Privacy policy

Who we are and who this covers

This website is published by PureBrix Solutions Pvt Ltd (“PureBrix”, “we”, “us”, “our”), registered at Innov8, Upper Ground Floor, Graphix Tower 2, A-13, Sector 62, Noida, Uttar Pradesh 201301, India. PureBrix makes hospital software: SanoBrix, VitaBrix, VitroBrix, LumenBrix and CuraBrix (together, “our products”).

For any question, request or complaint about this policy or about how we handle information, write to legal@purebrix.com. We have not appointed a Data Protection Officer. Privacy questions, requests and complaints all reach legal@purebrix.com, which is monitored by the people who can act on them.

Who this policy is for

It covers the people whose information reaches us through this website:

• anyone who asks for a demonstration, or otherwise contacts us through this site;
• anyone who emails, writes or calls us in response to it;
• anyone applying for a role with us through the careers page.

It does not cover patient data held in a hospital’s own deployment of our products. That relationship works differently and is set out in section 11.

What we collect

Information you give us

If you complete the demo request form we receive what you typed into it: your name, your role, your hospital or organisation, your work email address, your phone number, and any message you add. Our website host, which receives and stores the submission, also records your IP address, the browser you used and the page you came from — you do not type these, they are captured automatically with every submission.

If you email, write or call us instead, we hold whatever you choose to tell us in that correspondence, including anything in an attachment you send.

If you apply for a role, we receive your application and whatever you include with it — typically your name, contact details, work history and any covering note.

We ask for work contact details rather than personal ones. There is no reason to send us patient information, clinical records or special category data through this website, and you should not. If you do, we will delete it and tell you that we have.

Information collected automatically

This website sets no cookies. It stores nothing in your browser, runs no analytics, carries no advertising or social media pixels, and does not track you here or anywhere else. There is no consent banner because there is nothing to consent to. The cookie notice sets this out in full.

PureBrix keeps no logs of this website and runs no analytics. We cannot tell you who visited, when, or from where, because we do not hold that information at all. A request necessarily reaches our website host’s servers to be served, and whatever those servers record is the host’s own: we have no access to it, we do not use it, and we could not retrieve it for you if you asked.

Typefaces loaded from a third party

The pages request two typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). To deliver a font, Google necessarily receives your IP address and may log the request under its own terms. Nothing else about you is shared with Google, Google Fonts sets no cookies, and the site displays correctly without them.

Why we use it, and on what basis

We use the information above only for the purposes below. The third column is the legal ground we rely on; which framework applies depends on where you are, and the wording should be confirmed for the countries PureBrix operates in.

Answering you, and arranging a demonstration

Because you asked us to. Where a legal basis must be named, this is steps taken at your request, and our legitimate interest in responding to a business enquiry.

Preparing a demonstration that is useful to your hospital

Knowing which departments matter to you lets us show the right thing. Basis: our legitimate interest in presenting the product accurately.

Keeping a record of our correspondence

So that a conversation can be picked up again and so we can show what was discussed. Basis: our legitimate interest in running the business and keeping proper records.

Considering a job application

Basis: steps taken at your request before entering a contract of employment.

Meeting obligations that apply to us

Basis: compliance with a legal obligation.

We do not sell your information. We do not share it so that anyone else can market to you, we do not use it to build a profile of you, and we make no decisions about you by automated means.

PureBrix operates in India, so the Digital Personal Data Protection Act 2023 is the framework that applies, and the bases above are expressed in the terms it uses. If we begin selling into countries with a different framework, we will set out the equivalent bases for those countries rather than assume these carry across.

Marketing

If we send you anything beyond a reply to your own enquiry — a product update, an invitation, a newsletter — we will do so only where we are permitted to, and every message will carry a plain way to stop receiving them.

Asking us to stop takes effect for all such messages and we will action it within five working days. It does not stop us replying to something you have asked us about, and it does not affect messages we must send you for legal or contractual reasons.

Where consent is the basis for a message, you can withdraw it at any time. Withdrawing consent does not make anything we did beforehand unlawful.

