Clinic24x7

Last updated: 22 August 2026

Privacy Policy

1. Who Operates This Service

This Privacy Policy applies to Clinic24x7 ("we", "us", "our"), a dental clinic management platform operated by Clinic24x7 Technologies Private Limited, registered at [REGISTERED ADDRESS IN BENGALURU, KARNATAKA, INDIA]. For privacy inquiries, contact our Data Protection Officer at privacy@clinic24x7.in.

2. Personal Data We Collect

We collect the following categories of personal data to provide our service:

  • Account & staff data:names, email addresses, phone numbers (with country codes), WhatsApp numbers, profile images, role (Super Admin, Clinic Admin, Doctor, Receptionist), MFA settings, and login timestamps.
  • Clinic & billing data:clinic name, email, phone, WhatsApp, address, GST number, registration number.
  • Patient records (entered by your clinic):patient number (system-generated), full name, gender, date of birth, contact details (mobile, WhatsApp, email), address, emergency contact, preferred language, preferred doctor, communication preferences, registration source, referral information, and administrative notes.
  • Clinical records (entered by your clinic):consultation notes, treatment plans, prescriptions, dental charts/odontograms, procedures, appointments, and visit records.
  • Files & attachments:X-rays, photos, lab reports, consent forms, prescriptions, invoices, insurance documents, and other uploads, referenced by a storage key alongside metadata (file name, MIME type, size, checksum, category). We are migrating this storage backend to a dedicated encrypted object-storage provider; see §5.
  • AI Scribe sessions:When you use the AI Scribe feature, the dictated or typed clinical text is sent to a configured LLM provider to extract structured clinical suggestions. Providers currently supported are Anthropic, Groq, and Google Gemini (additional providers, including OpenAI, Azure OpenAI, Google Vertex AI, and self-hosted models, are reserved for future support and not yet available). Clinical text is transmitted outside India to servers in the United States and other jurisdictions; these providers are contractually prohibited from training on your data. The raw input text and the provider snapshot are stored for audit and review.
  • Public lead forms:Product enquiry submissions (name, email, phone, clinic name, message) and trial sign-up data (name, email, phone, password, clinic details, address).
  • Authentication & session metadata:IP address, user-agent, session timestamps, and device identifiers associated with login sessions.

3. Why We Collect Each Category & How We Use It

  • To provide the service:authenticate users, enforce role-based access, manage multi-tenancy, and run the dental clinic workflows (booking, clinical records, billing, communications).
  • To communicate with patients:send appointment reminders, recalls, birthday wishes, and other notifications via WhatsApp (and other channels the clinic enables) — only at the clinic's direction.
  • To process payments:forward payment data to the clinic's configured gateway (e.g., Razorpay, Stripe, PayPal, Square) for settlement.
  • To enable AI Scribe:transmit dictation text to the clinic's chosen LLM provider and return structured suggestions; the provider does not train on this data under our agreements.
  • For security & fraud prevention:detect anomalous login attempts, enforce account lockout, and maintain audit logs.
  • To respond to enquiries & trials:contact prospects who submit product-enquiry or start-trial forms.

We do not sell patient data or clinical records to third parties, and we do not use it for advertising.

4. Legal Basis for Processing (India — DPDP Act, 2023)

Our processing is based on the following grounds under the Digital Personal Data Protection Act, 2023 and applicable rules:

  • Contract performance:providing the SaaS to the clinic (account, clinical, billing, communication modules).
  • Consent:where the clinic or patient provides explicit consent (e.g., WhatsApp opt-in, AI Scribe use, marketing contact).
  • Legitimate interest:security monitoring, fraud prevention, service improvement, and responding to enquiries — balanced against data subject rights.
  • Legal obligation:retaining records as required by applicable Indian healthcare and tax laws.

