Legal
Website Privacy Policy
1. Who We Are and What This Policy Covers
This Privacy Policy explains how Vanta (Private) Limited ("Vanta", "we", "us", "our"), a company incorporated in Pakistan, collects and uses personal data when you visit our marketing website at healthease.app (the "Site"), fill in a form on the Site, or otherwise contact us as a prospective or existing business contact.
For the data described in this Policy — visitor, lead, and business-contact data — Vanta is the data controller (or the equivalent role under the data-protection law that applies to you).
1.1 What this Policy does NOT cover
This Policy covers the Site only. It does not cover patient or clinical data processed inside the HealthEase product (our clinic and hospital management software). For that data:
- The healthcare provider using HealthEase (the clinic or hospital) is the data controller.
- Vanta acts as a data processor on that provider's documented instructions, under a Data Processing Agreement ("DPA").
- If you are a patient of a clinic or hospital that uses HealthEase, please direct privacy questions and rights requests to that provider in the first instance. Vanta will assist the provider in responding, as its processor.
The product-level privacy documentation (the HealthEase Product Privacy Policy) and the customer Data Processing Agreement are available at healthease.app/legal or on request from info@healthease.app.
The Site itself holds no patient data. No patient or clinical records are collected through, stored on, or displayed by the Site.
2. Personal Data We Collect on the Site
We deliberately collect very little. The categories are:
| Category | What it includes | How we get it |
|---|---|---|
| Contact, demo and quote requests | Name, organisation/facility name (and its registered business name, if you give it), role, email address, phone/WhatsApp number, city or country, and the message you write. For a quote request, also the size of your organisation (patients a day, branches, and visits, patients and reports a month), how many staff you have in each role, the modules and dashboards you want, any AI credits or coupon code you mention, and when you would like to start | You submit it via a contact, demo-booking, or quote-request form |
| Trial and promotional-offer enquiries | The details above, plus which promotion you responded to (for example, a flyer QR code) | You submit it when responding to an offer |
| Correspondence | Emails, calls, and messages you exchange with us, and our notes about them | You contact us at info@healthease.app or through other published channels |
| Usage analytics and page recordings | How you use the Site — pages viewed, clicks, taps, scrolling and mouse movement — captured by Microsoft Clarity as heatmaps and recordings. Clarity does not run at all until you accept analytics cookies in our cookie banner; once you do, it uses first-party cookies to connect the pages you view into one session and to recognise your browser when you return, using a pseudonymous ID. If you decline or make no choice, Clarity never loads and nothing is recorded. When it runs, anything you type into a form, and the contents of our forms, is masked and never sent to Clarity; Clarity uses your IP address to estimate your approximate location; and we tell Clarity that advertising storage is denied. No advertising pixels | Automatically as you browse, once you have accepted analytics cookies |
| Website access logs | Every request your browser makes to the Site is recorded by the network that serves it: the date and time, your IP address, the page requested, any campaign values in the address (for example utm_source), the referring website, your browser's user agent, and the country the request came from. We keep these logs for 30 days to keep the Site secure and to count visits; after 30 days only aggregate counts remain (see section 7). They include the small engagement request each page sends when you leave or hide it, which carries the page's path, how long the page was visible to you (capped at 30 minutes) and, only if you accepted Visitor ID, your Visitor ID |
Automatically when the Site is served to you, and when you leave or hide a page |
| Visit and engagement statistics | Counts of sessions, pages per session, single-page visits, session length and time on page, worked out from the website access logs without any cookie. Each day's requests from the same connection and browser are grouped using a value held only in memory and never stored, and a session ends after 30 minutes without a new page. The totals identify nobody | From the website access logs |
| Visitor ID | If you accept Visitor ID in our cookie banner, a random ID in a first-party cookie (he_vid) that holds nothing about you, sent with the engagement request so we can count how many visitors return. We never keep the ID as it is, only a salted one-way hash of it, and use it only to count returning visitors. If you do not accept it, it is never set |
From your browser, only after you accept Visitor ID |
| Campaign attribution | Which campaign link or website brought you to the Site — the campaign labels on the link, the page you landed on, the referring site, and the date you arrived. It holds nothing that identifies you or your click. If you send us an enquiry or create a HealthEase account, that record is stored with it, so we can tell which campaigns bring clinics to HealthEase | Automatically from the link you followed, and from a first-party note in your browser (he_attr) where storing it is allowed — see our Cookie Policy, which explains that in the EU, the EEA and the UK it is stored only if you accept cookies |
| Video playback (YouTube) | Only if you press play on a video from our YouTube channel: YouTube (Google) receives your IP address and your activity with the video, and may store data on your device. Until you press play the video is only a picture served by the Site, and nothing reaches YouTube. The Site itself sets nothing for it | From your browser, directly to YouTube, when you press play |
| Approximate city (product demo only) | The city your visit appears to come from, as estimated by the network that serves the Site from your connection. It is used only to show nearby example branch names in the product demo on the page you are viewing. It is not stored on your device or by us, and it is not linked to you | Automatically when a page with the product demo loads |
| Technical server logs | IP address, request URL, timestamp, browser type — standard logs from the systems behind the Site (for example, the service that receives a form you submit), used for security and troubleshooting | Automatically when you use those systems |
We do not collect special-category/sensitive data through the Site, and we ask you not to include health information about identifiable individuals in free-text form fields.
