Privacy policy

Trichora (“Trichora”, “we”, “us”) builds AI-assisted hair and scalp measurement software for dermatology and hair-restoration clinics.

This policy covers two different situations, and our role is different in each:

• This website (dev.healthtec.ai). When you browse the site or request a demo, we decide why and how your data is used. We are the Data Fiduciary.
• The Trichora platform (clinic dashboard, SDKs and API). When a clinic scans a patient, the clinic decides why the data is processed and is the Data Fiduciary. We process that data only on the clinic's documented instructions, as its Data Processor, under a written agreement.

If you are a patient, your clinic is your first point of contact for questions about your scans. We will help your clinic respond.

Information you give us

When you request a demo we collect your name, role, clinic or organisation, city, work email, phone or WhatsApp number, clinic size, the products you are interested in and anything you write in the message field, together with your consent to be contacted.

Information collected automatically

Like every website, our servers and hosting provider receive technical data needed to deliver the page and keep it secure: IP address, browser and device type, pages requested, and the date and time of the request. We use the IP address of form submissions to prevent spam and abuse.

Cookies

This website does not use advertising or tracking cookies, and it does not currently use analytics. If we add analytics in future, we will update this policy first and, where required, ask for your consent.

• To reply to your demo request, arrange calls and send the information you asked for.
• To send a one-time confirmation that we received your request.
• To keep the website secure and to detect and prevent spam or abuse.
• To comply with legal obligations.

We process this data on the basis of your consent, given when you tick the consent box on our forms, and for legitimate uses permitted by law, such as security. We do not sell your data, and we do not add you to marketing lists you did not ask for. You can withdraw your consent at any time by emailing hello@healthtec.ai; we will stop contacting you.

When a clinic uses Trichora, the platform processes:

• Patient scan data — the five guided scalp photographs (front, left, right, top and back) and the measurements derived from them: hairline map, grade, zone thinning percentages, temporal and occipital flags, progression outlook and the draft treatment protocol.
• Health questionnaire answers — the patient's answers to a short medical history questionnaire (for example sex and age, family planning, recent illness or infection and how long the hair loss has been noticed), used only to personalise the treatment the doctor approves.
• Orders and delivery — where the clinic offers ordering, the items ordered against the signed prescription and the delivery name, address and phone number needed to dispense and deliver them.
• Prescriptions and messages — the protocol and prescription a doctor approves (with the doctor's name, qualification and registration number), the patient's WhatsApp number where the clinic uses WhatsApp delivery, and a record of the reports, prescriptions and reminders sent.
• Patient details the clinic chooses to record — for example a name or clinic patient ID, age and sex, needed to produce and track a report.
• Clinic user data — staff names, work emails, roles and activity logs (every scan, view, edit, signature and share is logged for the audit trail).

Consent first. Explicit patient consent is captured in the app before a scan. Trichora is a measurement and decision-support tool: every treatment protocol is reviewed, edited where needed and signed by a registered medical practitioner before it reaches the patient.

Our model was developed using expert-annotated, multi-angle scalp images labelled by trichologists. We take the use of health images for AI seriously:

• No training without separate opt-in. Images and reports processed for a clinic are never used to train or improve our models unless the patient gives separate, explicit, opt-in consent, in addition to their consent to the scan itself, and the clinic agrees to it.
• Opt-in can be withdrawn. If a patient withdraws it, their images are excluded from future training runs.
• Minimised and de-identified. Images used for model improvement are de-identified (names, contact details and clinic identifiers removed) and kept separate from clinic production data, with access limited to authorised staff.
• Not sold. We do not sell patient images, reports or datasets to third parties.

We share personal data only with service providers that help us run our services, and only what they need:

• Cloud hosting for the platform. Patient records, images and reports are stored in India (Mumbai region).
• Pharmacy and delivery partners. When a patient orders the prescribed treatment, the prescription and the delivery details are shared with the clinic's licensed pharmacy partner and its delivery provider, only to dispense and deliver that order.
• WhatsApp messaging. When a clinic uses WhatsApp delivery, the report link, prescription, order link and reminders are sent to the patient's WhatsApp number through the official WhatsApp Business Platform (operated by Meta), only after the patient has agreed to receive them. The message content is processed by Meta under its own terms and may be handled outside India; the records themselves stay stored in India. Patients can ask the clinic to stop WhatsApp messages at any time.
• Website hosting and email delivery. Demo requests from this website are delivered to our team by our email provider (Resend). Website hosting and email providers may process website enquiry data outside India. Patient data is never sent through these services.
• Professional advisers and authorities, where required by law or to protect our rights, users or the public.

Each provider is bound by a contract requiring confidentiality, appropriate security and use only on our instructions. If our business is reorganised or sold, data may transfer to the successor under the same protections. We will tell you if that happens.

• Demo requests: up to 24 months after our last contact with you, unless you become a customer or ask us to delete them sooner.
• Patient images and reports: for as long as the clinic's retention setting specifies. Clinics control retention, and deletion requests are honoured across all copies, including backups, within our standard backup cycle.
• Audit logs: for as long as the clinic agreement requires, so clinics can meet their own record-keeping duties.
• Technical logs: typically 30–90 days for security and troubleshooting.

• Encryption in transit (TLS 1.2+) and at rest (AES-256). Images are encrypted on the device before upload.
• Role-based access for front desk, doctor and admin users, separate API keys for each clinic, and SSO for chains.
• A full audit trail of scans, views, edits, signatures and shares, which clinics can export at any time.
• Least-privilege access for our staff, with confidentiality obligations and security training.
• Breach response: if a personal data breach occurs, we will notify affected clinics without undue delay, and the Data Protection Board of India and affected individuals as the law requires.

Subject to applicable law, including the DPDP Act, you can:

• Ask for a summary of the personal data we hold about you and how we use it.
• Ask us to correct, complete, update or erase your personal data.
• Withdraw consent at any time. This does not affect processing that happened before you withdrew.
• Nominate another person to exercise these rights if you die or become incapacitated.
• Raise a grievance with us and, if you are not satisfied with our response, with the Data Protection Board of India.

For website data, email hello@healthtec.ai. For patient scan data, please contact your clinic first; we will support them in responding. We respond to verified requests within the time the law requires.

This website is intended for healthcare professionals and businesses, not children. On the platform, scans of anyone under 18 can only be taken with verifiable consent from a parent or lawful guardian, captured by the clinic, and such data is never used for model training or any form of tracking or targeted advertising.

If you have a question or complaint about how we handle personal data, contact:

Grievance Officer
Trichora
hello@healthtec.ai

You can also reach us through our contact page.

We will update this policy when our practices or the law change. The “last updated” date at the top shows when it was last revised. For material changes, we will notify clinic customers in advance and highlight the change on this page.