Data Protection Policy

1. Our Commitment

As a healthcare provider, we handle sensitive personal information, including dental and medical history. We treat this data with the same care and confidentiality we bring to in-person treatment.

2. Data We Protect

• Patient identity and contact information (name, phone number, address, email)
• Treatment records, dental history, and clinical notes
• Appointment scheduling data
• WhatsApp and phone communication records related to your care

3. Security Measures

We apply reasonable safeguards appropriate to a small healthcare practice, including:

• Restricting access to patient records to authorised clinic staff and treating dentists only
• Using access-controlled digital systems for appointment scheduling and patient records
• Relying on encrypted, official channels (WhatsApp Business Platform, provided by Meta) for patient messaging rather than personal, unofficial messaging accounts
• Regularly reviewing who has access to patient data as staff roles change

4. Data Processors We Work With

We use third-party service providers to help us run the clinic, including:

• Meta / WhatsApp Business Platform - for sending appointment reminders and treatment-related messages. Meta processes this data as our service provider, under its own Business Data Processing Terms.
• Cloud-based scheduling and record-keeping tools - used to store and manage appointment schedules securely.

We only permit these providers to process your data for the specific purposes we've instructed, and not for their own independent use.

5. Data Retention and Deletion

• Patient treatment records are retained for as long as required to provide continuity of care and to meet applicable medical record-keeping norms under Indian dental practice regulations.
• Appointment and communication records not required for ongoing treatment are periodically reviewed and deleted or anonymised.
• If you request deletion of your data, we will action this except where we are legally required to retain records (e.g. treatment history relevant to an ongoing course of care, or statutory retention periods).

6. Your Rights as a Data Principal

Under applicable Indian data protection law, you have the right to:

• Obtain confirmation of whether we process your personal data, and access it
• Request correction or completion of your personal data
• Request erasure of personal data that is no longer necessary for the purpose it was collected
• Withdraw consent for optional communications at any time
• Nominate another individual to exercise these rights on your behalf in case of death or incapacity
• Raise a grievance with us, and escalate to the relevant Data Protection Board if unresolved

7. Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will take prompt steps to contain it, assess the impact, and notify affected patients and relevant authorities as required by applicable law.

8. Children's Data

Where a patient is a minor, we process their data on the basis of consent provided by a parent or legal guardian.

9. Contact for Data Protection Queries

10. Updates to This Policy

We may revise this Data Protection Policy periodically to reflect changes in law, technology, or our practices. Updates will be posted here with a revised date.