Effective August 14, 2026
This Privacy Policy explains how Chounda Tech (OPC) Private Limited, trading as Chounda ("Chounda Tech", "we", "us"), collects, uses, and protects information when you use NexOP, our OP visit registration and billing app for clinics ("the App"). NexOP is governed by and complies with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.
This Privacy Policy applies to all users of NexOP globally, except where regional restrictions apply. NexOP is not available in the United States or the European Economic Area, and users in those regions are not permitted to create accounts. This policy does not make any claims of compliance with HIPAA, GDPR, or other US/EU data protection frameworks. By using NexOP, you confirm that you are accessing the service from a jurisdiction where it is available.
NexOP is a billing and operations tool, not a clinical documentation system. We do not collect or store diagnoses, prescriptions, vitals, or clinical notes. The information we do collect includes:
We collect and process personal data solely to create and maintain your account, provide the core visit registration and billing features of the App, process subscription payments, respond to support queries, improve the product through aggregated anonymised analysis, and comply with applicable Indian law. We do not use your data for advertising, profiling, or any purpose beyond those listed.
To deliver the NexOP service, we engage the following third-party processors, each contractually bound to handle your data only as directed by us and in accordance with applicable law:
We do not sell or share your personal data with any third party for their independent use.
Some of our processors (including Supabase, AWS, RevenueCat, and Resend) are headquartered or operate infrastructure outside India, so your data may be stored and processed in data centres located in other countries, including the United States. We take reasonable steps to ensure transfers are covered by appropriate safeguards, including processor agreements obligating data to be handled securely and only for the purposes described in this policy. As the DPDP Act's cross-border transfer rules are progressively notified, we will update our practices accordingly.
Visit and billing data is stored securely and scoped to your clinic account — staff on one clinic account cannot see another clinic's records. We use account, database, and storage access controls designed to limit access to authorised users, and data is transmitted using secure connections. NexOP syncs data between your device and our servers when a connection is available; while offline, data is held locally until it can sync.
In addition, identifying patient fields are encrypted on your device using AES-256-GCM before they are synced, with an encryption key that belongs to your clinic alone. That clinic key is stored only in protected form, wrapped by a master key held in AWS Secrets Manager and never kept in our database or in the App. Only active members of your clinic can retrieve the clinic key, and it is cleared from the device when you sign out or switch clinic. On Android it is held in the app's encrypted storage, on iOS in the Keychain, and in a browser it is held in memory for that session only.
Clinic owners can generate single-use recovery codes that restore access to the clinic key if normal retrieval fails. Recovery codes are sensitive: you are responsible for storing them securely and not sharing them. Data exported from the App is unencrypted, so exports should also be stored securely. No digital system can be guaranteed to be completely secure — you remain responsible for protecting your account credentials, recovery codes and devices. A plain-language description of this model is on our Data safety page.
We retain your data for as long as your account is active and as necessary to fulfil the purposes described in this policy. When your account is deleted, all account, visit, billing, and subscription records are permanently purged from our active database within 30 days of the deletion request, in accordance with the DPDP Act 2023. Backup copies held by our service providers are purged within the same 30-day window. We recommend using the in-app export function to keep your own copy of your records before requesting deletion, as this will be the only copy available to you afterward.
Under the DPDP Act 2023, you have the right to access a summary of the personal data we hold about you, request correction of inaccurate data, request erasure of your data, raise grievances about how your data is processed, and nominate another individual to exercise your rights in the event of death or incapacity. To exercise any of these rights, contact us at [email protected].
NexOP is intended for use by clinic staff and registered medical professionals aged 18 and above. We do not knowingly collect personal data from individuals under 18. If we become aware that data has been submitted by a minor, we will take steps to delete it promptly.
In accordance with the Digital Personal Data Protection Act, 2023, any grievances regarding the processing of your personal data may be directed to the Grievance Officer:
Grievance Officer
Chounda Tech (OPC) Private Limited
Vanitha Hospital, 3/231, Sankagiri Main Road, Kondalampatty, Salem – 636010, Tamil Nadu, India.
Email: [email protected]
We aim to acknowledge all grievances within 48 hours and resolve them within 30 days of receipt.
We may update this policy as NexOP evolves. Material changes will be reflected here with a new effective date, and where appropriate, we will notify you by email or in-app notice.
Questions about this policy or your data? Email us at [email protected].