Privacy Policy

Clinics decide what patient information to record and why. For patient records, the clinic is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and ClinioSync processes that information on the clinic's behalf and on its instructions.

For clinic staff accounts, people who contact us, and visitors to our website, we decide how the information is used and are responsible for it.

Clinic and staff accounts.

• Name, email address, mobile number, role, branch and working hours.
• Clinic details such as name, address, specialty, fees and messaging settings.
• Your password, stored only as a one-way hash. We cannot read it.
• If you choose Sign in with Google: your Google account ID, email address, whether Google has verified that email, and your name. We do not receive your Google password and do not access your Gmail, contacts, Drive or any other Google data.

Patient records entered by a clinic.

• Identity and contact details: name, mobile number, age or date of birth, gender, address, language.
• Health information: complaints, case notes, history, examination findings, vitals, diagnoses, prescriptions, and reports or files the clinic uploads.
• Appointments, queue tokens, visits, bills, payments and pharmacy dispensing.
• Consent records, messages exchanged with the clinic, and feedback the patient gives.

Information patients enter themselves through links a clinic sends them, such as intake forms, QR check-in, booking and feedback pages. It is added to that clinic's records.

Technical and security records. The time of each sign-in, the IP address and browser it came from, and an audit trail of actions taken in the app (for example who changed a record and when).

Our website. The website uses Google Analytics to count visits and see which pages people read. It sets cookies in your browser and sends Google your IP address, browser and the pages you view. We do not use it for advertising, and it is not used in the clinic app. You can block it with your browser’s privacy settings or Google’s opt-out add-on (tools.google.com/dlpage/gaoptout). The “Book a demo” form opens WhatsApp with your message filled in, so we only receive what you choose to send. The site loads its font from Google Fonts, which means your browser contacts Google's servers. Questionnaires we send to specific customers may let you record voice notes, which are converted to text by a speech-to-text provider (see section 5).

• To provide the service the clinic has signed up for, including storing and displaying its records.
• To send WhatsApp messages that the clinic has set up, such as appointment reminders, queue updates, intake links, prescriptions and receipts.
• To sign people in, keep accounts secure, prevent misuse and investigate access a clinic does not recognise.
• To provide support when a clinic asks us for help, and to fix problems.
• To meet legal obligations.

We do not sell personal data, do not use it for advertising, and do not use patient records to train AI models.

ClinioSync uses Google Sign-In only to let clinic staff sign in to the app. We request only your basic profile (name, email address and Google account ID). We use it to identify your account and for nothing else, and we do not share it with anyone except as needed to run the service or comply with the law.

ClinioSync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Only with the following, and only as far as needed:

• The clinic's own staff, according to the roles and permissions the clinic sets.
• Service providers that run parts of the service for us, under our instructions:
  • Contabo: cloud servers that host the app and database, located in Mumbai, India.
  • Cloudflare: network protection and delivery, and storage for encrypted backups.
  • Meta (WhatsApp Business Platform): delivers the WhatsApp messages a clinic sends.
  • Google: Sign in with Google, for staff who choose it, and Google Analytics for visits to our website.
  • ElevenLabs: speech-to-text, only for voice notes in questionnaires we send to customers.
• Authorities, when the law requires it, for example a valid court order.
• A successor, if ClinioSync is merged or transferred, under the same protections described here.

The app and its database run on servers in Mumbai, India. Encrypted backups are kept with Cloudflare, which may store them in data centres outside India. WhatsApp messages pass through Meta's systems in order to be delivered. Website visit data collected by Google Analytics is stored by Google, which may be outside India.

• Clinic and patient records are kept while the clinic's account is active. Clinics are responsible for how long they must keep medical records under the laws and professional rules that apply to them.
• When a clinic closes its account, we return or delete its data on the clinic's written request. Copies in backups expire on a rolling schedule after that.
• Sign-in and audit records are kept while the account is active, for security.
• The public demo clinics contain only made-up data and are reset every night. Please do not enter real patient information in a demo clinic.

• All connections use HTTPS encryption.
• Passwords are stored as one-way hashes.
• Each clinic's data is kept separate, and staff see only what their role allows.
• Actions on records are written to an audit log.
• Backups are taken daily and stored encrypted, away from the main servers.
• Access to production systems is limited to the people who run the service.

No system is perfectly secure. If a breach affects personal data, we will inform the affected clinics and the authorities as the law requires.

Under the DPDP Act you can ask to access, correct or erase your personal data, withdraw consent, nominate someone to act for you, and raise a grievance.

• Patients: your records belong to your clinic, so please contact the clinic first. We will help the clinic respond to your request.
• Clinic staff and everyone else: email [email protected].

We respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

The app is used by clinic staff, not by children. Clinics may record information about patients under 18, with the consent of a parent or guardian, as part of their care.

We will update the date at the top when this policy changes, and tell clinics in advance about any important change.

For privacy questions, data requests or complaints, contact our Grievance Officer at [email protected]. We acknowledge grievances promptly and resolve them within 30 days.