1. Roles under the DPDP Act
Your clinic decides what patient data to record and why, so your clinic is the Data Fiduciary. ClinicManagerPro processes that data only on your behalf and on your instructions, as a Data Processor.
For the data of clinic owners and team members who use the app, we are the Data Fiduciary, as described in our Privacy Policy.
2. What we do as your Data Processor
- Process patient data only to provide ClinicManagerPro to your clinic.
- Keep patient data confidential and never sell it or use it for advertising.
- Store it on servers in Mumbai, India.
- Limit access inside your clinic by role and branch, and limit our own staff's access to what's needed to support you.
- Help you respond to patients' requests to access, correct or erase their data.
- Tell you without undue delay if we become aware of a personal data breach affecting your clinic's data.
- Delete or return your data when your account ends, as described in our Terms of Service.
3. Tools in the app that help you comply
- Consent records: record each patient's consent with its date and method.
- WhatsApp opt-in: record whether a patient agreed to WhatsApp messages.
- Role-based access: six roles, so each person sees only what their job needs.
- Branch-level access: staff see only their own branches. Patients are shared between branches deliberately, with an optional end date.
- Locked clinical notes: signed notes can't be changed.
- Export and deletion: export a patient's data or remove it on request.
4. What your clinic needs to do
- Give patients a clear notice of what you collect and why, and get their consent.
- Record only what you need for treatment, billing and legal records.
- Keep log-ins private and remove access for people who leave.
- Respond to patients' requests about their data.
- Keep records only as long as medical and legal rules require.
5. Sub-processors
We use carefully chosen providers for cloud hosting, databases, email delivery and payments. They process data only to provide their service to us. [list of sub-processors to be added]
6. Breach notification
If we become aware of a breach affecting personal data in your clinic's account, we'll inform you without undue delay with what we know, so you can meet your duties to the Data Protection Board and affected patients.
7. Contact
Questions about data protection: contact@clinicmanagerpro.com. Grievance Officer: [name of the Grievance Officer to be added].