VistaHealth is provided by VistaLogic Solutions Private Limited ("VistaLogic", "we", "us"). CIN U62011TS2026PTC213233. Registered office: Plot 237, Arsha Apartments, Ground Flat, Kalyan Nagar, Vengal Rao Nagar, Khairatabad, Hyderabad - 500038, Telangana, India.
For the personal data you give VistaHealth, VistaLogic is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules"). Until the remaining parts of the DPDP Act come into force, we also follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which treat health information as sensitive personal data.
Clinics that use VistaHealth keep their own records of their patients: visits, bookings, queues, payments and the prescriptions their doctors write at the clinic. For those clinic records, the clinic decides why and how they are used, and VistaLogic processes them on the clinic's behalf. Doctors and clinics remain responsible for their own professional duties over the notes and prescriptions they write.
We collect only what VistaHealth needs to work. Items marked optional are only collected if you add them or turn the feature on.
| Data | Why | Required? |
|---|---|---|
| Full name, date of birth, gender (as on your Aadhaar) | Create your record and match it to your reports. These cannot be changed in the app; ask us to correct them (section 13) | Name and gender required; date of birth optional |
| Mobile number | Sign you in with a one-time code; account messages | Required |
| Email address | Second check on sensitive changes; receipts and invoices; sign-in for accounts that use email | Optional |
| Address or city, profession, blood group, height, weight | Your profile; finding clinics near your city; health calculations such as BMI | Optional |
| Emergency contacts (up to 3): name, relation, a voice number and, if you add one, a WhatsApp number (numbers outside India are allowed) | One-tap call or message from the Emergency page | Required (one name and number) |
| Aadhaar number | Used once to verify identity through ABDM; we keep only the last 4 digits | Optional |
| ABHA number and ABHA address | Link your record with the Ayushman Bharat Digital Mission (ABDM) | Optional |
| Profile photo | Shown on your profile | Optional |
| Reports and documents you upload (lab reports, scans, prescriptions, discharge summaries, insurance papers, diagnostic videos, which may include sound) and the values read from them | Keep your health record; show results, ranges and trends | Optional |
| Conditions, allergies, surgeries, hospital stays, family history, medicines and reminders | Your health history and medicine reminders | Optional |
| Trackers: blood pressure, blood sugar, insulin, vaccines, menstrual cycle, pregnancy, growth, symptoms, temperature, water, mood, PHQ-9 and GAD-7 questionnaires, dialysis, chemotherapy, physiotherapy, eye/ear/dental checks and others | The trackers and reminders you turn on | Optional |
| Food log, including photos of a meal you choose to scan; smoking, alcohol and sleep habits | Nutrition and habit tracking. A meal photo is read by the AI service in section 6 (in India) to suggest the foods and portions, which you check before anything is logged | Optional |
| Readings from Health Connect, Apple Health, VistaHealth bands, rings and watches, and CGM apps (see section 7) | Show your fitness and vitals; alerts on very high or low recent readings | Optional |
| Notes, prescriptions and consultation records added by doctors and clinics you share with | Keep your doctor's advice in your record | Added by them |
| Appointments and visits you book, including visits at clinics that are not on VistaHealth | Your calendar and reminders | Optional |
| Messages with clinics and doctors; support tickets, feedback and screen recordings you attach | Communication and support | Optional |
| Community posts and replies, shown under your VistaHealth ID, never your name. Phone numbers, emails and Aadhaar-like numbers in posts are masked automatically. Community is switched off at present; posts already written are kept until you or we remove them | Publish what you choose to post | Optional |
| Your answers to the privacy choices in section 4, with the date and the version you answered | Do what you chose, and prove it | Required |
| Plan, payment status, payment reference, GST invoices | Billing. Your name and mobile number go to Razorpay to create the payment link. Card and UPI details are entered on Razorpay's page and never reach us | Only for paid plans and online fees |
Name, mobile number, email, photo, specialty, qualifications, medical council and registration number, Healthcare Professional ID, the hospitals you work at and your hours there, and, if you add it, your date of birth (kept private to you). These are checked against the ABDM Healthcare Professionals Registry (HPR). If you create an HPR ID through VistaHealth, your Aadhaar number is passed to ABDM for that step; VistaHealth does not keep the full number. Also: clinic hours, leave and calendar, the notes and prescriptions you write, and, if you use dictation, your voice recordings (see 3.4).
