Privacy policy
What we collect, why, where it is kept, who else handles it, and the rights you have over it.
Last updated 4 October 2026
Sixo is operated by Kiran Markad, an individual based in Maharashtra, India (“Sixo”, “we”, “us”). Contact: kiranmarkad3@gmail.com, +91 77589 80883, Maharashtra, India.
This policy covers the Sixo Clinic app, its web console at clinic.sixo.si, and this website. It is written to meet India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.
1. Who is responsible for what
Your clinic's records. Patient details, prescriptions, vitals, payments and admissions are entered by a clinic and belong to that clinic. For this data the clinic decides what is collected and why — it is the data fiduciary — and Sixo processes it only on the clinic's behalf and on its instructions, to provide the service. Clinics are responsible for having a lawful basis, such as consent, for the patient information they record.
Account and billing data. For the details of the people who use Sixo — names, mobile numbers, emails, sign-ins and payments — Sixo is the data fiduciary.
2. What we collect
| Category | What |
|---|---|
| Clinic and staff accounts | Clinic name and prescription prefix; each user's name, mobile number, email, role, qualification and registration number where given; a one-way hash of the password (we never store passwords themselves). |
| Clinical records (entered by the clinic) | Patients' names, age, gender, mobile numbers, allergies and known conditions; vitals; complaints, diagnoses and prescriptions; certificates; charges, payments and balances; ward admissions and bills. |
| Devices and sign-ins | A label for each device, when it signed in and was last seen, and session records so a device can be signed out. |
| Payments | The plan bought, the amount, and Razorpay's order and payment references. Card, UPI and bank details are entered on Razorpay's own screen and never reach Sixo. |
| Support | Requests our support team makes to view a clinic's account, the reason given, who approved or refused them, and when. |
| Messages to us | What you send through our contact form or by email. |
| Technical | Request logs kept by our hosting provider, and the network address of callers in hashed form to limit abuse such as password guessing. |
3. How we use it
- To provide the service: keeping the clinic's records on its devices, syncing them between the clinic's phones, and printing documents.
- To sign people in and keep accounts secure: one-time codes by email, locking an account after repeated wrong passwords, signing devices out.
- To bill: taking payments through Razorpay, and emailing the clinic owner before a plan or trial ends.
- To support clinics — and only with the clinic's approval where its account is concerned.
- To meet legal obligations, such as keeping payment records.
We do not sell personal data, use clinical records for advertising, or share them with anyone other than the processors listed below. We do not use clinics' patient records to train any model.
4. Where it is stored
On each phone, the clinic's records are kept in an encrypted database whose key is held by the phone's secure hardware.
To sync between phones and to keep a copy if a phone is lost, the records are also stored on our servers, which are in Singapore (our database provider's and hosting provider's Singapore regions). By using Sixo you agree to this transfer outside India; we rely on these providers' contractual and security commitments to protect it.
5. Who else processes it
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the Sixo servers, website and console | Singapore (servers); global network for the website |
| Neon Inc. | The database that stores synced records, encrypted at rest | Singapore |
| Razorpay Software Pvt. Ltd. | Taking payments | India |
| Google LLC | Delivering our emails (sign-in codes, reminders, consent requests) | Global |
We may disclose information where Indian law requires it, for example to comply with a court order.
6. How long we keep it
- Clinical records are kept for as long as the clinic's account exists. Medical rules may require a clinic to keep records for several years; the clinic should keep its own copies before asking us to delete an account.
- When a clinic asks us to close its account, we provide a copy of its records on request, then delete the account and its records from our servers within 30 days. Records on the clinic's own phones are under its control.
- Payment records are kept for as long as tax law requires, currently up to eight years.
- Contact messages are kept for up to two years.
7. Your rights
You may ask us to tell you what personal data we hold about you, to correct or complete it, or to erase it, and you may nominate someone to exercise these rights for you. Patients whose records are kept by a clinic should contact that clinic first; we will help the clinic respond. Write to kiranmarkad3@gmail.com. We may need to confirm your identity before acting.
8. Security
Records are encrypted on phones and in transit; each clinic's records are kept apart from every other clinic's by the database itself; passwords are stored only as one-way hashes; our support team cannot open a clinic's account without that clinic's approval, and never sees patient names or diagnoses when it does. More on our security page. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the Data Protection Board of India as the law requires.
9. This website
sixo.si uses no advertising or tracking cookies and no analytics. Fonts are loaded from Google Fonts, which receives your network address to deliver them. The clinic console uses a cookie only to keep you signed in.
10. Children
Sixo is for clinics and their staff, who must be adults. Records of patients who are children are entered by clinics, which are responsible for the appropriate consent.
11. Changes
If we change this policy in a way that matters, we will update the date above and tell clinic owners by email before the change takes effect.
12. Grievances and contact
Our grievance officer is Kiran Markad, kiranmarkad3@gmail.com, Maharashtra, India. We acknowledge grievances within 48 hours and aim to resolve them within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.