Who else sees it

Your information is seen by the people at PureBrix who need it to act on your enquiry. Beyond that, it is handled by the suppliers who run the systems we use to operate.

Our website host serves these pages and receives and stores every demo-request enquiry, which it also emails to us. An enquiry stays with the host until we delete it. Our email provider then carries that enquiry to us and holds our side of the correspondence. Those two are the only suppliers involved — there is no CRM, no applicant-tracking system and no analytics — and we will name either of them on request.

Those suppliers act on our written instructions, are bound to confidentiality, and are not permitted to use your information for their own purposes. We keep a record of who they are and review it at least once a year.

Other circumstances

We may also disclose information where:

• the law, a court or a regulator requires it;
• it is necessary to establish, exercise or defend a legal claim;
• it is necessary to protect the rights, property or safety of any person;
• our business or part of it is sold or reorganised, in which case the recipient is bound by this policy until they give you notice of their own.

How long we keep it

We keep information for as long as it is needed for the purpose it was collected for, and then delete it. In practice:

Enquiries that did not lead anywhere

12 months from our last contact with you, so we can pick up a conversation that restarts. After that we delete it.

Enquiries that became a customer relationship

for the life of the relationship, and seven years afterwards, in line with the record-keeping obligations that apply to us.

Job applications where we did not make an offer

12 months, so we can come back to you if something suitable opens — unless you ask us to delete it sooner.

Server logs

We hold none. Anything our host records in operating its own servers is subject to its retention, not ours.

Marketing opt-outs

Kept indefinitely. We have to remember that you asked us not to contact you.

Where we are required to keep something for longer, we do, and we keep it only for that reason. You can ask us to delete information sooner — see section 8.

Where it is held and transferred

A demo-request enquiry is stored by our website host and also delivered to us as an email, so it exists in two places: with the host until we delete it, and in our mailbox. PureBrix operates from India, and our own working copies stay here. Our website host and our email provider operate internationally, so a copy may rest on their infrastructure outside India; we can tell you where for either supplier if you ask.

Where information moves between countries, we put appropriate safeguards in place for that transfer before it happens. The safeguard we rely on is contractual: our agreement with each supplier binds it to handle your information only on our instructions, keep it confidential, and secure it to a standard no lower than our own.

You can ask us for details of the safeguard that applies to a particular transfer, and we will tell you.

Your rights

Depending on where you are, some or all of the following will apply to you. We will not charge you for exercising them, and we will not treat you differently for having done so.

Access

Ask whether we hold information about you and, if so, receive a copy of it along with an explanation of how it is used.

Correction

Have anything inaccurate corrected, and anything incomplete completed.

Deletion

Ask us to delete information where there is no longer a good reason for us to hold it.

Restriction

Ask us to stop using information while a question about it is resolved.

Objection

Object to our using information where we rely on legitimate interests, and object at any time to its use for direct marketing.

Portability

Receive information you gave us in a structured, commonly used, machine-readable form, and have it sent to someone else where that is technically feasible.

Withdrawing consent

Withdraw a consent you gave, at any time, without affecting anything done beforehand.

Nominating someone

Where the law where you live provides for it, nominate another person to exercise these rights on your behalf.

Human review

Not be subject to a decision made solely by automated means that significantly affects you. We make none.

How to exercise them

Write to legal@purebrix.com. We will acknowledge within five working days and respond within 30 days, or tell you within that time if we need longer and why. We may need to confirm who you are first, and we will only ask for what is necessary to do that.

If you are not satisfied

Tell us, and we will look at it again. You also have the right to complain to the data protection authority where you live, work, or where you believe something has gone wrong. In India that is the Data Protection Board of India, established under the Digital Personal Data Protection Act 2023. You do not have to come to us first, though we would rather you did, because we can usually fix it faster.

