Privacy Policy

1. Who we are and our role

ConsultifyIT Technology Services Private Limited is the data controller (or “data fiduciary” under India's Digital Personal Data Protection Act 2023, and “business” under U.S. state privacy laws) for personal information collected through www.consultifyit.com, our marketing, recruitment and business operations.

When we deliver services to clients, such as hosting an ERP system, building software, managing IT or performing medical coding and billing, we usually process personal information on the client's behalf and under its instructions. In that role we are a processor, service provider or business associate, and the client's privacy notice governs that data (see section 7).

2. Scope of this policy

This policy applies to visitors to our website, people who contact us or use our assistant, prospective and current client and partner contacts, event attendees, job applicants and users of our portals. Separate notices apply to our employees, and to data covered by a client contract, Data Processing Addendum or Business Associate Agreement.

3. Information we collect

Information you give us

• Contact and identity details, such as name, business email, phone number, company, job title and country.
• Enquiry and project details you share through forms, email, calls, chat, scheduling tools or meetings.
• Account information for portals, such as user name, role and authentication settings.
• Billing information, such as billing contact, address, tax registration number and payment records. Card payments are handled by our payment processors; we do not store full card numbers.
• Recruitment information, such as CV, work history, qualifications, certifications, references and interview notes.
• Partner information from referral and strategic partners, such as firm details and the contacts they introduce with permission.

Information collected automatically

• Device and usage data, such as IP address, browser, operating system, pages viewed, time on page, referring page and error logs.
• Campaign attribution, such as UTM parameters and the landing page, stored in your browser session and sent with a form you choose to submit.
• Cookies and local storage, described in section 13.

Information from other sources

• Publicly available business information, such as company websites, professional networking profiles and business directories, used for business-to-business outreach.
• Information from referral partners, event organizers and colleagues who introduce you.
• Security and fraud-prevention signals from our hosting and network providers.

We do not intentionally collect sensitive personal information through the website. Please do not submit health, financial account, government ID or payment card information through our forms or assistant.

4. How we use information

• To respond to enquiries, schedule meetings, prepare proposals and enter into contracts.
• To deliver, support and improve our services, and to administer accounts, billing and collections.
• To operate, secure and improve our website and portals, including detecting abuse, fraud and security incidents.
• To send service communications, and marketing communications in line with your preferences.
• To evaluate candidates and manage recruitment.
• To manage partner relationships and referral programs.
• To comply with law, respond to lawful requests, enforce our terms, and establish or defend legal claims.
• To support corporate transactions, such as a merger, financing or acquisition, under confidentiality obligations.

5. Legal bases

Where the law requires a legal basis (for example under the GDPR or UK GDPR), we rely on:

• Contract: to take steps at your request before entering into a contract, and to perform it.
• Legitimate interests: to run and grow our business, respond to business enquiries, conduct proportionate B2B outreach, and secure our systems, balanced against your rights.
• Consent: for non-essential cookies and advertising where required, and marketing where opt-in is required. You may withdraw consent at any time.
• Legal obligation: for tax, accounting, employment and regulatory requirements.

Under India's DPDP Act, we process digital personal data on the basis of your consent or for legitimate uses permitted by the Act, such as where you voluntarily provide data for a specified purpose.

6. Health information and HIPAA

We provide medical coding, medical billing, revenue cycle and healthcare technology services to healthcare providers and their business associates. In those engagements we act as a business associate under HIPAA and handle Protected Health Information (PHI) only:

• under a signed Business Associate Agreement, and only as permitted or required by that agreement or by law;
• to the minimum extent necessary to perform the contracted services;
• within access-controlled, encrypted systems approved by the client, never through our public website or marketing tools;
• by trained personnel who have signed confidentiality agreements and work under our HIPAA privacy and security program.

We never sell PHI, use it for marketing or advertising, or use it to train AI models. We report security incidents and breaches of unsecured PHI to the covered entity as required by HIPAA, the HITECH Act and the applicable BAA. If you are a patient, your healthcare provider's Notice of Privacy Practices explains your rights, and requests about your health records should be made to your provider. We will assist our clients in responding.