5. Data Storage, Security & Transfers

  • Hosting:PostgreSQL database, Redis, and application servers hosted in India (or as configured for the platform). File bytes reside in the external object store configured by the clinic (e.g., S3-compatible storage).
  • Encryption:TLS in transit. Encryption at rest for our database and file storage is on our roadmap and not yet implemented; this section will be updated once it lands.
  • Access controls:Multi-tenancy enforced per-query (every tenant-owned row has aclinic_id; repositories filter by it). Role-based access control (RBAC) with ~90 permissions mapped to four roles. HttpOnly cookies for JWT tokens; refresh tokens rotate on use.
  • Secrets:Integration credentials (WhatsApp, payment, AI, storage) are never stored in the database; they live in a dedicated secret manager (AWS Secrets Manager / Azure Key Vault / HashiCorp Vault / GCP Secret Manager) referenced by asecretReference.
  • Cross-border:If the clinic configures an LLM provider or storage outside India, personal data may be transferred to that provider's jurisdiction. We rely on the clinic's configuration choice and the provider's own safeguards.

We do notclaim "enterprise-grade", "HIPAA", or "DPDP compliant" certifications. Security is an ongoing process; the above describes our current technical measures.

6. Third-Party Service Providers (Sub-Processors)

The following categories of third parties may receive personal data at the clinic's configuration. We do not mandate any specific vendor; the clinic chooses and enables integrations.

  • Communications:Meta Cloud API (WhatsApp), Twilio (WhatsApp/SMS), SendGrid, AWS SES, Mailgun, Postmark (email), MSG91, Textlocal, AWS SNS, Vonage (SMS).
  • AI / LLM:Anthropic, Groq, or Google Gemini — for AI Scribe and text-polish endpoints. OpenAI, Azure OpenAI, Google Vertex AI, and self-hosted models are reserved for future support and not yet available.
  • Payments:Razorpay, Stripe, PayPal, Square (clinic-configured gateways).
  • Object storage:S3-compatible providers (AWS S3, MinIO, etc.) — for file bytes.
  • Infrastructure:PostgreSQL (database), Redis + BullMQ (job queues), hosting platform.

Each integration is governed by the provider's own terms and privacy policy. We encourage clinics to review them before enabling.

7. Data Retention & Deletion

  • Active accounts:Patient and clinical records retained while the clinic account is active.
  • Account closure:On closure request, we target a 30-day window to export the clinic's data before deletion, with backups purged within 90 days. Export and deletion are handled manually by our team on request today; self-service tooling for this is in development.
  • Legal holds:Records subject to litigation, regulatory inquiry, or tax audit are retained per applicable law and excluded from deletion schedules.
  • AI Scribe data:Dictation input and provider snapshots are retained as part of the clinical record for as long as the underlying consultation is retained, including sessions you discard without applying — a discarded AI suggestion is still kept as part of the clinical audit trail, not deleted.
  • Lead / trial data:Trial accounts converted to paid are retained as normal clinic accounts. Retaining product-enquiry data for 12 months and purging abandoned trials after 90 days of inactivity is our policy target; automated enforcement of these periods is not yet built, so these categories are retained until that automation ships.

8. Your Rights (India — DPDP Act, 2023)

As a data principal under the DPDP Act, you have the following rights regarding your personal data:

  • Access & portability:Request a copy of your data in a structured, commonly used format.
  • Correction & erasure:Rectify inaccurate data; request deletion where processing is no longer necessary or consent is withdrawn (subject to legal retention obligations).
  • Grievance redressal:Escalate concerns to our Data Protection Officer at [PRIVACY EMAIL]. We acknowledge within 72 hours and respond within 30 days.
  • Nomination:Nominate another individual to exercise your rights in the event of death or incapacity.
  • Withdraw consent:Where processing is based on consent, withdraw at any time without affecting lawfulness of prior processing.

Clinics (as data fiduciaries for their patients) are responsible for handling patient rights requests. We support these requests manually today (contact us to initiate an export or deletion); self-service export and deletion tooling is in development.

9. Children's Data

Our platform is not directed at children under 18. Clinics may create patient records for minors with parental/guardian consent as required by applicable law. We do not knowingly collect data from children without verifiable parental consent.

10. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email to registered clinic admins and/or a prominent notice in the platform at least 30 days before taking effect. The "Last updated" date above indicates the most recent revision.

11. Contact

For questions, complaints, or to exercise your rights, contact our Data Protection Officer:

  • Email: privacy@clinic24x7.in
  • Post: Clinic24x7 Technologies Private Limited, [REGISTERED ADDRESS IN BENGALURU, KARNATAKA, INDIA]