If you set up payouts for your own practice, your PAN and bank account details are sent to Razorpay to open your account there. VistaHealth keeps only the account status and the last 4 digits of the PAN and bank account.
Clinic name, address, contact details, the date the clinic was established if you add it, staff names, mobile numbers, sign-in emails and roles, the doctors on the roster, visits, queues, bookings, slips, fees and invoices.
Online OPD fees that members pay are collected by VistaLogic through Razorpay and paid to the clinic each month by bank transfer, against a settlement statement. The clinic gives VistaLogic its bank details for this. VistaHealth keeps the clinic's GSTIN for its invoices. For clinics that set up Razorpay payouts before 28 October 2026, the PAN, GSTIN and bank details were sent to Razorpay, and VistaHealth keeps only the status and the last 4 digits of the PAN and bank account.
At the counter, a walk-in member's mobile number is verified by a one-time code. Clinic staff see members' mobile numbers masked to the last 4 digits. If the clinic's administrator has allowed it, staff may photograph an ID card to fill in the form, after telling the patient. The photo is read by the AI service in section 6, in India, so the whole card, including a full Aadhaar number if it is an Aadhaar card, is sent to that service. The reader returns only the last 4 digits of an Aadhaar number, and the counter form asks only for those 4 digits.
Only doctors can dictate, to write a prescription or note:
VistaHealth does not record members. If other people speak while a doctor records a clip, their words may be transcribed too.
VistaHealth does not collect your location, your phone's contacts, call logs, SMS, calendar, browsing history or the list of apps on your phone. It contains no advertising or analytics software.
We process personal data to:
We rely on your consent. When you sign up, the "Your privacy & choices" step lists each purpose separately:
Doctors and clinic staff get their own list, including the diagnostic log; a clinic's administrator decides whether staff may read ID cards with AI. If you signed up before these choices existed, we ask you at your next sign-in; until you answer, uploads are read as before.
You can change an optional choice at any time in Settings → Security Settings → Terms & privacy, and withdrawing is as easy as giving it. You can also stop sharing in Settings → Share My Case, disconnect a device in Device Settings, withdraw a hospital's access in Connected Apps, revoke ABDM approvals in your ABHA app, or delete your account. Withdrawing stops future processing for that purpose but does not undo what was already done lawfully.
We may also process data without consent only for the legitimate uses in Section 7 of the DPDP Act. Examples: responding to a medical emergency that threatens life or health, or complying with a law or court order.
Insights in VistaHealth point out patterns worth discussing with a doctor. Most appear only after a pattern has held over several days. An out-of-range reading asks you to check again, and a very low glucose or oxygen reading is shown at once, with advice to contact your doctor. Insights are not a diagnosis or medical advice.
Your record is shared only when you act, and only with the recipient you name:
Your record is stored in India, on Amazon Web Services in the Mumbai region. The providers below process data for us under their service terms, which allow them to use it only to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, sign-in, email codes and invoices (Amazon SES), voice-to-text (Amazon Transcribe), logs and monitoring | Mumbai, India |
| Amazon Web Services: Amazon Bedrock, running Anthropic's Claude AI | Reading the reports, prescriptions and insurance papers uploaded to records whose owner allowed it, the ID cards a clinic photographs, and meal photos you scan, to fill in values that a person then checks. Amazon Bedrock does not store this content and does not use it to train AI models. It is not sent to Anthropic. | India only (AWS Mumbai and Hyderabad) |
| MSG91 (Walkover Web Solutions) | Sign-in codes and SMS messages (your mobile number and the message text). When WhatsApp messages are switched on: appointment updates, alerts about a sign-in on a new device, and emergency alerts, delivered through WhatsApp (Meta) | Outside India. MSG91's own privacy policy says its service is hosted outside India. WhatsApp messages also pass through Meta's servers |
| Razorpay | Payments, and payouts for doctors' own practices | India |
| Google (Firebase Cloud Messaging) | Delivering notifications to Android phones. A notification names whose record it is (a first name) and, if you allowed details in notifications, the kind of alert, for example that a reading was very low. It never contains the reading itself or a message's text | Google's global network |
| Google (speech recognition) | Doctors' dictation when the phone's own recogniser is used (section 3.4) | Google's global network |
| Our own crash server (GlitchTip, run by VistaLogic) | Crash reports with personal details removed | Mumbai, India |
We also exchange data with the National Health Authority, which runs ABDM, for ABHA verification, doctor verification (HPR) and the record exchange you approve. The NHA is not our service provider; it acts under ABDM's own rules, in India.
When a doctor types a medicine name, the name alone is checked against the US National Library of Medicine's public drug database. No personal data is sent with it.
Where data is processed outside India, the transfer follows Section 16 of the DPDP Act. Apple and Google also distribute the app and run Apple Health and Health Connect under their own terms.
The software kits for VistaHealth bands, rings and watches run on your phone. We have blocked or removed the vendor connections we found in them, and no health readings are sent to device vendors.
If you connect them, VistaHealth reads the following and never writes to them:
The readings are saved in your VistaHealth record on our servers in Mumbai. We use them only to show your fitness and vitals to you and to the doctors and family members you choose, and to alert you and your linked family to a very high or very low recent reading.
If you allow background access, VistaHealth keeps reading while the app is closed. On Android it shows an ongoing notification while it does. You can turn this off at any time.
The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. In particular, we do not sell this data. We do not use it for advertising, marketing or credit decisions. We do not transfer it to data brokers or other third parties, except to the doctors and family you choose, to service providers who help us run VistaHealth, or where the law requires. Our staff do not read it except with your permission (for example when you ask for support), for security, or when the law requires. The same applies to data from Apple HealthKit, which we never store in iCloud.
To stop syncing a device, use Device Settings in VistaHealth. To remove VistaHealth's access, use the Health Connect app or settings on Android, or the Health app on iPhone (your picture → Apps → VistaHealth).
To book and run the consultation, take payment and give refunds, keep the record of the consultation that the Telemedicine Practice Guidelines expect, keep the call secure and fix faults, and (only if you choose) keep a recording and send you key points.
Calls run on VistaHealth's own video servers in Amazon Web Services, Mumbai. The video and audio are encrypted in transit and do not pass through any other company [Eng: confirm the TURN relay is our own, in Mumbai]. Recordings, transcripts, chat and key points are stored encrypted in AWS Mumbai. Transcripts are made on our own speech service in Mumbai. Key points are prepared with Anthropic's Claude AI on Amazon Bedrock in India (Mumbai and Hyderabad); Amazon Bedrock does not keep the text or use it to train models. Appointment messages by WhatsApp, SMS or push notification carry only the doctor's name and the time, never health details.
Key points are sent by Amazon SES to the address you gave. Your email provider may store them outside India under its own terms. Ask for key points only to an address you trust.
| Item | Who can see it |
|---|---|
| Booking and call log | You, the people who manage or see your record, the doctor, and (for a clinic's doctor) the clinic's staff for scheduling and payment, not the reason or advice |
| Chat and reports sent in the chat | You, the people who manage your record, your family participant on the call, and the doctor. Never the clinic's staff |
| Recording | You, the people who can see your record, and the doctor of that visit while you share your record with them. Never the clinic, other doctors or VistaHealth staff |
| Key points | You and the people who manage your record. The doctor sees the draft only to check it |
| Prescription verification page | Anyone with the prescription's verification code: the doctor, the date, your initials (never your name or VistaHealth ID) and the medicines |
VistaHealth staff do not watch recordings or read key points. The one exception is when you ask us in writing to help with a complaint, and then only what is needed.
