Privacy Policy

1. Who we are

Logora ("we", "us") is a clinical case logbook application built and operated by Dr Divya Jyoti Banerjee, a sole proprietor and independent medical software developer, with registered correspondence address at Hugli, West Bengal, India.

You can reach us at support@logora.in for product and account matters, or hello@logora.in for legal, privacy and grievance matters.

2. What information we collect

Information you give us directly

• Account information — your name, email address and password (stored as a one-way cryptographic hash) when you create an account. Optional fields: specialty, sub-specialty, role (resident, fellow, consultant, etc.), institution, profile photo, region mode preference.
• Waitlist and survey responses — if you sign up via our website, we collect the email and survey answers you submit. These are processed via Tally and routed to us via Make for automated welcome email handling.
• Communication — when you email us, we keep that correspondence so we can respond and provide support.

Clinical data you enter

This is the most important section. Read carefully.

Logora is designed NOT to handle directly identifiable Protected Health Information. You are expected to enter anonymised case data. Use patient codes (e.g., "PT-247") rather than names. Do not enter MRN, Aadhaar numbers, full addresses, or any other patient-identifying information. The app does not request these fields.

The clinical data you enter — diagnosis, lab values, procedures, medications, microbiology results, histopathology reports, complications, mortality and morbidity (M&M) flags, etc. — is treated as your professional educational record, not as patient health records. You are the data controller for this data. We store it on your behalf.

Educational and research records

If you use the AETCOM, Thesis Pipeline, or Academic Portfolio features (India compliance pack), we also store data about your training, not about patients:

• AETCOM module completion dates, faculty names you record, and your reflective notes
• Thesis title, guide and co-guide names, course start date, IEC approval status, and stage progress
• Seminars, journal clubs, CME entries, conferences and publications you log
• Gamification data — XP, daily streak and level (derived from your case log activity)

This data is treated with the same security standard as your clinical case data. The faculty names you record are personal data of those individuals; you are responsible for ensuring you have a reasonable basis (e.g., the educational context) to log them.

Sensitive Personal Data classification

Under India's DPDP Act 2023, clinical and educational data you enter into Logora qualifies as Sensitive Personal Data because it relates to professional health practice and clinical decisions. We treat all clinical data with the highest standard of protection:

• Encrypted both at rest and in transit
• Restricted access — only you, and only Dr Banerjee for technical support purposes when you explicitly request it
• Never used for advertising, profiling, or any non-essential purpose
• Never shared with third parties except the limited service providers required to operate the app
• Never sold under any circumstances

Information we collect automatically

• Usage data — which screens you visit, which features you use, errors that occur. Collected anonymously via PostHog. We use this only to improve the app.
• Device information — device type, operating system, app version, language preference.
• Crash reports — if the app crashes, anonymised diagnostic information is sent to Sentry to help us fix the bug. Crash data does not include your case content; only stack traces and the app state at the point of failure.
• Approximate country — derived from IP address. We do not store the full IP address.

What we do NOT collect

• Patient names, MRN, hospital ID (outside India Mode), Aadhaar, or other identifiable patient details
• Your precise (GPS) location
• Your contacts, photo library, or files outside what you explicitly upload
• Audio or video recordings
• Biometric data
• Financial account credentials beyond what payment processors handle directly

3. How we use your information

4. AI processing — important details

Some Logora features use AI, specifically Anthropic's Claude API accessed through our own server-side proxy hosted on a managed serverless platform:

• PDF / image extraction — when you upload a discharge summary or report, the file is sent to Claude via our proxy for extraction, then deleted from our servers within minutes. The extracted data is returned to your device.
• Viva question generation — when you tap "Generate viva questions" on a case, the case summary is sent to Claude through our proxy and questions are returned.
• Scoring suggestions — when scoring-system suggestions are enabled, the relevant clinical fields are sent to Claude through our proxy and suggested values are returned.

According to Anthropic's privacy policy, data sent via the API is not used to train their models. Our proxy does not retain the request body after the response is returned; only minimal request metadata (timestamp, model used, success/error status) is logged for billing and abuse-detection purposes.

5. Where your data is stored

We deliberately chose Indian data residency for clinical and account data. Some third-party services (Brevo, Tally, Make, PostHog, Sentry, Anthropic) are based outside India and process only the limited categories of data shown above. For users in the European Union or United Kingdom, cross-border transfers are covered by the Standard Contractual Clauses (or equivalent transfer mechanism) offered by each of those providers.

6. Who we share your data with

We do not sell your data. We do not share it with advertisers. We do not share it with anyone outside the limited service providers listed below.

The only third parties we share data with are the platforms that help us operate Logora:

• Google Firebase — authentication, cloud database, crash reporting infrastructure
• Anthropic — AI processing, only when you use AI features
• Tally — waitlist and survey forms on our website
• Make — automation between Tally signups and welcome email delivery
• Brevo — sending transactional and waitlist emails on our behalf
• Zoho — email mailbox for support@logora.in and hello@logora.in
• PostHog — anonymised product analytics
• Sentry — anonymised crash and error reporting
• Netlify — website hosting
• Payment processors — once paid plans launch, a regulated processor will handle payments directly; we will not store full card details

Each of these has its own privacy policy and is contractually obligated to protect your data. A current list of named sub-processors will be published at https://logora.in/subprocessors once paid plans launch.

We may disclose information if compelled by law (e.g., a court order from an Indian court, or a similar lawful request from another jurisdiction in which our service providers operate). We will notify you unless legally prohibited from doing so.

7. Your rights

Under India's Digital Personal Data Protection Act 2023, and aligned with the GDPR, UK GDPR and CCPA where applicable, you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your account and all associated data ("right to erasure" / "right to be forgotten")
• Withdraw consent for processing at any time
• Export your case data in CSV format (a built-in app feature)
• Object to specific uses of your data, including for product analytics
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity (under DPDP Act § 14)
• File a grievance with us, or with the Data Protection Board of India

To exercise any of these rights, email hello@logora.in. We respond within 30 days.

8. Grievance Officer

9. Data retention

You can request earlier deletion at any time by emailing hello@logora.in. We will comply within 30 days unless legally required to retain certain data (e.g., financial records under tax law).

10. Data security

We take security seriously, but no system is 100% secure. We implement:

• HTTPS / TLS encryption for all data in transit
• Encryption at rest for cloud-stored data (Firebase default AES-256)
• Password hashing using industry-standard algorithms (handled by Firebase Authentication)
• Limited access — only Dr Banerjee has access to production data, and only when troubleshooting on user request
• Regular security review of dependencies and third-party services
• Automatic logout after extended inactivity
• DKIM, SPF and DMARC configured on the logora.in domain to prevent email spoofing

In case of a data breach

If we discover a data breach affecting your personal information, we will, within 72 hours of becoming aware:

• Notify you by email at the address associated with your account
• Notify the Data Protection Board of India (as required by the DPDP Act 2023) and CERT-In where applicable
• Tell you, in plain language: what happened, what data was affected, what we are doing about it, and what you should do
• Maintain a public incident report on logora.in if the breach is significant

You will not have to chase us for information. Transparency in case of failure is part of our commitment to you.

11. Children's privacy

Logora is intended for medical professionals and trainees aged 18 or older. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, contact us at hello@logora.in and we will delete the account.

12. Cookies and tracking

The Logora website (logora.in) uses minimal cookies, only what is necessary for the site to function. We do not use third-party advertising cookies or behavioural retargeting. Anonymised analytics on the mobile app are handled via PostHog (no cross-site identifiers). The mobile app itself does not use browser cookies; it uses standard local storage to keep you logged in and to cache your cases offline.

13. International users

Logora is operated from India. By using Logora, you understand that your data may be processed in India and other countries where our service providers operate (primarily Mumbai for clinical and account data; European Union for forms, automation and outbound email; United States for AI, analytics and crash reporting).

If you are based in the European Union, the United Kingdom, or California, you have additional rights under GDPR, UK GDPR and CCPA respectively. We will honour these rights to the extent applicable. Cross-border transfers from those regions to India and our other processors are covered by Standard Contractual Clauses (or equivalent transfer mechanisms) provided by each processor.

14. Patient data and your responsibilities as a user

Logora is a personal academic logging tool. You, the user, are responsible for:

• Ensuring you have any consent or authorisation required by your hospital, university or jurisdiction to log clinical case data, including (where applicable) under hospital privacy policies, the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations 2002, HIPAA, GDPR, the UK Common Law Duty of Confidentiality, or equivalent rules in your country.
• Entering data in de-identified form. Do not enter real patient names, government identifiers (Aadhaar, NHS number, SSN, MRN beyond what your institution permits), or photographs that show identifying features of a patient's face or surroundings.
• Using the app's International Mode if you practise in a jurisdiction (EU / EEA / UK / US / Canada / Australia / GCC) where storing hospital identifiers would breach local law.
• Reporting any unintentional capture of identifiable patient information to hello@logora.in so it can be deleted.

Under the DPDP Act and GDPR, you act as the Data Fiduciary / Data Controller for any patient data you enter, and Logora acts as the Data Processor on your instructions.

15. Changes to this policy

We may update this Privacy Policy as Logora evolves. When we do, we will:

• Update the "Last updated" date at the top of this page
• Notify all account holders by email if changes are material
• Maintain previous versions on request

When the Government of India notifies operational rules under the DPDP Act 2023 (the DPDP Rules), we will update this policy to align with the prescribed notice and consent-manager formats.

Continued use of Logora after changes constitutes acceptance of the updated policy.

16. Contact us

For any privacy-related question, request, or concern:

For grievances under the DPDP Act that we cannot resolve, you may approach the Data Protection Board of India.

One last thing

Logora exists because medical trainees deserve better tools. We are not in the business of selling data. We are in the business of helping you log cases, build research, and grow as a clinician. If anything in this policy feels unclear or inconsistent with that mission — please tell us. We will fix it.