How we protect it

We take technical and organisational measures appropriate to the information we hold. Specifically, and only what is true:

• this website is served over HTTPS, and requests to it are upgraded to HTTPS automatically;
• it carries a content security policy, and headers that prevent it being framed, that stop content-type sniffing and that limit what is sent in a referrer;
• it sets no cookies and stores nothing in your browser, so there is nothing on your device for anyone to read;
• access to enquiry correspondence inside PureBrix is limited to the people who need it;
• accounts are individual rather than shared, so an action can be traced to a person;
• anyone we allow near your information is under a confidentiality obligation.

That is the whole of it. We hold no security certification, and we are not going to imply one by listing standards we merely have in mind.

If something goes wrong

If information is lost, disclosed or accessed without authorisation, we will investigate, contain it, and notify the relevant authority and the people affected where the law requires it and within the time it requires. We will tell the Data Protection Board of India without delay and in any case within 72 hours of becoming aware, and we will tell you without delay where the breach is likely to affect you. Where an incident is also reportable to CERT-In, we report it within the 6 hours that direction requires. If the law allows us longer than these, we hold ourselves to these.

No method of transmitting information over the internet is completely secure, and we cannot guarantee absolute security. Please do not send sensitive personal or clinical information through this website.

Children

This website is intended for hospital and healthcare professionals acting in a professional capacity. It is not directed at children, we do not knowingly collect information about anyone below the age at which consent is required where they live, and we do not offer any service on this site to a child.

If you believe a child has sent us information, tell us and we will delete it promptly.

Patient data and hospital deployments

This is the section most readers of a healthcare vendor’s privacy policy actually want, so it is worth being exact.

The hospital controls the data, not us

Our products are deployed for a hospital and run in that hospital’s own environment. The hospital decides what patient data is recorded, who may see it, how long it is kept, and what happens to it. In data protection terms the hospital is the controller of that data and PureBrix is not. This website policy does not govern it, and no patient data reaches PureBrix through this website.

When we handle data on a hospital’s behalf

During implementation, migration or support we may process data on a hospital’s instructions. Where we do, it is under a separate written agreement covering at least:

• the subject matter, duration, nature and purpose of the processing;
• that we act only on the hospital’s documented instructions;
• confidentiality obligations on everyone we allow near it;
• the security measures that apply;
• the terms on which we may engage a sub-processor, and our responsibility for them;
• assistance with data subject requests, impact assessments and regulator enquiries;
• breach notification to the hospital without undue delay;
• deletion or return of the data at the end of the engagement;
• audit and inspection rights.

How support reaches a live system

PureBrix holds no standing access to a hospital’s deployment. Our team cannot connect to a live system at will, and does not hold permanent credentials for one.

Where an incident needs it, the hospital’s own IT team opens a route — a VPN session, a remote session or a temporary account — and closes it afterwards. The hospital decides whether to grant access, to whom, and for how long. It can refuse, and it can revoke at any point.

What our staff then do is recorded twice: in the system’s own audit trail, where every action is attributed to the person who took it exactly as it is for a hospital user, and against a support ticket recording who asked for the access, why, and when it was closed. The hospital can reconcile the two, and can ask us for either.

Support is provided by the team that builds the product — for the first year as part of the implementation, and after that under an annual maintenance agreement. The access model above does not change between the two.

If you are a patient

Your hospital is the right place to ask about your own records. We cannot reach them, we have no authority over them, and we cannot act on a request about them. Your hospital can.

Changes to this policy

We may update this policy as our practices or the law change. The version in force is always the one published here, with the effective date shown at the top of the page.

Where a change materially affects how we use information you have already given us, we will take reasonable steps to tell you before it takes effect — by email where we have your address, and by a notice on this page in any event. Previous versions are available on request.

How to contact us

For any question, request or complaint about this policy or about how we handle information:

By email

legal@purebrix.com

By post

PureBrix Solutions Pvt Ltd, Innov8, Upper Ground Floor, Graphix Tower 2, A-13, Sector 62, Noida, Uttar Pradesh 201301, India

Through the site

The contact page — though please do not put sensitive information in that form.

We aim to acknowledge every message within five working days.