| Item | Kept |
|---|---|
| Booking, call log, chat, the doctor's advice | With your health record: up to 7 years after your last activity, unless you delete them sooner |
| Recording | Until you delete it, and at most 7 years after your last activity. Deleting it removes it for good; the call log keeps only the fact that it was made and deleted |
| Transcript | Deleted once the key points are made, and within [7] days at most |
| Key points | With the visit until you delete them or your account |
| Payment records | 8 years from the end of the financial year, as tax law requires, without health details |
A child's video consultation is booked and attended by the parent or guardian, who alone can agree to a recording or ask for key points. We never use a child's consultation for tracking, monitoring or advertising.
Recording and key points are off unless you choose them for that call. You can stop a recording during the call and delete it, the transcript or the key points afterwards in the visit. "My data rights" includes your video consultations, and deleting your account deletes them as described in section 14. No part of a consultation is used for research, analytics, advertising or to train AI.
The key points are documentation for you, not advice. The AI only summarises what was said and the doctor's entry; it does not diagnose or suggest treatment. Where AI is used, the doctor checks the key points before they are sent.
You must be 18 or older to create a VistaHealth account; the Terms you accept at sign-up say so. A parent or lawful guardian may keep a child's (under-18) health record under their own account.
Before a child's profile is added, we take verifiable consent from the parent or guardian: a declaration, plus a one-time code sent to the account holder's own verified mobile number, as Section 9 of the DPDP Act and Rule 10 of the DPDP Rules require.
A child's data is used only to keep the child's record for the guardian. It is never used for tracking, behavioural monitoring or advertising. Guardians can remove a child's profile at any time. When the child turns 18, the guardian can hand the record over to them in Settings → Personal Settings → Family Profile; the young adult then confirms with a one-time code on their own phone.
An adult with their own VistaHealth login decides in their own app whether a family member may view, or also manage, their record. An adult kept without a login of their own is added on the account holder's declaration that the adult agreed, or that the account holder is their lawful guardian, with a one-time code to the adult's phone where they have one.
VistaHealth asks for each permission only when you use the feature that needs it, and works without it where it can.
| Permission | Why |
|---|---|
| Camera; chosen photos and files | Photograph or pick a report, prescription, ID card, insurance card or meal, or record a diagnostic video. VistaHealth uses the system picker and does not read your whole gallery. |
| Phone calls | On the Emergency page, tapping your emergency contact's number calls them straight away instead of opening the keypad first. VistaHealth never places a call without your tap, does not read your call history, and does not record or send call details to VistaHealth. If you say no, the keypad opens as before. Ambulance numbers (108, 112) always open the keypad, as Android requires. |
| Nearby devices (Bluetooth) | Connect the band, ring or watch you pair. VistaHealth does not use Bluetooth to find your location. |
| Location (Android 11 and older only) | Those Android versions require it to scan for Bluetooth devices. VistaHealth never reads your location. |
| Microphone (doctors) | Dictate prescriptions and notes. |
| Notifications | Reminders, alerts and messages. If you allowed details in notifications (section 4), reminders and alerts can show a medicine name or a reading, and may appear on your lock screen. Notifications sent through Google never contain a reading, a value or a message's text. |
| Health Connect / Apple Health | See section 7. |
| Background sync (foreground service) | Keeps your paired device or Health Connect readings syncing with an ongoing notification. Optional. |
| Data | How long |
|---|---|
| Health records | While you use VistaHealth and for up to 7 years after your last activity, unless you delete them sooner. Files older than one year move to lower-cost archive storage in Mumbai and stay available to you. Automatic deletion for inactivity is not switched on yet. Before it is, we will tell you by SMS and email at least 30 days before a record is deleted for inactivity, and any activity cancels the deletion. |
| Records received through ABDM | Until the approval you gave in your ABHA app expires or is revoked |
| Dictation clips | Deleted automatically after 1 day (earlier versions of deleted files: see Backups) |
| Downloaded copies ("Download everything") | The download works for 24 hours. The copy is removed from our storage the next time it is opened after that; a copy that is never opened again stays in our storage in Mumbai until we remove it. You can ask us to remove it. |
| Meal photos you scan | Not kept by our servers after they are read. The phone app keeps the photo in your food log, in your record |
| Notifications in the app | 90 days |
| Crash reports | 90 days |
| Security and access logs, including IP addresses | About 400 days |
| Devices you signed in on | About 400 days after the device first signed in |
| Payment, invoice and tax records | 8 years from the end of the financial year they relate to, as Indian tax and company law require |
| Terms acceptances and privacy choices (with the IP address they came from); proof that a deletion was carried out | Kept after deletion as our legal record. These hold no health data. |
| Backups | Database backups roll off within 35 days. Earlier versions of deleted files are removed within 90 days. |
Under the DPDP Act you can:
We answer requests within 30 days. These rights stay open to you even if your paid plan has ended.