3. Why We Use Your Data and Our Legal Bases
| Purpose | Data used | Legal basis (GDPR-style; equivalents apply under other laws) |
|---|---|---|
| Responding to your enquiry, demo request, or quote request | Contact, demo and quote requests; correspondence | Steps at your request prior to entering a contract; legitimate interests (running our business) |
| Administering trials and promotional offers | Trial enquiries; correspondence | Steps prior to a contract; performance of a contract once one exists |
| Sending follow-up communications about HealthEase to business contacts who enquired | Contact details | Legitimate interests (business-to-business marketing to people who asked about our product), with an opt-out in every message; consent where the law that applies to you requires it |
| Keeping the Site secure and diagnosing problems | Website access logs; technical server logs | Legitimate interests (security and service integrity) |
| Counting visits to the Site — how many, to which pages, from which countries and campaigns | Website access logs, and the aggregate counts kept from them | Legitimate interests (knowing whether our own marketing works, without tracking individuals). No cookie is needed for this, so it does not depend on your cookie choice |
| Measuring how the Site is used without cookies: sessions, pages per session, single-page visits, session length and time on page | Website access logs, including the engagement request; visit and engagement statistics | Legitimate interests (knowing which pages help visitors, without tracking individuals). No cookie is needed, so it does not depend on your cookie choice |
| Counting how many visitors return to the Site | Visitor ID | Consent: the he_vid cookie is set only if you accept Visitor ID, and withdrawing your consent deletes it |
| Crediting an enquiry, trial or account to the campaign that brought you | Campaign attribution; contact, demo and quote requests | Legitimate interests (measuring our own marketing); consent where storing the campaign note on your device requires it (EU, EEA, UK — see the Cookie Policy) |
| Understanding how the Site is used, so we can improve it | Usage analytics and page recordings | Consent: Clarity does not run, and nothing is recorded, until you accept analytics cookies. Never used to build an advertising profile of you |
| Playing a video you asked to watch | Video playback (YouTube) | Your request: pressing play is you asking YouTube for the video, which it then handles under Google's privacy policy as its own controller. The Site sets nothing for it |
| Showing example branch names near you in the product demo | Approximate city (product demo only) | Legitimate interests (presenting a relevant demonstration). Used only while the page is open and never stored |
| Establishing, exercising, or defending legal claims; complying with law | Any of the above, as needed | Legal obligation; legitimate interests |
We do not sell personal data, and we do not use Site data for third-party advertising.
4. Cookies and Analytics
The Site sets analytics cookies only if you accept them in our cookie banner, and no advertising cookies. Microsoft Clarity does not load at all until you accept; if you decline, or make no choice, Clarity never runs. You can change your choice at any time with Cookie settings in the footer of the pages that load analytics. You can also stop Clarity recording your visits altogether by turning on Global Privacy Control in your browser, which Clarity honours, or through the Digital Advertising Alliance opt-out at optout.aboutads.info.
Our cookie banner offers three choices of equal weight, Accept all, Reject all and Choose, and Choose lets you decide category by category: Analytics (Clarity, analytics storage for Google tags and, in the EU, the EEA and the UK, the campaign note below) and Visitor ID (a first-party cookie, he_vid, holding only a random ID, used to count returning visitors and kept for at most 13 months). Both start switched off. Every page that runs the Site's own scripts also sends one small cookieless request when you leave or hide it, with the page's path and how long it was visible to you, so we can count sessions and time on page; it carries your Visitor ID only if you accepted it.
