Privacy Policy & Data Stewardship

Ritrio collects institutional and operational data provided directly by healthcare organizations during onboarding and platform use. This includes organizational identifiers, operational metrics, and system configuration data necessary to deliver our services. We do not collect personal patient health information (PHI) through this corporate website.

Data collected through our platforms and this website is used exclusively to provide, maintain, and improve Ritrio services. We do not sell, rent, or share institutional data with third parties for commercial purposes. Operational data may be used in anonymized, aggregate form to improve platform performance and clinical workflow design.

Ritrio maintains enterprise-grade security protocols including AES-256 encryption at rest, TLS 1.3 in transit, and multi-factor authentication for all administrative access. Our platform architecture is designed to meet HIPAA standards and Nepal Insurance Authority (NIA) requirements. For detailed security documentation, contact our institutional team.

Patient and institutional data processed through Ritrio platforms is stored within cloud infrastructure designed to meet Nepal's emerging health data governance requirements. Ritrio is committed to data residency arrangements that align with national health data sovereignty policy and Ministry of Health and Population guidelines. Infrastructure is operated within internationally recognized cloud regions with comprehensive data access controls, encryption at rest and in transit, and immutable audit trails. Detailed data residency documentation — including infrastructure specifications, data flow diagrams, and jurisdictional controls — is available to institutional partners under a confidentiality agreement. Contact hello@ritrio.com to request security and data residency documentation.