Privacy Policy
- PLUS is software that dental clinics use to run their practice. A clinic puts its patients' records into PLUS. The clinic decides what to record and who on its team can see it.
- Each clinic's records are kept separate from every other clinic's. We do not sell personal information and we do not show advertising.
- Clinics can download their data at any time, and ask us to delete it.
1. Who we are
PLUS is run from GF-105 P, Sector 28, Gurugram, Haryana 122002, India. In this policy, "we" and "us" mean PLUS. You can reach us at [email protected] or on +91 84475 54137.
2. Two kinds of people, two roles
Clinic owners and their staff use PLUS. For their account information, we decide how it is used, as described in this policy.
Patients do not use PLUS. Their information is entered by the clinic that treats them. For that information the clinic decides what is collected and why, and we store and process it on the clinic's behalf, following the clinic's instructions and this policy. A patient who wants to see, correct or delete their record should ask their clinic. If you write to us instead, we will pass your request to the clinic.
In the language of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the clinic is the "Data Fiduciary" for its patients' information and PLUS is a "Data Processor" acting for it. For clinic and staff account information, PLUS is the Data Fiduciary. Section 9 explains what this means.
3. What information is held
| Whose | What |
|---|---|
| Clinic and staff accounts | Clinic name, address and contact details, logo; each person's name, email, mobile number, role and sign-in details; doctor details such as speciality and registration number; attendance times; pictures or photos people choose to add; reports of problems they send us. |
| Patients (entered by the clinic) | Name, date of birth, gender, contact details and address; medical history and allergies; examination findings, tooth charts, diagnoses, treatment plans and clinical notes; prescriptions; X-rays, photographs and documents; consent forms and signatures; appointments; bills and payments; and, if the clinic records them, an ABHA number and address. |
| Everyone using the app | Technical information needed to run the service, such as the device and browser type, and error reports when a screen fails. |
Much of a patient's record is sensitive health information. We treat all of it that way.
4. How it is used
- To provide PLUS: store the records, show them to the people the clinic has allowed, produce bills, reports, messages and printouts, and keep the service working.
- To send the clinic emails about its account: confirming an email address, staff invitations, subscription and demo notices, and reports a clinic asks to send.
- To give support, fix problems and keep the service safe.
- To meet legal duties.
We do not use patient records for advertising, and we do not sell or rent personal information.
5. Who else handles the information
We use other companies to run parts of the service. They handle information only to provide that service.
| Service | What it does for PLUS | Where it is processed |
|---|---|---|
| Supabase | Database, sign-in and file storage | South Asia (Mumbai), India |
| Cloudflare | Hosting and delivering the website and app | Cloudflare's network, which serves pages from servers near the visitor, in India and elsewhere. Patient records are not stored by Cloudflare. |
| Resend | Sending emails from the service | Tokyo, Japan |
| Anthropic (AI service) | Optional AI-assisted features. Only when a staff member uses one, the information needed for that action is sent: for example a photo of a paper registration form so it can be read, dictated findings, or details used to write a summary or a message. The AI's output is a suggestion for the clinic to check. | Anthropic's servers, in the United States or other countries. Not stored in India. |
| Meta (WhatsApp) | Only for clinics that switch on automatic messages such as birthday wishes. The message and the phone number are sent to WhatsApp for delivery. Other WhatsApp buttons in the app open your own WhatsApp with a message ready; they do not send anything through us. | Meta's systems, which may be outside India. |
| Only for clinics that connect their Google Business Profile, to read and reply to reviews and publish posts. | Google's systems, which may be outside India. |
The providers above are our only sub-processors. If we add or replace one that handles patient records, we will update this table and tell clinic owners before it takes effect. Each is bound by its own terms to protect the information it handles.
We may also disclose information when the law requires it, for example to a court or authority, or to protect people's safety.
6. Where it is kept and how it is protected
- The database and files are held with Supabase, in Mumbai, India. Other providers listed in section 5 may process limited information in India or in other countries, as the last column of that table says.
- Information is encrypted while stored with our cloud provider.
- It travels over encrypted connections.
- Access is by sign-in. Each clinic can only reach its own records, and within a clinic the Admin chooses what each role can see and do. Changes to clinical records are kept in an audit history.
- We take a backup of the whole database every night. Each backup is locked with strong encryption (AES-256) before it is saved, using a passphrase held only by us, and is checked to make sure it opens. Backups are kept for 30 days.
No system is completely secure. If we learn of a breach that affects personal information, we will tell the affected clinics and the authorities as the law requires.
7. How long it is kept
- A clinic's records stay for as long as the clinic keeps its account. Items deleted inside the app are kept for 60 days so they can be restored, then removed.
- A demo account that is not subscribed within 14 days of starting is deleted with its data.
- If a clinic ends its subscription, or asks us to delete its data, we delete it from the live system within 30 days, unless the law requires us to keep something. Copies in the nightly backups are removed as those backups expire, at most 30 days later. Clinics may also have their own duty to keep patient records for a period, so they should download a copy first. This is done from Settings, Export all clinic data.
8. Your choices and rights
- Clinics: download all your data as an Excel file at any time, correct or delete records in the app, and ask us to close your account and delete your data.
- Staff: you can ask us to see or correct your account details.
- Patients: to see, correct or delete your record, or to withdraw a consent you gave, ask your clinic. Where the law gives you more rights, such as the right to complain, you keep them.
To make a request or raise a concern, write to us at the email above or at the address in section 1, marked "Grievance". We will reply within a reasonable time and in any case within the time the law sets.
9. India's data protection law (DPDP Act, 2023)
We handle personal information in line with the DPDP Act and the rules made under it, as they come into force. In practice:
- Roles. For patients' information the clinic is the Data Fiduciary and we are its Data Processor. We act only on the clinic's instructions and this policy, and we do not use patients' records for our own purposes.
- Notice and consent. The clinic tells its patients what is collected and why, and gets their consent where the law requires it. PLUS includes consent forms and a record of who consented and when. Patients' records are not passed to anyone outside the clinic except through the providers in section 5, or when the clinic itself chooses to share them (for example by printing or sending a report).
- Only what is needed. Information is kept for the purposes in section 4 and for the periods in section 7, then deleted.
- Security. We use the safeguards in section 6. If a breach affects personal information, we will tell the clinics concerned without delay, so they can inform patients and the Data Protection Board of India as the Act requires, and we will help them do so.
- Rights of patients and staff. You may ask to know what information is held about you, to have it corrected or completed, to have it erased, to complain, and to name another person to exercise these rights for you if you die or cannot act. Patients make these requests to their clinic, and we help the clinic carry them out. Staff can write to us.
- Children. See section 10.
- Information leaving India. Some providers in section 5 may process information outside India. We do not send information to any country the Government of India has restricted.
- Grievance officer. Ashish, Technical Team, reachable at the email and address in section 12, marked "Grievance". If we do not resolve your concern, you may complain to the Data Protection Board of India.
10. Children
PLUS is for clinics, not for children. A clinic may record information about patients who are children. The clinic is responsible for getting the permission of a parent or guardian where the law requires it.
11. Changes to this policy
If we change this policy in a way that matters, we will update the date at the top and tell clinic owners by email or in the app.
12. Contact
PLUS, GF-105 P, Sector 28, Gurugram, Haryana 122002, India
Email: [email protected]
Phone and WhatsApp: +91 84475 54137