The Site also keeps one first-party campaign note (he_attr), which records the campaign or website that brought you and nothing that identifies you. If you are visiting from the EU, the EEA or the UK, it is stored on your device only if you accept cookies, and declining after an earlier acceptance removes it; an enquiry you send from the page the campaign link opened carries that link's labels either way. Our campaign landing pages load no analytics at all and so show no banner, which means nothing is stored on them for those visitors. Some pages show a video from our YouTube channel. Nothing is loaded from YouTube until you press play; when you do, the player loads from www.youtube-nocookie.com, and YouTube (Google) may store data on your device and receives your IP address and your activity with the video under Google's privacy policy. Pressing play is your own request, so it is not part of the cookie banner, and the Site itself sets nothing for it.
See the separate Cookie Policy at healthease.app/legal for that note, the cookies Clarity sets, the Visitor ID, the engagement request, and the short list of strictly-necessary items the Site uses.
5. Who We Share Data With (Sub-processors and Service Providers)
We share Site data only with service providers who process it on our behalf under contract, and only as needed:
- Hosting. The Site and our lead-handling systems are hosted with a reputable cloud hosting provider operating in the Asia-Pacific (Singapore) region under appropriate data-protection safeguards.
- Email/SMS delivery providers — to send you replies, confirmations, and (where permitted) follow-ups.
- Microsoft (Clarity) — usage analytics and page recordings, as described above. Clarity data is stored in the Microsoft Azure cloud and handled under the Microsoft Privacy Statement; Microsoft does not sell it.
- Google (Tag Manager) — loads and manages the scripts on the Site. It sets no cookies itself; Google tags loaded through it may use analytics storage only after you accept analytics cookies, and never advertising storage. Google receives standard technical information, such as your IP address, when your browser loads it.
- Google (YouTube): plays a video from our YouTube channel, only after you press play. YouTube is not our processor: it receives your IP address and your activity with the video, and may store data on your device, under Google's own privacy policy.
- Error-monitoring tooling — privacy-safe, used only to diagnose faults on the Site.
- Professional advisers (lawyers, accountants, auditors) where necessary, and authorities where the law requires disclosure (we validate the legal instrument, disclose the minimum required, and log the disclosure).
A current list of our sub-processors is available at healthease.app/legal or on request from info@healthease.app.
We never share your data with third parties for their own marketing.
6. International Transfers
Vanta is a Pakistani company, and our primary hosting region is Asia-Pacific (Singapore). If you contact us from another country, your data will be transferred to and processed in Singapore and accessed by our team in Pakistan. Usage analytics collected by Microsoft Clarity are stored in the Microsoft Azure cloud, and requests to Google Tag Manager are served by Google, as is a video you choose to play from YouTube; all of these may be processed outside Singapore. Where the law that applies to you (for example, the GDPR, UK GDPR, or Singapore PDPA) restricts international transfers, we rely on appropriate safeguards, including contractual data-protection commitments with our providers.
For the HealthEase product, hosting and international-transfer arrangements are governed by the HealthEase Product Privacy Policy and the Data Processing Agreement.
7. How Long We Keep Data
| Data | Retention |
|---|---|
| Leads and business-contact records | 24 months after our last contact with you, then deleted or anonymised |
| Correspondence tied to a contract or dispute | For the life of the matter plus applicable limitation periods |
| Website access logs (the raw request records, including IP addresses and the engagement requests) | 30 days, then deleted. Only aggregate counts are kept after that: totals by day, page, country, referring site and campaign, and session and time-on-page totals, which identify nobody |
Visitor ID cookie (he_vid, on your device) |
At most 13 months from when it was created, and deleted straight away if you withdraw Visitor ID |
| Hashed Visitor IDs (salted one-way hashes, one list per day) | 92 days, then deleted automatically. After that only the aggregate count of returning visitors remains |
| Campaign attribution | 90 days in your browser (see the Cookie Policy); once it is stored with a lead or an account, for as long as that record is kept |
| Approximate city (product demo only) | Not kept: used only while the page is open, then discarded |
| Video playback (YouTube) | Not kept by us. What YouTube keeps after you press play is set by Google's privacy policy |
| Technical server logs (the systems behind the Site) | Up to 13 months, then deleted or archived in de-identified form |
| Page recordings (Microsoft Clarity) | 30 days from recording; recordings we mark as favourites, and a random sample Microsoft keeps, up to 9 months |
| Aggregate statistics (page-view counts, heatmaps) | For as long as Microsoft Clarity makes them available; they do not identify individuals |
8. Your Rights
Depending on the law that applies to you (for example, the EU GDPR, UK GDPR, Singapore PDPA, or Pakistan's data-protection legislation as enacted), you may have the right to:
- Access the personal data we hold about you and receive a copy;
- Correct inaccurate or incomplete data;
- Delete your data (subject to lawful retention grounds);
- Object to or restrict processing, including objecting to direct marketing at any time (we honour marketing opt-outs, regardless of jurisdiction);
- Data portability — receive data you provided in a machine-readable format;
- Withdraw consent, where processing is based on consent, without affecting prior processing;
- Complain to a supervisory authority in your jurisdiction.
