Legal
Sub-processors
Last updated 20 October 2026
These are the companies that process personal data on our behalf to run Curanto and curanto.in. Each is bound by contract to use the data only to provide its service to us. We list a region only where our own configuration fixes it. When someone uses an AI feature, processing may happen outside India; the Curanto AI page lists exactly what each feature sends, and a hospital administrator can switch AI off for the organisation.
Hosting and storage
Contabo
Server hosting for the Curanto application and its database.
- Data
- All product data the hospital or clinic enters: patient, clinical, billing and staff records.
- Region
- Mumbai, India
Cloudflare (R2)
Object storage for uploaded files and encrypted database backups.
- Data
- Files such as patient photos, scanned documents and generated reports, and encrypted copies of the database.
- Region
- Asia-Pacific (may be outside India)
Vercel
Hosting for this website, curanto.in, and its optional cookieless visit counts.
- Data
- Website requests (IP address, browser, pages viewed) and what you type into a form on this site, on its way to us.
- Region
- Server functions in Mumbai, India
AI and speech
OpenRouter
Routes each AI request to the model provider that runs it. Used only when someone uses an AI feature, plus the morning business brief.
- Data
- The text an AI feature needs: scribe transcripts with names, phone numbers, Aadhaar numbers, dates of birth and email addresses removed, prescriptions with no name, UHID or contact details, questions to the Medi assistant with the records it reads to answer them, which can include patient details, and totals only for the business brief.
OpenAI (through OpenRouter)
Language models that write the scribe's final note, review prescriptions and read a doctor's written or dictated ward orders.
- Data
- The same AI request text, as forwarded by OpenRouter.
Google (through OpenRouter)
Gemini models for the scribe's live suggestions, consent form translation and the business brief.
- Data
- The same AI request text, as forwarded by OpenRouter.
Groq (through OpenRouter)
Runs the open model behind the Medi assistant, including discharge summary drafts.
- Data
- Questions to Medi and the records Medi reads to answer them, which can include patient details.
Sarvam AI
Speech recognition for the AI scribe, built for Indian languages.
- Data
- Short clips of consultation audio, transcribed and not stored by Curanto.
Deepgram
Live speech-to-text for voice dictation, streamed straight from the browser with a short-lived token.
- Data
- Dictation audio while the microphone is on.
Messages, sign-in and payments
ZeptoMail (Zoho)
Transactional email: reminders, reports, notifications and replies to enquiries.
- Data
- Recipient names and email addresses, and the message itself, which can include appointment, report or billing details a hospital sends to its patients.
- Region
- India (api.zeptomail.in)
MSG91
Delivers the one-time code for signing in with a phone number.
- Data
- The phone number and the one-time code. No other message is sent by SMS or WhatsApp.
Razorpay
Collects Curanto subscription payments by UPI, card or netbanking.
- Data
- The organisation's name, contact phone and email, and the amount. Card, UPI and bank details are entered on Razorpay's checkout and never reach Curanto.
Expo
Delivers push notifications to the Curanto staff app through Apple and Google.
- Data
- The device's push token and a notification that carries only a category and a count, never patient details.
Cloudflare (Turnstile)
Bot checks on public forms: this site's forms and a hospital's public booking and feedback pages.
- Data
- IP address and browser signals needed to tell a person from a bot.
Monitoring
Sentry
Error reports, so we can find and fix crashes.
- Data
- Technical details of the error (stack trace, app version, browser or device). Patient data is scrubbed before sending; no cookies, IP address or session replay.
- Region
- United States
PostHog
Product analytics: which features are used, so we know what to improve.
- Data
- Named product events with an organisation identifier. No page addresses, no on-screen text, no session recording and no patient data.
- Region
- United States
Changes to this list
We update this page before a new sub-processor starts receiving personal data, and notify subscribing organisations of material changes in advance. Questions go to hello@curanto.in; privacy concerns can also go to our Grievance Officer.