Data Processing terms

What we do with your patients' data

• We process it only to provide CareClinic to you, on your instructions as set in the app (for example the messages you switch on).
• We don't use it for our own purposes, don't sell it, and don't contact your patients except the messages your account sends.

Your duties as the data fiduciary

• Give patients a notice of what you collect and why, and get consent where the law needs it. CareClinic helps: consent forms, message preferences with a log, and marketing off by default.
• Answer patients' requests to see, correct or erase their data. Medical, tax and drug records may have to be kept for the periods the law sets.

How we protect it

• Each business's records are separated, and every request is checked against the signed-in person's business and permissions.
• Encryption in transit and at rest; secrets such as WhatsApp and Razorpay keys sealed separately; an audit log of who did what.
• Only staff who need to, for support you asked for or that the law requires, can see records; they are bound to confidentiality.

Sub-processors

Google Cloud (hosting), Razorpay (payments), Meta WhatsApp Business (messages), our SMS gateway and our email provider. We tell you 30 days before adding one.

Breaches

If your patients' data is breached we tell you without undue delay, with what we know, so you can inform the Board and the patients; we help you do it.

When the agreement ends

You can export everything at any time. After the account closes we keep the data 90 days for your export, then delete it, keeping only what the law requires.

Grievance officer: Srikanth, help@careclinic.com. We acknowledge complaints within 48 hours and resolve them within 30 days.