Privacy Policy
ClinicConnect helps clinics answer patients on WhatsApp and the phone, book and remind appointments, collect payments, and publish social media content. This policy explains what personal data we handle, why, who we share it with, how long we keep it, and how you can ask for it to be corrected or deleted. It is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the requirements of the platforms we connect to, including Meta (WhatsApp, Facebook, Instagram) and Google.
1. Who is responsible
- Patients of a clinic: the clinic you contact decides why and how your data is used. The clinic is the Data Fiduciary; ClinicConnect processes the data on the clinic's behalf as its Data Processor, only on its instructions.
- Clinics and visitors to this website: Marketing Thrive is responsible for the data of clinic staff who use our dashboard and of people who contact us through this website.
2. What we collect
| From | What |
|---|---|
| Patients (WhatsApp) | Name, phone number, the messages you send, appointment requests and details, your choice about reminders (including STOP). |
| Patients (phone calls to a clinic's AI receptionist) | Your phone number, the call's audio as processed to understand it, a transcript or summary, call length, and any appointment booked. |
| Patients (at the clinic) | What the front desk records: visits, invoices and payment method, recall dates. |
| Clinic staff | Name, email, role, sign-in details, and the actions taken in the dashboard (including who approved social media posts). |
| Clinics | Clinic details, doctors' names, qualifications and registration numbers, schedules, photos and logos the clinic uploads, subscription and payment records. |
| Facebook and Instagram (when a clinic connects them) | The clinic's Facebook Page ID, its linked Instagram professional account ID, and access tokens that let us publish posts the clinic has approved. We do not read private messages, followers' personal profiles, or any personal data of people who interact with the Page. |
| Google (when a clinic connects them) | Public details of the clinic's Google Business Profile, used for the profile audit and to publish the clinic's approved posts. |
We do not intentionally collect information about health conditions beyond what a patient chooses to write to the clinic. Our AI does not give medical advice and is designed to pass medical questions to the clinic's team.
3. Why we use it
- To answer enquiries, check doctors' availability, book, confirm, remind, reschedule and cancel appointments.
- To send messages a patient has agreed to (reminders, recall reminders, review requests, a follow-up after a missed call), and to stop them when the patient replies STOP.
- To run the clinic's front desk, invoices and reports.
- To create, check against Indian medical advertising rules, and publish the clinic's social media posts only after the clinic approves them.
- To bill clinics for their subscription, keep the service secure, fix problems and meet legal obligations.
We do not sell personal data, use it for advertising, or use patients' data to train AI models.
4. Who we share it with
Only the service providers needed to run ClinicConnect, each bound to use the data only to provide their service:
| Provider | What for |
|---|---|
| Supabase | Database, sign-in and file storage |
| Cloudflare | Hosting this website and the dashboard |
| Meta (WhatsApp, Facebook, Instagram) and RichAutomate | Sending and receiving WhatsApp messages; publishing approved posts |
| Bolna and Plivo | Phone calls to the AI receptionist |
| OpenAI | Understanding messages and drafting replies and social media content |
| Razorpay | Payments (we never see or store card numbers) |
| Business Profile audit and publishing approved posts | |
| Shotstack | Turning approved content into short videos |
| Resend | Service emails |
Some of these providers may process data outside India. We use reputable providers with security commitments and share only what each needs. We may also disclose data if the law requires it.
5. How long we keep it
- Patient records are kept for the period the clinic sets, and removed when the clinic or patient asks for erasure (see section 7).
- Messages and call logs are kept only as long as the clinic needs them for care and its records.
- When a clinic disconnects Facebook, Instagram or Google, or stops using ClinicConnect, we delete its access tokens immediately and its other data within 30 days, unless the law requires us to keep it longer.
6. How we protect it
Data is encrypted in transit, access is limited to people and systems that need it, each clinic can see only its own data, secret keys are kept on the server and never in the browser, and actions are logged.
7. Your rights, and how to delete your data
You can ask to see, correct, or delete your personal data, withdraw consent, or name someone to act for you.
- Patients: you can also ask your clinic directly; they can erase your record in ClinicConnect. Reply STOP on WhatsApp at any time to stop messages.
- Facebook / Instagram: a clinic can remove ClinicConnect's access at any time in Facebook (Settings → Business integrations) or by removing our business's access to its Page. Email us as above and we delete everything we hold from Facebook and Instagram — the Page and account IDs, access tokens and records of published posts — within 30 days.
8. Children
ClinicConnect is a service for clinics, not for children. A child's appointment should be made by a parent or guardian, who provides any consent needed.
9. Cookies and browser storage
This website does not use advertising cookies. The clinic dashboard stores a sign-in session in your browser so you stay signed in.
10. Grievances and contact
Grievance Officer: Kishor Kakati, Marketing Thrive, Guwahati, Assam, India · clinicconnect.info@gmail.com. We reply within 7 days. If you are not satisfied, you may complain to the Data Protection Board of India.
11. Changes
If we change this policy we will update the date at the top, and tell clinics in advance of any important change.