This policy describes what we actually do today, not an aspirational version of it. If anything here is unclear, write to us and we will explain it in plain language.
1. Who we are
ClinicDesk is a clinic management software product. Clinic owners (the "Clinic") create an account and use the service to manage their patients, appointments and revenue. Clinic owners are the controllers of their patient data. We act as a processor on their behalf, and the clinic's own name appears to patients on the booking page.
2. Information we collect
Information you give us
- Clinic details: name, address, contact details, logo, timings, fee list and working hours.
- Doctor and staff details: name, role, contact details and login credentials.
- Patient records that clinic staff enter: name, contact details, age, visit history, notes, fees paid and appointment records.
- Billing information: plan, payment method, invoices and transaction records.
- Support messages you send us.
Information collected automatically
- Technical data such as IP address, device and browser type, pages viewed and timestamps, used to operate and secure the service.
- Cookies and similar storage used to keep you signed in and to remember preferences.
Information from patients
When a patient books through your clinic's booking link, we receive the details the patient enters — typically name, phone number, email address, the doctor and slot they chose, and any note they add. This information is entered into your clinic's dashboard so your team can manage the appointment.
3. How we use the information
- To provide, operate and support the ClinicDesk service, including running your clinic's booking page and reminders.
- To calculate and display appointment status, patient counts and revenue figures inside your dashboard.
- To send appointment reminders on your behalf, where you have enabled them.
- To process subscription payments and issue invoices.
- To detect, prevent and investigate abuse, fraud and security incidents.
- To send service announcements and product updates. Marketing email is opt-in and can be turned off at any time.
We do not sell your clinic's data or your patients' data. We do not use patient data for advertising or for training third-party models.
4. How we share information
- Service providers. We use vetted providers for hosting, database, payment processing, email notifications, and customer support. They act on our instructions and may not use your data for their own purposes.
- At your instruction. When appointment reminders or email confirmations are sent, the relevant patient email details are processed to deliver the notification.
- Payments. Payment details are handled directly by our payment processor; we never see or store full card numbers.
- Legal requirement. We may disclose information where required by law, or to protect the rights, safety and integrity of our users and the public.
- Business transfer. If we sell or merge the business, information will be transferred as part of that transaction, and we will tell you before it happens.
5. Where we store data
ClinicDesk data is stored on secure cloud database servers. Where data leaves India, we use appropriate contractual safeguards.
6. How long we keep it
We keep clinic and patient data for as long as your account is active. If you cancel, your data remains available for export for 30 days, after which it is permanently deleted from production systems and removed from backups on our standard backup rotation. Data required to be retained for legal, tax or accounting reasons is kept in an isolated archive for the period required by law.
7. Security
Data is encrypted in transit using TLS and at rest using industry-standard encryption. Access is role-based, so you control what each staff member can see. Logins are protected by password hashing. Backups are taken daily. Staff access to customer data is limited to what is needed to support you and is logged.
If a breach affects your data, we will notify you and the relevant authority as required by law, and we will tell you what we know and what we are doing.
8. Your rights
Depending on where you are, you may have the right to access, correct, delete, restrict or port your data, and to object to certain processing. In practice, clinic owners control this directly:
- Export your clinic and patient data at any time from your dashboard, as CSV or Excel.
- Correct or delete any record, and delete a patient record entirely.
- Manage which staff members can access which parts of your data.
- Delete your clinic and all associated data by cancelling your account.
9. Contact
If you have questions about this policy or your data, email privacy@clinidesk.in.