Legal
Privacy Policy
Last updated: August 2026
1. Overview
Alinto ("we", "us", or "our") is a healthcare technology company headquartered in Nagpur, India, serving clinics, practices, and health systems worldwide. We build HIPAA-aligned clinical software — including scheduling, EHR integration, telehealth, and analytics — for providers across multiple regions.
This Privacy Policy explains what information we collect through our website and services, how we use and store it, the third parties we work with, and the choices and rights you have. By using our website or engaging our services, you consent to the practices described here.
This policy applies to visitors of our website and to client organisations that engage our services. Where we process data on behalf of a client, the specific terms are governed by the applicable service agreement and Business Associate Agreement (BAA).
2. Protected Health Information
Alinto operates under Business Associate Agreements (BAAs) with covered entities. Protected Health Information (PHI) processed through our platform is handled in accordance with HIPAA requirements and the terms of each BAA.
PHI is encrypted in transit and at rest, access is restricted to authorised personnel on a least-privilege basis, and all access is logged and auditable. We do not use PHI for marketing purposes, and we do not sell PHI under any circumstances.
We support patients' rights under HIPAA, including access, amendment, and an accounting of disclosures, in coordination with the covered entity that owns the data. Questions about our handling of PHI should be directed to info@alinto.tech.
3. Information We Collect
Website visitors: When you submit a contact form, request a discovery call, subscribe to updates, or email us, we collect your name, email address, phone number, organisation, and any message content you provide.
Service data: Through our platform, we process operational data on behalf of our clients — including appointment schedules, provider availability, telehealth session metadata, and analytics. This data is governed by the applicable BAA and client agreement.
Technical data: We automatically collect basic technical information such as IP address, browser type, device identifiers, and pages visited, using cookies and similar technologies described below.
4. How We Use Information
We use contact-form submissions to respond to enquiries, schedule discovery calls, send proposals, and share relevant information about our services.
We use service data to operate, maintain, secure, and improve the platform on behalf of our clients, and to deliver the analytics and reporting they have contracted us to provide.
We use technical data to monitor site and service performance, detect and prevent fraud or abuse, troubleshoot issues, and improve user experience.
7. Third-Party Services
We rely on trusted third-party providers to deliver our services, including cloud hosting infrastructure, analytics platforms, email and transactional messaging providers, and customer support tools. Each provider is engaged under contracts that require appropriate security and confidentiality protections.
A current list of key sub-processors is available on request. We notify affected clients in advance of any material change to our sub-processors.
8. Data Storage and Location
Service data is stored on SOC 2 Type II audited cloud infrastructure with encryption in transit (TLS) and at rest. Production data is hosted in geographically separated regions to support availability and disaster recovery.
Backups are encrypted and access-controlled, and are retained and rotated according to our documented backup policy. We do not transfer PHI outside the agreed infrastructure boundaries without the client's authorisation and an appropriate legal basis.
9. Data Security
We maintain SOC 2 Type II audited infrastructure, encrypt data in transit and at rest, enforce least-privilege access controls with multi-factor authentication, and conduct regular security reviews and penetration testing.
Our security program includes employee training, incident response procedures, and vendor risk management. In the event of a security incident affecting personal data or PHI, we follow our breach response plan and notify affected parties and regulators as required by law and the applicable BAA.
Despite these measures, no system can be guaranteed completely secure. We continuously work to strengthen our posture against evolving threats.
10. Data Retention
Contact-form submissions and enquiry records are retained for as long as needed to respond to your enquiry and for reasonable record-keeping thereafter, typically up to three years unless you request earlier deletion.
Service data is retained in accordance with each client agreement, the applicable BAA, and legal requirements. Upon termination, client data is returned or securely deleted within the timeframe set out in the agreement, subject to any legal retention obligations.
11. Regulatory Compliance
Alinto designs its services to support compliance with HIPAA for covered entities and business associates in the United States, and with applicable data protection laws in the jurisdictions where our clients operate.
This includes the Digital Personal Data Protection (DPDP) Act, 2023 of India, the General Data Protection Regulation (GDPR) for clients in the European Economic Area and the United Kingdom, and other regional privacy laws as applicable.
We provide the organisational and technical measures — including BAAs, Data Processing Agreements, and Standard Contractual Clauses where required — to help our clients meet their own compliance obligations. Specific compliance terms are documented in the applicable signed agreement.
12. Your Rights
Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at info@alinto.tech. We will verify your identity before acting on a request and respond within the timeframe required by applicable law, generally within thirty (30) days.
If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.
13. Children's Privacy
Our website and services are directed at healthcare organisations and professionals, not at children. We do not knowingly collect personal information from children under the age of 18 through our website.
Where our platform processes data relating to minors on behalf of a client, that processing is governed by the client's own policies, the applicable BAA, and relevant law, including any parental consent requirements.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Material changes will be posted on this page with an updated effective date.
For significant changes affecting how we process client data, we will also notify affected clients directly where practicable. Continued use of our website or services after a change constitutes acceptance of the revised policy.
15. Contact Us
For privacy questions, data requests, or to exercise your rights, email info@alinto.tech or write to: 1st Floor, Plot No. 06, Katol Road, Falke Layout, Kolbaswami Nagar, Akar Nagar, Nagpur, Maharashtra 440013.