Your data, handled with clinical care.

Overview

SentArc Labs (“we”, “us”, “OpenInsight”) operates a clinical decision-support platform that helps medical practitioners find evidence-backed answers at the point of care. This policy explains what data we collect, why we collect it, how long we keep it, and the choices you have.

We follow the principles of the Digital Personal Data Protection Act, 2023 (India) and align with recognized health-data best practices. Where this policy refers to “clinical queries”, it means the de-identified questions you ask OpenInsight — not patient records.

What we collect

We keep data collection deliberately narrow. There are three categories:

How we use it

• Verification — to confirm you are a licensed medical practitioner before granting access.
• Service delivery — to answer your clinical queries and generate citation-ready summaries.
• Quality improvement — to evaluate answer quality, fix errors, and improve retrieval.
• Security — to detect abuse, rate-limit, and protect the service.
• Communication — to send early-access updates and respond to support requests.

We do not sell your data. We do not use clinical queries to train pharmaceutical-advertising models. Sponsored educational content, when present, is kept strictly separate from clinical responses.

Storage & security

Account and query data are stored on encrypted infrastructure. Access is role-restricted, logged, and reviewed. Clinical query logs are separated from account-identifying records wherever practical, so a query cannot be trivially traced back to a named individual.

We use TLS in transit and encryption at rest. Internal access requires multi-factor authentication. Despite these measures, no system is perfectly secure — if a breach occurs, we will notify affected users promptly and in line with applicable law.

Cookies & analytics

We use a small set of cookies for session continuity and privacy-respecting analytics. We do not run advertising networks on OpenInsight and do not share identifiers with ad brokers.

• Essential — login session, consent banner state. Required for the service to function.
• Analytics — aggregate usage patterns (PostHog / Clarity). Used to improve the product. You can decline these.
• Functional — preferred mode (Fast Search / DeepInsight), theme preferences.

The cookie-consent banner lets you accept or decline non-essential cookies. You can change your choice at any time.

Third-party services

We rely on a small number of trusted processors:

• Cloud infrastructure — to host the application and vector store.
• Email delivery — to send early-access and support communications.
• Analytics — aggregate product analytics, configured to minimise personal data.

Each processor is bound by data-processing agreements and is only permitted to use data on our instructions. We do not transfer clinical query data outside the jurisdictions required to operate the service.

Your rights

Under the DPDP Act 2023 and equivalent protections, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — fix inaccurate or outdated information.
• Erase — request deletion of your account and associated query logs.
• Withdraw consent — turn off non-essential cookies or analytics.
• Data portability — receive your data in a structured, machine-readable format.
• Grievance — raise a concern with our Grievance Officer (see Contact).

To exercise any of these rights, email support@openinsight.in. We respond within 30 days.

Data retention

We keep data only as long as necessary:

• Account data — retained while your account is active; deleted within 90 days of account closure.
• Clinical query logs — anonymised and retained for up to 24 months for quality improvement, then aggregated and purged.
• Verification records — kept for the duration of access to demonstrate practitioner verification.
• Analytics — aggregated and retained per our analytics provider’s policy; raw event data is rotated.

Children

OpenInsight is intended exclusively for licensed medical practitioners and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy as the product evolves. Material changes will be announced via the early-access mailing list and reflected in the “Last updated” date above. Continued use after a change constitutes acceptance.