Togthr Privacy Policy

This Privacy Policy explains how Togthr (“Togthr”, “we”, “us”, “our”) collects, uses, discloses, and protects personal data when you interact with our products, services, websites, and applications.

Company address: IITM Research Park, Kanagam Rd, Kanagam, Tharamani, Chennai, Tamil Nadu 600113

Contact: care@togthr.health

By using our services, you agree to the practices described in this Policy. If you do not agree, please do not provide personal data and request that your employer or customer does not submit it on your behalf.

We may update this Policy periodically to reflect legal, technical, or business changes. If changes materially affect your rights, we will make commercially reasonable efforts to notify you. Otherwise, please review this Policy regularly.

Controller: When we collect personal data about you for our own purposes (e.g., website usage, billing, account administration), we act as a data controller.

Processor: When our customers use our platform to process data (including PHI) about individuals (e.g., patients, staff), we act as a processor—or a “Business Associate” under HIPAA—and process the data only as instructed in our contracts, including the Data Processing Agreement (DPA) and, if applicable, the Business Associate Agreement (BAA).

Children: Our website and marketing are not directed to children. However, our customers may process minors’ health information for healthcare purposes through our platform. In such cases, our customers act as controllers, and Togthr acts strictly as a processor/Business Associate.

Third-party links and apps: Our services may include links or integrations with third-party websites, apps, plug‑ins, and tools. We do not control third‑party privacy practices, so please review their policies before using them.

We collect personal and business information from different sources depending on how you use our services. This includes information you provide directly, that we collect automatically, that comes from integrations and connected services, or that is provided by others (such as your employer).

2.1 Data You Provide to Us

• Account and profile: name, role, organization, email, phone, password hashes, profile photo.
• Business and billing: plan, seats, subscription details, transaction records, addresses, tax information.
• Communications: support requests, feedback, survey responses.
• Forms and content: any data entered in EHR/CRM/forms/website builder (as a controller or on behalf of your controller).
• Job applications: CV/resume, cover letters, references, interview feedback.

2.2 Data Collected Automatically

• Device/technical: IP address, device identifiers, operating system, browser, network details, language, time zone.
• Usage: feature/event telemetry, session length, pages/screens viewed, clickstream data, crash logs.
• Cookies/SDKs: see our Cookies Policy for details and controls.

2.3 Data from Integrations and Connected Services

If you connect third‑party services, we may receive:

• Identity data (names, emails, account identifiers).
• Email/calendar content and metadata (e.g., Gmail, Microsoft 365 Outlook).
• Files/attachments (e.g., Google Drive, OneDrive).
• Messages from connected channels (if enabled).
• CRM/EHR/other system data via APIs or imports.

Google APIs – Additional Limits (Data Accessed, Usage, Sharing, Storage, Retention, Deletion):If you connect Google services (e.g., Gmail, Calendar, Drive), Togthr accesses the following specific data types to provide the features you enable: names, emails, account identifiers, email/calendar content and metadata, and files/attachments (the "Google User Data").

Togthr’s use and transfer of Google User Data will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Data Usage:We only use Google User Data to provide or improve user-facing features (e.g., displaying emails, managing calendars, accessing files for your direct use within Togthr).
• Data Sharing: We do not use Google User Data for ads. We do not share this data with any third parties except with our necessary Service providers/Subprocessors (e.g., cloud hosting, security tools) strictly for the purpose of operating the Togthr service and maintaining its security, as outlined in Section 5, and in compliance with the Limited Use policy. We will not transfer or allow access to this data by any human unless you consent, required by law, necessary for security/abuse investigations, or for internal operations with data aggregated/de-identified.
• Data Storage & Protection: We securely store and protect Google User Data using technical and organizational measures appropriate to risk, including encryption in transit and at rest, access controls, and audit logging, as detailed in Section 7.
• Data Retention & Deletion: We retain Google User Data for as long as necessary to provide services and fulfill the purposes outlined in Section 8. You can request the deletion of your Google User Data by disconnecting the integration within the application settings or by contacting us at care@togthr.health. Upon a valid deletion request, we will delete or anonymize your Google User Data within our systems, in compliance with our data retention policy and applicable law.

Microsoft Graph – Additional Limits:If you connect Microsoft services (e.g., Outlook, Calendar, OneDrive), we use and transfer Microsoft Graph data only to provide Togthr features you enable, do not use it for ads, and limit access consistent with Microsoft’s terms and applicable law.

2.4 Data We Receive from Others

• Your employer, customer, or colleagues may provide your details (e.g., work email) to add you as a user.
• Service providers, payment processors, anti-abuse/security tools, and enrichment services may share signals or data under their policies and applicable law.

2.5 Special Categories, Health Data, PHI

The platform supports healthcare data, including PHI under HIPAA, when used in PHISafe features subject to a Business Associate Agreement (BAA). Our customers control whether they upload/process special categories of data or PHI. Togthr processes such data only under customer instruction and contracts (DPA/BAA).

We use personal data to deliver, improve, and protect our services, based on lawful grounds for processing under applicable data protection laws (such as GDPR or HIPAA). The purposes and legal bases include:

PHI processing requires a BAA and use of PHISafe features. Customers are responsible for configuration, role-based controls, and ensuring PHI is not sent via NonPHI channels.

We may share personal data with:

We do not sell personal data. We do not use PHI or Google User Data for advertising purposes, and we do not share such data with third parties for advertising.

Depending on your region, you may have rights such as:

• Access, correction, deletion/erasure, restriction, portability.
• Objection to processing or to direct marketing.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a regulator.

We use cookies/SDKs for essential operations, security, preferences, analytics, and, where applicable, marketing. Consent banners and regional controls are applied where required. See our Cookies Policy for details and options

While our customers may process minors’ health data within PHISafe features, our website and marketing are not directed at children. Any processing of minors’ data in the platform is under our customer’s control and governed by our DPA/BAA.

Our services currently do not respond to browser “Do Not Track” signals. We will honor applicable global privacy control signals where required by law for optout preferences in the US.

We may revise this Policy and will update the “Last updated” date. For material changes, we will provide notice via the services, email, or our website.