More detail on our safeguards is available on our Security & Compliance page and in our Data Processing & BAA Terms.

7. Data we process for clients

Data we process on behalf of clients (for example, records in a client's ERP, customer data in a website we host, or patient account data in a billing engagement) belongs to that client. We process it only to provide the contracted services and as instructed by the client, under our Data Processing & BAA Terms. If your data is held by one of our clients and you want to exercise your rights, please contact that organization directly; if you contact us, we will forward your request to the client and support its response.

8. AI assistant and automated processing

Our website assistant uses a third-party large language model provider to generate responses. Messages you type are sent to that provider to produce a reply, are processed under contractual terms that restrict use of the data, and may be logged by us for quality and abuse prevention. Do not enter confidential, health or payment information in the assistant.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Where we use AI tools in delivering services, we do so under the client's instructions, with human review, and without using client data to train general-purpose models.

9. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as follows:

• Service providers and sub-processors who process data for us under contracts requiring confidentiality, security and use only on our instructions, in categories such as cloud hosting and content delivery (for example Cloudflare), business email and productivity (for example Zoho and Google Workspace), transactional email delivery, content management, scheduling, AI assistant providers, payment processors, accounting and advertising (only where enabled and consented).
• Affiliates within our corporate group, under this policy.
• Delivery and strategic partners, where needed to deliver a service you have requested and under confidentiality obligations, or with your consent.
• Professional advisors, such as auditors, lawyers, accountants and insurers.
• Authorities and others, where required by law, regulation, court order or lawful request, or where necessary to protect the rights, safety or property of ConsultifyIT, our clients or others.
• Corporate transactions, to a buyer, investor or successor in a merger, acquisition, financing or sale of assets, subject to confidentiality and to this policy.

A current list of sub-processors used for client engagements is available to clients on request and is referenced in our DPA.

10. International transfers

We are headquartered in Hyderabad, India, and serve clients in the United States, the United Kingdom, the European Union, the Middle East, Australia and elsewhere. Personal information may be processed in India, the United States, the European Economic Area, the United Kingdom and other countries where we or our providers operate.

When we transfer personal information from the EEA, the UK or Switzerland to a country without an adequacy decision, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful mechanisms, together with supplementary measures where needed. Client engagements may also specify data residency, such as keeping data in a U.S. or EU region; we honor those commitments. Transfers out of India comply with the DPDP Act and any restrictions notified under it.

11. Retention

We keep personal information only as long as needed for the purposes described, then delete or anonymize it:

• Enquiries and leads: up to 24 months after our last interaction, unless a business relationship begins.
• Client and contract records: for the duration of the relationship and up to 8 years afterwards to meet tax, accounting and limitation-period requirements.
• Job applications: up to 12 months after the hiring decision, or longer with your consent.
• Website and security logs: typically up to 12 months.
• Marketing suppression lists: indefinitely, so that we continue to honor your opt-out.
• Client data and PHI: as set out in the client contract, DPA or BAA, and returned or securely destroyed at the end of the engagement. HIPAA-required documentation is retained for at least six years.

12. Security

We protect personal information with administrative, technical and physical safeguards appropriate to its sensitivity, including role-based least-privilege access, multi-factor authentication, encryption in transit (TLS 1.2 or higher) and at rest, endpoint protection, logging and monitoring, secure software development, vendor due diligence, confidentiality agreements, workforce training and a documented incident response plan. No system is completely secure, but we work to continuously improve our controls. See our Security & Compliance page for details.

If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities where required by law, within the required timeframes.

13. Cookies and similar technologies

We use cookies, local storage and similar technologies in the following categories:

• Strictly necessary: security, load balancing, bot protection and portal sign-in. These cannot be switched off.
• Functional: remembering choices such as a dismissed pop-up, assistant state and session campaign attribution, stored in your browser.
• Analytics: aggregated, privacy-friendly measurement of how the site is used.
• Advertising: only where advertising is enabled. In the EEA, the UK and Switzerland we use a certified consent management platform, and advertising cookies are not set until you consent.

Embedded third-party tools, such as scheduling widgets, may set their own cookies when you interact with them. You can control cookies through our consent banner where shown and through your browser settings. We honor Global Privacy Control (GPC) signals as a valid opt-out of sale or sharing where required by law.

14. Marketing communications

We send business-to-business marketing communications in accordance with applicable law, including the U.S. CAN-SPAM Act, the UK Privacy and Electronic Communications Regulations, the EU ePrivacy rules and Canada's Anti-Spam Legislation. Where consent is required, we ask for it first. Every marketing email identifies us and includes an unsubscribe link, and you can opt out at any time by replying “unsubscribe” or emailing contact@consultifyit.com. Opting out does not stop service or transactional messages.

15. Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and receive a copy;
• correct inaccurate or incomplete information;
• delete your information;
• restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• receive your information in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• opt out of sale, sharing or targeted advertising (we do not sell or share);
• nominate another person to exercise your rights in the event of death or incapacity (India); and
• complain to a data protection authority.

To exercise a right, email contact@consultifyit.com with the subject “Privacy request”. We will verify your identity using information we already hold, and may accept requests from an authorized agent with proof of authority. We respond within the time required by law, normally within 30 days (45 days under U.S. state laws, extendable where permitted). We will not discriminate against you for exercising your rights. If we decline a request, we will explain why and how to appeal.

16. Regional information

European Economic Area, United Kingdom and Switzerland

The GDPR, UK GDPR or Swiss Federal Act on Data Protection may apply to you. You may lodge a complaint with your local supervisory authority, including the UK Information Commissioner's Office (ico.org.uk) or the Swiss FDPIC. Where required, we will appoint an EU or UK representative and publish their details here.

United States

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws may have the rights described in section 15. In the last 12 months we have collected the categories below, from the sources described in section 3, for the business purposes shown. We have not sold or shared personal information, and we do not knowingly sell or share the information of consumers under 16.

We disclose these categories to service providers and the other recipients in section 9 for business purposes only. We use sensitive personal information only for permitted purposes and not to infer characteristics. California residents may also request information about disclosures for direct marketing under California Civil Code §1798.83; we do not make such disclosures. Health information we process as a business associate is governed by HIPAA rather than state consumer privacy laws.

India

Under the Digital Personal Data Protection Act 2023 and the Information Technology Act 2000 and rules made under them, you may access a summary of your personal data and processing, correct, complete, update or erase it, withdraw consent, nominate another person and seek grievance redressal. Our Grievance Officer will acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied, you may approach the Data Protection Board of India.

Canada

We handle personal information in line with PIPEDA and applicable provincial laws. You may access and correct your information and complain to the Office of the Privacy Commissioner of Canada.

United Arab Emirates and Saudi Arabia

Where the UAE Federal Decree-Law No. 45 of 2021 or the Saudi Personal Data Protection Law applies, you have the rights those laws provide, including access, correction and erasure, and we apply the transfer safeguards they require.

Australia

We handle personal information in line with the Privacy Act 1988 and the Australian Privacy Principles. Before disclosing information to overseas recipients we take reasonable steps to ensure they comply with the APPs. You may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Africa

Where South Africa's POPIA, Kenya's Data Protection Act 2019, the Nigeria Data Protection Act 2023 or similar laws apply, you have the rights they provide. Our Information Officer can be contacted at contact@consultifyit.com.

17. Children

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16 (or under 18 in India). If you believe a child has provided us information, contact us and we will delete it.

18. Changes to this policy

We may update this policy to reflect changes in our practices or the law. We will post the updated policy with a new effective date and, for material changes, give additional notice such as a website banner or email where appropriate.

19. Contact and grievance officer

For privacy questions, requests or complaints, contact our Privacy and Grievance Officer:

Email: contact@consultifyit.com
HIPAA privacy and security matters: contact@consultifyit.com (subject “HIPAA privacy”)

See also our Terms of Service.