Privacy Policy
Last updated: 13 October 2026
1. Introduction
This Privacy Policy describes how we collect, use, store, and protect information in connection with Clinic-Ops (online appointment booking and clinic management) and related applications. We are committed to protecting your privacy and handling personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, where applicable.
2. Information We Collect
We may collect information you provide when you register or use our services, such as name, email, phone number, clinic and doctor details, appointment and booking data, and similar information necessary to provide the services. When you use our web application, we may collect information such as IP address and browser type as permitted by law.
If you connect optional services, we also process the connection data described in the Google Drive and WhatsApp sections below. We do not sell your personal data to third parties.
3. Purpose and Use
We use the information we collect to provide, operate, and improve our services; to authenticate users and manage accounts; to send service-related communications; to comply with legal obligations; and to protect the security of our systems and users. Processing is done for specified, clear and lawful purposes in line with applicable Indian data protection requirements.
4. Consent and Lawful Basis
Where required under Indian law (including the DPDP Act), we process personal data based on your consent or other lawful grounds permitted under the Act. By using our services, you consent to the collection and use of your information as described in this policy. Connecting Google Drive or WhatsApp is optional and is a further consent for the processing described in those sections. You may withdraw consent or exercise your rights as described below, subject to applicable legal and contractual constraints.
5. Your Rights (Data Principal Rights)
Under the Digital Personal Data Protection Act, 2023, you have the right to access your personal data, to correct or update inaccurate data, to erase data in accordance with the law, and to nominate another person in the event of death or incapacity. You also have the right to grievance redressal. To exercise these rights, please contact us using the details provided on the Clinic-Ops website, or use the data-deletion request page where it is published. We will respond in accordance with the timelines prescribed under applicable law.
6. Data Retention and Security
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and as required by applicable Indian law. We implement reasonable security practices and procedures to protect personal data from unauthorised access, alteration, disclosure or destruction, in line with the requirements under the IT Act and rules and the DPDP Act. Sensitive clinical and patient identity fields stored in our databases are encrypted at rest using application-level field encryption; access is limited to authenticated clinic and administrative users as needed to operate the service. You are responsible for keeping your login credentials secure.
Consultation audio uploaded to a doctor's Google Drive is not kept on Clinic-Ops storage. Chart backups that a doctor sends to their own Google Drive are stored there as files the doctor controls.
7. Healthcare and Patient Data
If you use our services to process patient or other health-related data, you are responsible for ensuring that your collection, use, storage and disclosure comply with applicable Indian laws, including medical ethics, consent requirements, and any sector-specific rules. We process such data only as necessary to provide the services you request and in accordance with this policy and our agreements. Recording a consultation and sending patient details on WhatsApp require the clinic to have any consent the law requires.
8. Sharing and Third Parties
We may share data with service providers who assist in operating our services, subject to confidentiality and data-protection obligations. We may disclose data where required by law or by order of a competent authority in India. We do not sell your personal data.
Google and Meta receive data only when a user connects or uses those features, as described in the next two sections.
9. Google Drive
Google Drive is optional.
Doctor connection. From EMR Settings, a doctor can sign in with Google and allow Clinic-Ops to create files in their Drive. The permission is limited to files Clinic-Ops creates. We store a refresh token for that doctor on our servers so backups and uploads can continue. We do not receive the doctor's Google password.
Chart backups. The doctor chooses which sections to include (for example patients, prescriptions, bills, growth, vaccinations, Natal IQ, and specialty charts). The backup is a JSON file written to a Clinic-Ops folder in that doctor's Google Drive. The file is unencrypted so the doctor can read it and import it back. It does not include clinical file blobs stored in our object storage.
PsychOps session audio. If the doctor turns this on, the browser records the consultation (one or two microphones, mixed into one file) and uploads it to a PsychOps audio folder in that doctor's Google Drive. The audio is not stored on Clinic-Ops. We save the Drive file id, file name, type, size, duration, and time on that assessment so it can be played later through a signed-in clinic session.
Administrator connection. A platform administrator may connect a separate Google account for a system backup of operational data such as doctor accounts, appointments, and settings. That backup is not the patient-chart backup.
Data in Google Drive is processed by Google under Google's Privacy Policy. Disconnecting removes our ability to upload new files. Files already in Drive stay in that Google account until the account holder deletes them.
10. WhatsApp and Meta
WhatsApp messaging is optional and uses the WhatsApp Cloud API provided by Meta.
What we send. When a clinic or the platform sends a WhatsApp message, the message content and the recipient's phone number are transmitted to Meta. Clinic messages can include a patient's name, mobile number, appointment details, and the text or image of a bill, prescription, or reminder that the clinic chooses to send. Platform notices may be sent to a doctor's own mobile number.
Connecting a business account. A doctor may connect a WhatsApp Business Account through Meta Embedded Signup, which uses Facebook Login. Meta then provides a business token so the clinic can send messages from that WhatsApp number. We store what we need to operate that connection.
Messages opened on the device. Some buttons open WhatsApp on the doctor's or staff member's own device with a draft message. In that case the message is sent by the WhatsApp app on that device, not only through our server.
Meta processes this information under its own terms, including the WhatsApp Privacy Policy and Meta Privacy Policy. The clinic is responsible for sending patient information on WhatsApp only when it has a lawful basis to do so.
11. Children
Our services are not directed at individuals below 18 years of age. We do not knowingly collect personal data from children for account registration. If you believe we have collected such data, please contact us so we can take steps to delete it in accordance with the law. Clinics that treat children remain responsible for the patient records they enter.
12. Grievance Officer
In accordance with Indian law, we may designate a Grievance Officer for the redressal of complaints relating to the processing of personal data. Contact details for the Grievance Officer (if designated) will be made available on the Clinic-Ops website.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. Continued use of the services after changes constitutes acceptance of the updated policy, subject to your rights under applicable law.
14. Contact
For any questions, requests or complaints regarding this Privacy Policy or your personal data, please contact us through the contact details provided on the Clinic-Ops website.