Security and privacy
Your patients trust you. We take that seriously.
This page describes what we have actually built. It is not a certification, and we say clearly below what we do not yet have.
What we have built
Each hospital's data kept apart
Every record belongs to one hospital, and the database itself refuses to show one hospital's data to another, in addition to the checks in our application.
Setu26 staff cannot browse your patients
Our own team works in a separate console that cannot read call recordings, transcripts or patient records. If you ask us for help with a specific call, access is requested, approved, limited in time and recorded, and you can see it.
Accounts and roles
Staff sign in with their own accounts. Passwords are stored using modern one-way hashing, repeated failed sign-ins lock the account, and two-step verification is available for hospital staff and required for our team. Roles limit what each person can see and change.
A record of who did what
Sign-ins, changes to appointments and settings, and access to recordings are written to an audit log that cannot be edited.
Recordings and retention
Call recordings are stored privately and opened through short-lived links. Your hospital decides whether calls are recorded and how long recordings and transcripts are kept; older ones are deleted automatically.
Encryption
Connections to Setu26 are encrypted. Stored data is encrypted by our cloud provider, and integration credentials such as calendar access are additionally encrypted by us.
Minimal information on calls
The receptionist asks only for what a booking needs: name, phone number and a short reason for the visit. It does not ask for diagnoses or medical history.
Doctors' calendars
When a doctor connects Google Calendar or Outlook, Setu26 reads only when they are busy, never what their events are about, and the doctor can disconnect at any time.
Where your data is kept
Setu26's database and stored files, including call recordings, are kept in Google Cloud's Mumbai region in India.
To answer and understand calls, Setu26 uses specialist providers for telephony, speech and AI. Some of them process call audio or text outside India while a call is handled or summarised. We list these providers for every hospital before a pilot starts, and we are evaluating India-hosted alternatives.
Who is responsible for what
Under India's Digital Personal Data Protection Act, your hospital decides why and how patient information is used, and Setu26 processes it on your behalf. We agree this in writing before a pilot.
What we do not claim
- We do not hold ISO 27001, SOC 2 or HIPAA certification.
- We do not claim that using Setu26 makes a hospital compliant with any law; our contract and data processing terms are being reviewed by legal professionals.
- Setu26 is not a medical device and does not give medical advice.
Questions from your IT or legal team are welcome. We will answer them in writing.
Have security questions?
We are happy to walk your team through how Setu26 handles data before you decide anything.