Privacy policy

1. Who we are

Dental OS ("we", "us") is a cloud-based practice management service for dental clinics, operated by [Legal entity name], [registered address], India. This policy explains what personal data we process, why, and the choices you have. It is written with reference to the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023.

2. Two kinds of data

Account data (we are the data fiduciary)

When a clinic signs up we collect the name, email address, phone number and password hash of each user, the clinic's name, address, GSTIN and billing email, and subscription and payment records. We use this data to provide the service, issue invoices, send transactional email, provide support and meet our legal obligations.

Patient data (the clinic is the data fiduciary; we are a processor)

Clinics enter patient names, contact details, appointment history, clinical findings, treatment plans, prescriptions, files and invoices into the service. The clinic decides what is collected and why, and is responsible for obtaining patient consent as required by law. We process this data only on the clinic's instructions to deliver the service, and never use it for advertising or sell it to anyone.

3. Website visitors

If you fill in our contact form we store the details you submit (name, clinic name, phone, email, message) to respond to you. Our website does not use third-party advertising cookies or analytics that identify individual visitors.

4. Where data is stored

Production data is stored on servers located in India. Daily encrypted backups are retained for 14 days. Data in transit is protected with TLS and sensitive credentials are encrypted at rest.

5. Sub-processors

We share data only with providers needed to run the service:

• Razorpay Software Pvt. Ltd. for subscription payments (we never see full card numbers).
• Our transactional email provider for email such as invitations and password resets.
• Meta Platforms (WhatsApp Business Cloud API) for patient messaging, once that module is enabled by the clinic.
• Our hosting provider for servers, storage and backups.

6. Retention

Account and patient data is retained for as long as the clinic's account exists. After a subscription ends the account becomes read-only; the clinic can request a full export of its data at any time. We delete the clinic's data 90 days after the account is closed on request, except invoices and payment records that we must keep for tax purposes.

7. Your rights

Clinic users can view and correct their profile inside the app. Patients should contact their clinic to access or correct their records; if a patient contacts us directly we will refer the request to the clinic and assist it. You may withdraw consent, request deletion or raise a grievance by writing to the Grievance Officer at suryakiran369499@gmail.com. We aim to respond within 30 days.

8. Security

Access to the service is by individual user accounts with role-based permissions. All changes to patient and billing records are recorded in an audit log visible to the clinic owner. We will notify affected clinics and the relevant authorities of any personal data breach as required by law.

9. Changes

We will post any changes to this policy on this page and update the date at the top. Material changes will be announced to clinic owners by email.

10. Contact

Grievance Officer: [Grievance officer name], [Legal entity name], [registered address]. suryakiran369499@gmail.com. See also our Terms of service and Refund policy.