Privacy Policy

The OeHMIS Citizen Services application ("the App") is operated by the Department of Health & Family Welfare, Government of Odisha, and is developed and maintained by C-DAC (Centre for Development of Advanced Computing), Noida.

This Privacy Policy explains what personal information is collected when you use the App, why it is collected, how it is used, how it is protected, and your rights as a user. By using the App you agree to the practices described in this policy.

The App collects the minimum personal data required to deliver each service:

• To register you as a new patient at a government hospital and generate a C.R. number.
• To verify your identity via OTP before booking or modifying an appointment.
• To book, reschedule, or cancel OPD appointments and send confirmation details.
• To retrieve and display your hospital investigation (lab) reports.
• To generate a QR code for paperless hospital check-in.
• To facilitate ABHA (Ayushman Bharat Health Account) creation through NHA/ABDM APIs.
• To display real-time queue status on the Queue Management System (QMS) display boards.
• To maintain server-side audit logs for security, fraud prevention, and system debugging.
• To improve application performance, fix bugs, and enhance user experience.

Your personal data is shared only in the following limited circumstances:

The App implements multiple layers of security to protect your data:

• HTTPS / TLS encryption – All data transmitted between your device and our servers is encrypted.
• OTP-based authentication – Every appointment transaction requires verification via a one-time password sent to your registered mobile number.
• CAPTCHA protection – Automated abuse is prevented by configurable CAPTCHA challenges.
• CSRF protection – Cross-Site Request Forgery tokens are validated on every state-changing request.
• Security headers – HTTP security headers (Content-Security-Policy, X-Frame-Options, etc.) are enforced on all responses.
• Session management – Sessions expire automatically after inactivity; session tokens are invalidated on logout.
• Input validation – All user-supplied input is validated and sanitised server-side to prevent injection attacks.
• Audit logging – Access to sensitive data is logged for accountability and intrusion detection.

• Appointment records – Retained as part of the hospital management system for the duration required by government healthcare regulations.
• Lab reports – Stored on secure government servers and accessible to the patient through the App; retention follows hospital record-keeping policies.
• Provisional registrations – Valid and accessible for 30 days from the date of booking; automatically archived thereafter.
• Session data – Cleared automatically when your session ends or expires.
• Server / audit logs – Retained for a period as required by IT security policy and government audit requirements.

• Access – You can view your appointment history and lab reports directly within the App using your C.R. number and OTP verification.
• Correction – If your registered details (e.g., mobile number, name) are incorrect, contact the hospital Registration Counter for correction.
• ABHA account – You may manage or delete your ABHA health account through the official ABHA portal (abdm.gov.in) at any time.
• Opt-out – Use of the App and submission of personal data is entirely voluntary. You may stop using the App at any time.

• Session cookie – Used to maintain your authenticated session. Deleted when you close the browser or log out.
• Language preference cookie – Stores your selected display language (English / Hindi / Odia) for a consistent experience across pages.
• Google Translate cookie (googtrans) – Set if you choose to translate the page. This cookie is controlled by Google's Translation service.
• Local storage (QMS) – The Queue Management System may store queue token data temporarily in your browser's local storage for real-time display. No personal health data is stored.

The App does not use advertising cookies, tracking pixels, or third-party analytics.

Government hospitals serve patients of all ages. Where a minor's appointment is booked, all transactions must be completed by a parent or legal guardian who provides their own verified mobile number and accepts responsibility for the accuracy of the information submitted. The App does not knowingly collect personal data from children without appropriate adult authorisation.

The App may contain links to external websites such as abdm.gov.in and cdac.in. These sites have their own privacy policies. We are not responsible for the content or privacy practices of any external website.

We may update this Privacy Policy from time to time to reflect changes in the App's features or applicable law. When we do, the "Last Updated" date at the top of this page will be revised. Continued use of the App after any update constitutes acceptance of the revised policy.

If you have questions or concerns about this Privacy Policy or the handling of your data, please contact: