Privacy Policy
Notice version 2026-08-27 · Applies to Operax Health Pvt. Ltd. (Data Fiduciary)
This policy explains what personal data Operax collects from residents, faculty and hospitals, why we process it, how long we keep it, and the rights you can exercise as a Data Principal.
1. Who we are
Operax Health Pvt. Ltd. is the Data Fiduciary for personal data processed through the Operax platform. Where your hospital or programme licenses Operax for you, that institution may act as a joint fiduciary for your training records.
2. Data we collect
- Identity & profile: name, email, role/PGY level, specialty, institution, avatar.
- Training data: simulation attempts, instrument movements, timings, scores, complication handling, AI mentor conversations.
- Technical data: device, browser, IP-derived region, and security logs.
- Billing data: plan, invoices and payment status (card data is handled by our payment processor, never by us).
Operax is a simulation platform. Do not enter real patient identifiable information anywhere in the product.
4. Sharing and processors
We share data only with processors bound by contract: cloud hosting, email delivery, payment processing, analytics and AI inference providers. We do not sell personal data. Your programme director sees your training performance if your institution licenses Operax.
5. Security
Encryption in transit and at rest, role-based access, least-privilege internal access, audit logging, and breach notification to the Data Protection Board and affected users as required by law.
6. Your rights
- Access a summary of your data and processing.
- Correct, complete, update or erase your data.
- Withdraw consent for any optional purpose at any time.
- Nominate another person to exercise your rights in the event of death or incapacity.
- Raise a grievance and escalate to the Data Protection Board of India.
Manage all of this in the consent centre or via grievance redressal.
7. Children and students under 18
Accounts require verifiable parental consent for anyone under 18. We do not run behavioural tracking or targeted advertising towards children.
Purposes, data used and retention
| Purpose | Data used | Retention |
|---|---|---|
| Account & service delivery(required) | Name, email, role, specialty, institution, session security logs | For the life of your account + 90 days |
| Training records & assessment | Case attempts, scores, timings, complication handling, AI mentor transcripts | 7 years (medical education record norms) or until withdrawn |
| Product analytics | Page views, feature usage, device and browser type | 24 months |
| Personalised recommendations | Performance history, specialty, learning goals | Until withdrawn |
| Product updates & marketing | Name, email, engagement with our emails | Until withdrawn |
| De-identified education research | De-identified scores and interaction patterns | Until withdrawn |
Contact
Dr. Meera Raghavan, Data Protection Officer & Grievance Officer · privacy@operax.health · +91 22 4890 1122
Operax Health Pvt. Ltd., 4th Floor, Lodha Supremus, Worli, Mumbai 400018, India