Privacy Policy

Apex Meridian Private Limited ("we," "us," or "our") operates the website https://www.apexmeridian.xyz (the "Service"). We collect information you voluntarily provide — including your email address, phone number, and clinic details — as well as Usage Data about how the Service is accessed. We collect only what is necessary to provide and improve the Service.

We use collected data to provide and maintain the Service, notify you about changes, offer customer support, and monitor usage patterns. We do not sell your personal data to third parties under any circumstance. Clinic patient records are never used for advertising, marketplace directories, or any commercial purpose beyond delivering the Service.

We recognise that conversations between doctors and patients are among the most sensitive data in existence. CURA is architected so that privileged clinical information — consultations, diagnoses, prescriptions — is accessible only to authorised members of your clinic team. We do not access, review, or process clinical notes for any purpose other than technical delivery of the Service.

Your information may be processed on infrastructure outside your state or country. All data in transit is encrypted using TLS, and data at rest is encrypted by our database and storage providers. Integration credentials and Aadhaar numbers carry an additional application-level AES-256-GCM encryption layer. Customers on a dedicated instance, available on request, additionally have infrastructure-level isolation.

We implement commercially reasonable technical and organisational measures to protect your Personal Data. Every clinic is isolated by row-level security across all tables. Hosting locations depend on the deployment and may be outside India. A dedicated instance is available on request for customers who require infrastructure-level isolation. While no method of Internet transmission is 100% secure, we continuously audit and improve our security posture.

We work with trusted service providers including Supabase (database infrastructure), Vercel (application hosting), Cloudflare (file storage), Razorpay (payment processing), Meta (WhatsApp Business API) and, where AI features such as AI Scribe are used, Deepgram (speech transcription) and OpenAI (language processing). These providers access your data only to perform services on our behalf and are contractually obligated not to disclose or use it for any other purpose.

Your clinic owns your patient data. You may request deletion of your account and associated data at any time by contacting support@apexmeridian.xyz. We comply with India's Digital Personal Data Protection (DPDP) Act 2023. When you request deletion, we confirm the applicable schedule and any records that must be retained under your agreement or applicable requirements.

We wrote this policy in plain language because we believe transparency earns trust. If you have any questions, contact us at support@apexmeridian.xyz or visit https://www.apexmeridian.xyz. We aim to respond to all privacy inquiries within 48 business hours.