Members can delete their VistaHealth account and its data at any time, without contacting us. Doctors can close their account in the app. Clinics, and anyone who cannot use the app, can write to support@vistalogic.in. The full details, including what is kept and for how long, are on our Delete your account page.
You can come back anytime within 30 days. Sign in with the same mobile number and choose Restore my account. Your record comes back exactly as it was, but the access you had given stays stopped: share again with the doctors, clinics and family members you choose. The app tells you the date your account will be deleted, and if your email address is verified we email you then and again 7 days before that date.
If you want your account erased at once, without waiting 30 days, write to support@vistalogic.in. We will verify that the request is yours and erase it.
If you cannot sign in, write to support@vistalogic.in from the email on your account, or tell us your mobile number and VistaHealth ID. We will verify that the request is yours before acting, and complete it within 30 days.
Stopped at once, when you delete: your doctors, clinics and family members can no longer see your record; your share links stop working and your share requests are withdrawn; hospital consents are revoked; upcoming clinic bookings and video visits are cancelled (a paid video visit 24 hours or more away is refunded in full by the clinic or doctor; a paid video visit less than 24 hours away, and a clinic booking paid in the app, are not refunded), so no doctor or clinic keeps a slot for you; reminders and notifications stop, and your notifications are cleared; and you are signed out on every device. A child with a co-guardian is handed over to that guardian at once. During the 30 days your data is kept unchanged and hidden from everyone.
Permanently deleted after 30 days (or at once, if you ask support):
Approvals you gave in your ABHA app are managed there. Family profiles you keep are archived. Database backups that still hold your data roll off within a further 35 days, and earlier versions of deleted files are removed within 90 days (section 12). After the 30 days your account and health records cannot be recovered.
Kept:
If a personal data breach affects you, we will tell you without delay: what happened, when, the likely impact, what we are doing about it, what you can do, and whom to contact. We will report it to the Data Protection Board of India and to CERT-In within the time limits the law sets.
The VistaHealth web app (www.vistacare.co.in) uses only the cookies needed to keep you signed in and secure: sign-in session cookies that last up to 30 days (12 hours for VistaLogic admins) and are removed when you sign out. Your browser also remembers small settings such as your language. There are no advertising, analytics or tracking cookies or scripts.
The company website www.vistalogic.in is a static site. It sets no cookies and has no analytics or tracking. Some of its pages load a font from Google Fonts, so your browser's IP address is seen by Google. This policy page loads nothing from outside.
If we make a material change, we will tell you in the app before it takes effect. Where a purpose changes, we will ask for fresh consent. The version and effective date are at the top of this page.
Our Grievance Officer also answers questions about how we process your personal data.
Grievance Officer: Alahari Mallikarjuna Naidu
Email: grievance@vistalogic.in
Address: VistaLogic Solutions Private Limited, Ground Floor Flat, Plot No 237, Arsha Apartments, Kalyan Nagar Main Road, Hyderabad, Telangana 500038.
We acknowledge complaints within 24 hours and resolve them within 7 days. Requests about your personal data are handled as described in section 13.
If you are not satisfied with our answer, you may complain to the Data Protection Board of India once its complaint process is in force.
General questions: support@vistalogic.in