Legal

Privacy policy

Last updated 10 October 2026

CrossCares is software for hospitals that treat patients from other countries. It is made and run by Vynton Works LLP, a limited liability partnership registered in India (“Vynton”, “we”). This policy explains what personal data we handle, why, and what you can ask of us. It covers this website, crosscares.com, and the CrossCares platform that hospitals use.

1. Two different roles

• When you visit this website, ask for a demo, or deal with us as a customer, Vynton decides how your data is used. We are the data fiduciary, or controller, for that data.
• When a hospital uses CrossCares to look after its patients, the hospital decides. Patient records, documents and messages in CrossCares are the hospital's. Vynton processes them only on the hospital's instructions and under our agreement with it. If you are a patient, the hospital treating you is responsible for your data, so please contact it first. If you write to us instead, we will pass your request to the hospital.
• When a hospital runs CrossCares in its own cloud account, patient data stays in that account. We manage the software, but we do not hold the key that decrypts passport and bank details.

2. This website

• No cookies or tracking. crosscares.com sets no cookies and uses no analytics or advertising trackers.
• Fonts. The pages load their typefaces from Google Fonts, so your browser sends your IP address to Google when a page opens. Google's privacy policy applies to that request.
• Hosting. The site is served by Amazon Web Services. AWS uses your IP address to deliver the pages. We do not keep access logs.
• Demo requests. When you ask for a demo we receive the details you give us: your name, your hospital or group, your work email, your WhatsApp number if you add it, roughly how many international enquiries you handle, and your notes. We use them to reply to you and arrange the demo, and for nothing else. The request is stored with AWS in Mumbai and emailed to our team. We keep it while we are in touch with you and delete it when you ask. To stop the form being abused, we count requests from each IP address for an hour, and those counts are deleted after a day.

3. Hospital staff and customers

For hospital staff who sign in to CrossCares, we hold:

• name, work email, role and hospital;
• sign-in and two-step verification records;
• a record of the actions they take in the platform, which is the audit trail the hospital relies on.

For our customers we hold the contact details of the people we deal with, along with contracts and invoices. We use this data to provide CrossCares, keep it secure, support our customers and bill them.

4. Patient data in CrossCares

A hospital can keep these records about its patients in CrossCares:

• identity and contact details;
• passport and visa details;
• medical reports and doctors' opinions;
• treatment estimates, payments and travel arrangements;
• the messages exchanged with the hospital over WhatsApp, Telegram and other channels.

Each hospital or hospital group has its own database, separate from every other customer's. Passport and bank details are encrypted field by field. Unless a hospital chooses another region, or runs CrossCares in its own AWS account, the data is held with AWS in India (Mumbai). The hospital decides how long records are kept, subject to the legal minimums for medical records.

5. WhatsApp, Telegram and connected accounts

• Messages between a patient and a hospital pass through Meta's WhatsApp Business Platform or through Telegram. Each applies its own terms and privacy policy to what passes through it.
• A hospital connects its own WhatsApp Business account to CrossCares through Meta's Facebook Login for Business. When it does, Meta gives us an access token and the IDs of the hospital's business portfolio, WhatsApp Business account and phone number. We store the token encrypted. We use the token and IDs only to send and receive that hospital's messages, manage its message templates and show it the state of its account. We do not use the connection to read anything else in the hospital's Meta accounts.
• We do not use data from Meta or Telegram for advertising, and we do not sell it.

6. Reading documents with AI

If a hospital turns it on, CrossCares sends a patient's medical documents to an AI model to pull out findings for the hospital's coordinators to check. The model is provided by Anthropic, Google or Amazon Web Services (Bedrock), depending on how the hospital's CrossCares is set up. Documents are sent for that extraction and nothing else. If the hospital does not turn the feature on, no documents are sent.

7. Who else handles data

We do not sell personal data, and we do not share it for advertising.

8. Data that crosses borders

Patients often live in a different country from the hospital treating them, so their data crosses borders as part of their care. Vynton is in India. Where a country's law requires safeguards for such transfers, we provide them through our agreements with hospitals.

9. Security

We protect data in these ways:

• Every connection uses HTTPS.
• Each hospital or group has its own database.
• Passport and bank details are encrypted field by field.
• Staff sign in with two-step verification.
• Actions in the platform are logged.
• Access is limited to the people who need it.

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires. For patient data, we will tell the hospital, so that it can do the same.

10. Your rights

Depending on where you live, under India's Digital Personal Data Protection Act 2023, the EU or UK GDPR or other laws, you can:

• ask what personal data we hold about you;
• have it corrected, completed or erased;
• withdraw consent you have given;
• nominate someone to act for you;
• complain to a data protection authority, which in India is the Data Protection Board of India.

To use these rights, write to us at the address in section 14. If your request is about your records as a patient, it is best made to your hospital.

11. Deleting your data

• Website visitors and demo requests. Email us and we will delete your details within 30 days and confirm when it is done.
• Hospital staff. Your hospital's administrator can remove your account. You can also ask the hospital, or us, to do it.
• Patients. Ask your hospital, and we will act on its instruction. Medical records sometimes have to be kept for a minimum period by law. Until that period ends, they are restricted rather than erased.
• A hospital's WhatsApp connection. When a hospital disconnects its WhatsApp account from CrossCares, or asks us to, we delete the access token we held for it within 30 days and stop using the account's IDs. A hospital can also remove CrossCares' access at any time in its Meta business settings.

12. Children

This website is not meant for children. Hospitals do treat children. A hospital that keeps a child's records in CrossCares is responsible for having the consent of a parent or guardian.

13. Changes to this policy

When this policy changes, the date at the top changes with it. We will tell our customers about significant changes before they take effect.

14. Contact and grievance officer

Grievance officer: Ramu Radhakrishnan, technology@vynton.com. We acknowledge every request and respond within 30 days.