log for regulatory, financial, and legal compliance.

All data is stored in Supabase (PostgreSQL), hosted on AWS (ap-south-1 — Mumbai region). Data at rest is encrypted using AES-256. Data in transit is protected by TLS 1.2 or higher. Row-level security (RLS) policies ensure each hospital's data is strictly isolated — no hospital can access another's records.

Application hosting is provided by Vercel. Voice message processing uses the Twilio platform. Email notifications are delivered via SendGrid. Each sub-processor operates under a Data Processing Agreement and is bound to equivalent data protection standards.

Under the Digital Personal Data Protection Act, 2023 (India), you have the following rights with respect to your personal data:

• Right to access — request a summary of personal data we hold about you.
• Right to correction — request correction of inaccurate or incomplete personal data.
• Right to erasure — request deletion of your personal data, subject to legal retention obligations (see “Data retention” below).
• Right to grievance redressal — file a grievance with our Data Protection Officer. We will acknowledge within 48 hours and resolve within 30 days.
• Right to nominate — nominate another individual to exercise your rights on your behalf in the event of incapacity or death.

To exercise any right, contact us at privacy@thinkrighter.in.

• Procurement records (indents, purchase orders, deliveries, invoices) are retained for a minimum of 3 years, or as required by your hospital's internal policy and applicable regulation.
• Voice recordings are retained for 90 days from the date of capture and then permanently deleted — unless you withdraw consent earlier.
• Audit logs are retained for 7 years to meet financial compliance requirements.
• User accounts are deactivated (not deleted) on role termination; personal identifiers are anonymised after the applicable retention period.
• Demo requests submitted through this website (name, email, phone, hospital name and city) are retained for 730 days from the date of submission, then deleted. That window is the outer bound of a hospital procurement cycle — long enough that a lead who goes quiet for a budget season is not discarded, short enough that it is not indefinite. You do not have to wait for it: see “Erasing a demo request” below.

You can withdraw consent for voice recording processing at any time via Settings → Consent preferences within the SmartSupply application. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

For data processed on the basis of contract or legitimate interest — such as procurement records required for hospital operations — erasure requests will be evaluated against legal retention obligations before being actioned.

If you asked for a demo but never became a SmartSupply user, you have no account to sign in to. You do not need one. Enter the address you submitted and we will email you a confirmation link; opening it and pressing the button deletes every demo request bearing that address — one prospect often submits the form more than once — and tells you how many records were removed, so you have evidence that something happened.

We do not say on this page whether we hold anything for an address — that answer goes only to whoever opens the email, so that nobody can use this form to find out who has approached us, or to delete someone else's request.

If the email does not arrive, write to privacy@thinkrighter.in from the address you submitted and a person will do the same thing by hand. We aim to complete that within 30 days of receiving the request.

Demo requests are stored separately from hospital procurement records and are referenced by nothing else, so deleting them destroys no audit trail and is not weighed against any retention obligation.

For data protection queries, rights requests, or grievances: