Privacy Policy

CrelioHealth values your privacy and is committed to protecting the information entrusted to us. This Privacy Policy explains how we collect, use, disclose, store, and protect information when you access or use our websites, laboratory information management systems (LIMS), laboratory information systems (LIS), PACS and RIS platforms, inventory and patient requisition platforms, patient portals, mobile applications, integrations, APIs, and related services (together, the "Services").

Please read this Privacy Policy carefully. By accessing or using the Services, you acknowledge that you have read and understood it. If you do not agree with our practices as described here, please do not use the Services.

Who We Are

In this Privacy Policy, "CrelioHealth," "we," "us," and "our" refer to the CrelioHealth group, including:

  • Creliant Software Private Limited, a company incorporated in India, with its registered office at 8th Floor, Baner Biz Bay, Laxman Nagar, Baner, Pune, Maharashtra 411045, India.
  • CrelioHealth Inc., 8865 Stanford Blvd, 2nd Floor, Suite 202, Columbia, MD 21045, United States.

The CrelioHealth entity that provides the Services to you is the one named in your service agreement or, for our websites, the one that operates the website you are visiting. "You" means any visitor, user, customer, or other person who interacts with us or the Services.

Scope and Applicability

This Privacy Policy applies to information collected through our websites, applications, products, services, customer support channels, and other interactions with CrelioHealth. It applies to customers, healthcare organizations, laboratories, diagnostic chains, radiology practices, healthcare providers, patients who use customer-operated portals, business partners, vendors, and visitors to our websites.

We serve customers in the United States, India, the Kingdom of Saudi Arabia (KSA), the wider Middle East, Southeast Asia, and other regions. The sections below apply to everyone. The section titled "Regional Notices" adds information for people in specific jurisdictions. Where local law gives you rights beyond those described here, those rights apply to you.

Our Role: Processor or Controller

CrelioHealth acts in one of two roles, depending on the type of information involved.

  • Processor or service provider (patient and healthcare data). In most of our operations, we provide technology services to laboratories, hospitals, and other healthcare organizations that decide how patient information is collected and used. These customers are the data controllers, or covered entities under US HIPAA. We process this information only on their behalf and in line with our contracts, executed Business Associate Agreements (BAAs) where applicable, and applicable law. In the United States, we act as a Business Associate.
  • Independent controller (corporate and account data). For our own business operations, we collect corporate and account data such as administrator login credentials, billing details, purchase records, and marketing analytics. We decide how this information is used to maintain, secure, and improve our accounts and public-facing platforms. We keep it separate from patient health data workflows.

If you are a patient and your information was entered by a laboratory or healthcare provider, that organization is responsible for the information. Please contact them first about access, correction, or deletion. We will support them in responding to your request.

Information We Collect

We collect information directly from you and automatically when you visit our websites or applications, create an account, request a demo, respond to a survey, fill out a form, contact support, or use the Services.

Account and Business Contact Information

We may collect personally identifiable information that you provide when you create an account, request information, subscribe to communications, purchase the Services, or contact us. This may include your name, email address, telephone number, mailing address, organization details, job title, payment information, and other details needed to provide the Services.

Sensitive Personal Information and Health Data

Depending on how our customers use the Services, we process sensitive personal information and health data on behalf of healthcare organizations, laboratories, healthcare providers, and other authorized entities. This may include patient identifiers, laboratory records, diagnostic reports and images, treatment-related information, insurance information, and other healthcare data needed to deliver and manage healthcare services. It may also include financial information such as payment methods and card details. In the United States, this category includes Protected Health Information (PHI).

Google Single Sign-On and Google API Disclosures

Some Services let you sign in with Google Single Sign-On. When you choose this option, we receive information from your Google account that we need to verify your identity and give you access to the Services. We use this information only for authentication, account management, and security.

CrelioHealth's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Technical and Usage Information

We automatically collect certain information about how you interact with the Services. This may include your browser type, operating system, device information, IP address, internet service provider, access times, usage patterns, log files, diagnostic data, and other technical details. We use it to operate, maintain, secure, and improve the Services. This information is generally not used to identify you directly.

Cookies and Similar Technologies

Our website and applications use essential cookies and similar tracking technologies to operate the Services, maintain security, and remember your preferences. With your consent, where required by applicable data protection laws, we also deploy non-essential cookies (including third-party analytics and marketing tools) to analyze traffic and improve user experience. You can accept, decline, or customize your preferences at any time using our Cookie Settings link in the footer or through your browser settings. Please note that restricting or disabling strictly necessary cookies may impact the availability, functionality, or performance of certain features within our Services.

Location Information

Some Services collect location information when it is needed for an operational workflow. For example, the CrelioHealth Phlebotomist application uses location data to share estimated arrival times and distance, support order fulfillment, and send order status updates, alerts, and refund notifications where applicable. We collect location data only as needed to provide the Services and in line with the permissions on your device. You can change these permissions in your device settings at any time.

How We Use Information

We collect and use information for legitimate business, operational, contractual, and legal purposes, including:

  • Service delivery: providing and maintaining the Services, creating and managing accounts, processing transactions and payments, and providing customer support.
  • Product improvement: analyzing how the Services are used so that we can develop new features, run internal analytics, and keep our systems healthy. We use aggregated information to understand how users as a group use our websites and applications.
  • Communications: sending service-related notices, responding to inquiries, and, where permitted by law and in line with your choices, sending newsletters, company news, product updates, and information about promotions, contests, or surveys.
  • Operations and logistics: supporting order management, delivery tracking, and phlebotomy workflows.
  • Security and compliance: protecting our systems, preventing fraud and misuse, meeting regulatory requirements, and enforcing or defending our contractual and legal rights.

You can unsubscribe from marketing emails at any time by using the link in the email or by contacting us. Service-related notices will continue.

Protected Health Information and Health Data

When we process health data on behalf of our customers, we do so only to provide the contracted Services and in line with applicable agreements and law.

  • Access controls: access to health data is limited to authorized personnel who need it to perform their duties.
  • Safeguards: we use administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of health data.
  • No sale or advertising use: we do not sell health data, and we do not use it for advertising or marketing.

In the event of any conflict between this Privacy Policy and an executed Business Associate Agreement (BAA) with a covered entity, the terms of the BAA shall govern with respect to Protected Health Information.

Artificial Intelligence and Automated Technologies

Some features of the Services use artificial intelligence, machine learning, automation, or advanced analytics to support laboratory and healthcare workflows. Information processed by these technologies remains subject to this Privacy Policy and to our security and contractual obligations. CrelioHealth does not use customer data or Protected Health Information to train publicly available artificial intelligence models. Customers remain responsible for reviewing and validating information generated by automated tools where appropriate.

How We Share Information

We do not sell, rent, or trade personal information. We limit access to personal information to employees, contractors, service providers, partners, and other authorized third parties who need it to perform legitimate business functions or to support the Services. These parties are bound by confidentiality obligations and must handle information in line with legal and contractual requirements.

We may share information in the following ways:

  • With our customers and authorized recipients: we disclose information to the laboratory, healthcare provider, or organization that controls it, and to patients or their doctors, as instructed by the customer or as required by contract.
  • With service providers: we use third-party providers to help us operate our business and the Services, for example, to host data, send newsletters or surveys, or process payments. We share information with them only for these limited purposes and, where required, with your permission.
  • With authorities: we may disclose information to regulators, courts, or other authorities where the law requires it or where it is needed to protect rights, safety, or security.
  • In aggregated or de-identified form: we may share aggregated, anonymized, or de-identified information that does not identify any individual with business partners and research/industry affiliates for analytical and product improvement purposes.
  • In a business transfer: if we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy and applicable law.

Data Hosting, Security, and International Transfers

Hosting and Data Residency

For our US customers, all Protected Health Information and application data are hosted on cloud infrastructure located entirely within the United States. For customers in other regions, we host data in the region agreed with the customer. Where local law requires health data to be stored or processed in a particular country, we work with the customer to meet that requirement.

Cross-Border Access

CrelioHealth operates globally, and our engineering, maintenance, and corporate support teams are based in India. US production databases that contain patient PHI remain in the United States. If our global engineering or support teams need to access a hosted environment for troubleshooting, maintenance, or critical support, that access is restricted, monitored, and logged, and is subject to administrative, technical, and physical safeguards. Where the law of your country limits or conditions the transfer of personal data abroad, we apply the safeguards that law requires, such as contractual protections, and obtain consent where it is required.

Security Safeguards

We keep information in secure databases protected by firewalls, and communications on our websites and APIs are encrypted in transit using industry-standard protocols (such as TLS 1.2/1.3) and encrypted at rest. We apply managerial, technical, operational, and physical security measures that are reasonable for the nature of the information and consistent with industry standards. Information may sometimes be converted to physical form where this is needed to provide the Services. No method of electronic storage or internet transmission is completely secure, and we cannot guarantee absolute security.

Account Security

To use the Services, you may need to create a user account protected by a user name and password. Passwords are cryptographically hashed and never stored or accessible in plain text by our employees or administrators. Please protect your account, password, computer, and mobile device against unauthorized access, and log off when you finish. You are responsible for activity under your account. If you suspect unauthorized use, notify us immediately using the contact details below. Liability for unauthorized use of an account is governed by our Terms and Conditions and the applicable service agreement.

Data Retention and Ownership

Retention. We keep information only for as long as needed to provide the Services, meet our contractual obligations, comply with legal and regulatory requirements, resolve disputes, and maintain business records. When Services end, information is returned, archived, or securely deleted in line with our customer agreements and applicable law.

Ownership. Customer data remains the property of the customer that provided or controls it. CrelioHealth does not claim ownership of customer data, patient records, laboratory results, or health data processed through our technology. Customers decide the retention, access, disclosure, and use rules for their data.

Your Privacy Rights

Depending on where you live and on our role in handling your information, you may have the right to:

  • know what personal information we hold about you and how we use it;
  • access your personal information and receive a copy of it, including in a portable format where the law provides for this;
  • correct, complete, or update inaccurate information;
  • request deletion of your information;
  • withdraw your consent, or object to or restrict certain processing;
  • opt out of marketing communications; and
  • complain to a data protection authority in your country.

To exercise these rights, contact us using the details in the "Contact Us" section. We may need to verify your identity before acting on a request. We will respond within 30 days, or sooner where applicable law requires. If your information is held by us as a processor on behalf of a customer, we will direct your request to that customer or help them respond. These rights may be limited where the law allows or requires us to keep information, for example where it is exempt because it is regulated under health privacy laws.

Regional Notices

United States

HIPAA

CrelioHealth processes Protected Health Information on behalf of covered entities and other organizations subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). When acting as a Business Associate, we process PHI only to provide the contracted Services and in line with the applicable BAA.

State privacy laws

Residents of certain states, including California, Virginia, Colorado, Connecticut, Utah, and others, have rights under state privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA and CPRA). These may include the right to know, access, correct, and delete personal information and to obtain a portable copy. Most of the information we process is PHI managed for our healthcare customers. PHI is exempt from these state consumer privacy laws because federal HIPAA rules already regulate it. Clinical trial data and some business-to-business operational information may be similarly excluded.

No sale or targeted advertising

CrelioHealth does not sell or rent personal information. It also does not "share" personal information with third parties for cross-context behavioral or targeted advertising under the CCPA and CPRA.

Global Privacy Control

Our public-facing corporate websites recognize and honor opt-out preference signals such as the Global Privacy Control (GPC) for users in applicable jurisdictions.

Consumer health data laws

Some US states, such as Washington under its My Health My Data Act, regulate consumer health data collected outside HIPAA, for example, health information entered into an unauthenticated web form. CrelioHealth does not actively collect consumer health data outside its secure, HIPAA-compliant LIMS, LIS, and authenticated patient portal workflows. If any non-HIPAA consumer health data does fall within our scope, we obtain the separate, explicit consent these laws require before collecting, using, or sharing it.

India

For people in India, we process personal data in line with the Digital Personal Data Protection Act, 2023 and the rules made under it, as they come into force, and with the Information Technology Act, 2000 and the rules made under it, including the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011, to the extent they apply.

  • Our customers are generally the data controllers for patient data (called data fiduciaries under the DPDP Act), and we act as a data processor. For our own account and marketing data, we act as the data controller.
  • We process personal data on the basis of your consent or another lawful ground permitted by law. Consent is specific and can be withdrawn at any time.
  • You may request a summary of the personal data we process, correction, completion and updating of your data, and its erasure. You may also nominate another person to exercise your rights in the event of your death or incapacity.
  • We obtain verifiable parental or guardian consent before processing the personal data of a child, meaning a person under 18, except where the law permits otherwise.
  • If we are unable to resolve your concern through our Data Protection Officer (DPO) / Grievance Officer, you may complain to the Data Protection Board of India once it is constituted and the relevant provisions are in force.

Kingdom of Saudi Arabia

For people in the Kingdom of Saudi Arabia, we process personal data in line with the Personal Data Protection Law (PDPL), its Implementing Regulations, and the regulations on transferring personal data outside the Kingdom, issued under the supervision of the Saudi Data and Artificial Intelligence Authority (SDAIA).

  • Health and genetic data are treated as sensitive personal data and are protected with additional safeguards.
  • You have the right to be informed about the processing of your data, to access it and obtain a copy, to request correction, to request its destruction where permitted, and to withdraw your consent.
  • We transfer personal data outside the Kingdom only where the PDPL and its regulations allow, and with the safeguards they require.
  • You may lodge a complaint with SDAIA.

United Arab Emirates and Other Middle East Countries

For people in the United Arab Emirates (UAE), we process personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Health data is also subject to Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields and its implementing rules, which restrict storing and transferring health data outside the UAE except in the cases the law permits. Where the Dubai International Financial Centre or the Abu Dhabi Global Market data protection laws apply, we comply with them as well.

In other Middle Eastern countries where we operate, we comply with the applicable national data protection laws, including those of Qatar (Law No. 13 of 2016), Bahrain (Law No. 30 of 2018), and Oman (Royal Decree No. 6 of 2022).

  • You may ask us to confirm whether we process your data, to access it, to correct it, to delete it, and to restrict or object to processing, as the law of your country provides.
  • We transfer data outside your country only as local law allows, with the safeguards it requires and, where necessary, with your consent or the approval of the competent authority.
  • You may complain to the data protection authority in your country.

South East Asia

For people in South East Asia, we process personal data in line with the data protection laws that apply in the country where you are located, including:

  • Singapore: Personal Data Protection Act 2012;
  • Malaysia: Personal Data Protection Act 2010;
  • Indonesia: Law No. 27 of 2022 on Personal Data Protection;
  • the Philippines: Data Privacy Act of 2012;
  • Thailand: Personal Data Protection Act B.E. 2562 (2019); and
  • Vietnam: the personal data protection laws and regulations in force.

Depending on the country, you may have the right to access and correct your personal data, to withdraw your consent, to request deletion, to object to or restrict processing, and to receive a copy of your data in a portable format. We transfer personal data across borders only as local law permits and with appropriate safeguards. You may complain to the data protection authority in your country.

Children's Privacy

Our public websites, marketing activities, and direct sales outreach are not directed to children, and we do not knowingly collect personal information directly from children. In the United States, this means children under 13 (COPPA). In other countries, we apply the age of majority or digital consent age set by local law, which is 18 in India.

As a technology service provider, we may process information about minors through the Services. This information is entered and transmitted by authorized healthcare provider customers, or by a verified parent or legal guardian who uses a secure patient portal, for healthcare and laboratory service delivery. If you believe a child has given us personal information directly, please contact us and we will take steps to delete it.

Incident Response and Breach Notification

CrelioHealth maintains policies and procedures designed to detect, investigate, respond to, and reduce the impact of security incidents. If a reportable breach affects personal information or health data, we will give notice in line with our contractual commitments and applicable laws, including HIPAA and US state laws, the laws of India (including reporting to CERT-In and notifying affected Data Fiduciaries/Data Protection Board in accordance with statutory timelines), and the data protection laws of the Middle East and Southeast Asia.

Third-Party Websites and Services

Our websites and applications may contain links to, or advertising from, the sites and services of partners, suppliers, sponsors, and other third parties. These sites operate independently, and their content and links may change. They may have their own privacy and customer service policies. We do not control them and are not responsible for their privacy practices or security. Your use of any other website is subject to that website's own terms and policies. CrelioHealth is also not responsible for the handling of personal information by partners and third parties outside the scope of our agreement with them, or for events beyond our reasonable control, such as acts of government, hacking, or failures of internet or telephone services.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page with a new "Last updated" date. If a change is material, we will also give notice, for example through a banner on our website or by email, and we will ask for your consent again where the law requires it. Please review this page regularly. Your continued use of the Services after changes are posted means you accept the updated Privacy Policy, except where the law requires your fresh consent.

Acceptance, Governing Terms, and Dispute Resolution

By accessing or using the Services, you signify your acceptance of this Privacy Policy. If you do not agree with it, please stop using the Services. This Privacy Policy forms part of, and should be read together with, our Terms and Conditions, the SaaS Services terms, and any license or business-to-business service agreement you enter into with us.

Disputes relating to our privacy practices are subject to the governing law, venue, arbitration, and other dispute resolution terms of the applicable agreement. If this Privacy Policy conflicts with a separate customer service agreement, the service agreement prevails. Nothing in this Privacy Policy limits any rights you have under mandatory local law, including your right to complain to a regulator.

Privacy Inquiries and Complaints

If you have a complaint about our privacy practices or applicable privacy laws, want to access your information, or want to correct errors in it, please contact us at info@creliohealth.com. If you are in India, you may also contact our Data Protection Officer (DPO) / Grievance Officer:

Mr. Mukund Malani
Data Protection Officer (DPO) / Grievance Officer
Creliant Software Private Limited
Email: info@creliohealth.com

We will address all requests within 30 days from the date of the request, or sooner where applicable law requires.

Contact Us

If you have questions about this Privacy Policy, our compliance practices, or how we handle data, please contact us through the appropriate channel below.

Corporate and general privacy inquiries (global)

Email: info@creliohealth.com

United States

CrelioHealth Inc.
8865 Stanford Blvd, 2nd Floor, Suite 202
Columbia, MD 21045, United States

India

Creliant Software Private Limited
8th Floor, Baner Biz Bay, Laxman Nagar, Baner,
Pune, Maharashtra 411 045, India

HIPAA, Business Associate Agreements, and security controls

For questions about HIPAA compliance, security documentation, system audits, or Business Associate Agreements, email info@creliohealth.com with "HIPAA" in the subject line. Additional compliance disclosures are available through our Trust Center on request.