To exercise any right, email wecare@healthease.app. We will respond within any timescale required by applicable law, and in any event we aim to acknowledge within 72 hours and resolve within 30 days. We may ask you to verify your identity. We will not discriminate against you for exercising your rights.
If you are a patient seeking rights over clinical records held in HealthEase by your healthcare provider, please contact that provider — they are the controller of that data, as explained at the start of this Policy under what this Policy does not cover. We will assist them.
9. Security
We take reasonable technical and organisational measures appropriate to the data to protect Site and lead data, aligned with recognised industry practices. No method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security; however, we take the protection of your data seriously and review our controls regularly.
If a personal-data breach affecting you occurs, we will notify you and/or the relevant authorities where and when applicable law requires; our internal standard is to aim to notify affected parties as soon as reasonably practicable, and in any event to work towards notification within 72 hours of confirming a notifiable breach.
10. Children
The Site is directed at healthcare professionals and organisations. It is not intended for children, and we do not knowingly collect data from anyone under 18 through the Site. If you believe a child has provided us data, contact wecare@healthease.app and we will delete it.
11. Third-Party Links
The Site may link to third-party websites (for example, app stores). Those sites have their own privacy policies; we are not responsible for their practices.
12. The Site Is Provided "As Is"; Limitation of Liability
The Site and its content are provided on an "as is" and "as available" basis, without warranties of any kind, whether express, implied, or statutory, to the maximum extent permitted by applicable law. While we take reasonable measures to keep the Site accurate, available, and secure, we do not warrant that the Site will be uninterrupted, timely, error-free, or free of harmful components, or that any information on it is complete or current.
This Policy describes our data-protection practices; it is not a contract and does not create any warranty, guarantee, or service-level commitment. Vanta's organisational liability to business customers for the HealthEase product is governed by the separate master Subscription Agreement and Data Processing Agreement between Vanta and the customer, including their limitation-of-liability, warranty-disclaimer, exclusion, and indemnity provisions, which prevail over this Policy in the event of any conflict on those matters.
To the maximum extent permitted by applicable law, Vanta shall not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, business, data, or goodwill, arising out of or in connection with your use of, or inability to use, the Site, however caused and on any theory of liability. You are responsible for the accuracy of the information you submit through the Site and for maintaining the confidentiality of any credentials used to contact us.
Nothing in this Policy operates to limit or exclude any liability that cannot lawfully be limited or excluded under applicable law — including, where applicable, liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for gross negligence where it cannot be excluded, or under any non-excludable statutory data-protection or consumer-protection rights.
This Policy, and any dispute or claim arising out of or in connection with it, is governed by the laws of Pakistan, and the courts of Islamabad have exclusive jurisdiction — without prejudice to any data-subject rights or mandatory protections that apply to you regardless of a choice of law.
13. Changes to This Policy
We may update this Policy from time to time. We will post the updated version on the Site with a new "Last updated" date and, for material changes, provide reasonable additional notice. Continued use of the Site after the effective date constitutes acceptance of the updated Policy to the extent permitted by law.
14. Contact
- Privacy and data-protection questions / rights requests: wecare@healthease.app
- General enquiries: info@healthease.app
- Post: Vanta (Private) Limited, Pakistan (please email info@healthease.app for our current postal address)
Data-protection and privacy enquiries sent to wecare@healthease.app are routed to the team member responsible for privacy matters.
This Policy covers healthease.app visitor and lead data only. Product terms (the Subscription Agreement), the HealthEase Product Privacy Policy, and the customer Data Processing Agreement are separate documents available at healthease.app/legal.