Skip to main content

Request a Demo

See GxP Flow in action

By submitting, you agree to our Privacy Policy
Back to Home

Privacy Policy

Last updated: December 19, 2024

1. Introduction

Sridevi Health Innovations Pvt. Ltd. ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our document management services and visit our website.

This policy applies to personal data processed under the General Data Protection Regulation (GDPR), India's Digital Personal Data Protection Act (DPDP Act 2023), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.

2. Data Controller

The data controller responsible for your personal data is:

Sridevi Health Innovations Pvt. Ltd.
Registration Number: PENDING
Address: Meraki Latitude, 211/212, Old Padra Rd, Vadodara, Gujarat - 390007
Country: INDIA

3. Information We Collect

Personal Information

We collect information that you provide directly to us, including:

  • Name and contact information (email address, phone number)
  • Company name and job title
  • Account credentials
  • Billing and payment information
  • Communication preferences

Usage Data

We automatically collect certain information when you access or use our services:

  • Log data (IP address, browser type, device information)
  • Usage patterns and activity within our platform
  • Date and time stamps of access
  • Pages viewed and features used

4. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

  • Contract Performance: Processing necessary to provide our services under our agreement with you
  • Legitimate Interests: To improve our services, ensure security, and communicate with you about our products
  • Legal Obligations: To comply with applicable laws, including audit trail requirements under FDA 21 CFR Part 11
  • Consent: Where you have given explicit consent (e.g., marketing communications)

5. How We Use Your Information

  • Service Delivery: To provide, maintain, and improve our document management services
  • Account Management: To manage your account and provide customer support
  • Communications: To send technical notices, updates, security alerts, and administrative messages
  • Compliance: To maintain required audit trails and support regulatory compliance
  • Analytics: To analyze usage patterns and improve our platform
  • Legal Obligations: To comply with applicable laws and regulations

6. Data Retention

We retain personal data for the following periods:

  • Account Data: Duration of the service agreement plus 3 years for legal purposes
  • Audit Trail Data: Minimum 7 years or as required by applicable regulations (e.g., 21 CFR Part 11)
  • Marketing Data: Until consent is withdrawn
  • Usage Analytics: 24 months in aggregated/anonymized form

When data is no longer needed, it is securely deleted or anonymized in accordance with our data retention policy.

7. International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Adequate data protection agreements with all service providers
  • Compliance with applicable adequacy decisions

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

  • Encryption of data in transit (TLS 1.3) and at rest (AES-256)
  • Access controls and multi-factor authentication
  • Regular security assessments and penetration testing
  • Employee training on data protection
  • Incident response and breach notification procedures

9. Your Rights

Depending on your location, you have the following rights regarding your personal information:

  • Access: Request access to your personal information
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your personal information (subject to regulatory retention requirements)
  • Portability: Request a copy of your data in a machine-readable format
  • Objection: Object to processing of your personal information
  • Restriction: Request restriction of processing
  • Withdrawal: Withdraw consent for consent-based processing

To exercise these rights, contact us at contact@gxpflow.com. We will respond within 30 days (or as required by applicable law).

10. Children's Data

Our services are designed for business use and are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately at contact@gxpflow.com.

11. Data Protection Officer

We have appointed a Data Protection Officer (DPO) who can be contacted for any privacy-related inquiries:

Data Protection Officer: Data Protection Team
Email: contact@gxpflow.com
Phone: +91 9876543210

12. Supervisory Authority

If you are located in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority if you believe we have violated applicable data protection laws.

A list of supervisory authorities is available at: European Data Protection Board

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last updated" date and, where appropriate, providing additional notice.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: contact@gxpflow.com
Phone: +91 9876543210
Address: Meraki Latitude, 211/212, Old Padra Rd, Vadodara, Gujarat - 390007