Privacy policy

1. Who we are

"DentoBlaze", "we" and "us" mean [legal name of the entity], a [type of entity] registered in India with its office at [registered address]. We provide the DentoBlaze clinic management software at app.dentoblaze.com (the "Service") and this website, dentoblaze.com.

2. Our two roles under the DPDP Act

The DPDP Act separates the business that decides why and how personal data is used from the business that processes it on its behalf. We play a different role for different data:

If you are a patient of a clinic that uses DentoBlaze, the clinic is responsible for your data. Please send requests about your records (access, correction, erasure, consent) to your clinic. We help clinics answer them, and if you write to us we will pass your request to the clinic.

3. Data we process for clinics

Depending on how a clinic uses DentoBlaze, it may store:

• Patient details: name, age or date of birth, gender, mobile number, address, preferred language, patient number, photographs and files the clinic uploads.
• Health information: medical history, chief complaints, findings, investigations, diagnoses, tooth charts, treatment plans, prescriptions and lab orders.
• Appointments and payments: visits, bills, receipts, EMI plans and payment records. Patients pay the clinic directly (for example to the clinic's UPI ID); DentoBlaze does not receive or hold patients' money or card details.
• Consent records: when and how a patient agreed to receive messages, and any withdrawal.
• Inquiries and camp registrations: names, numbers and interests of people who contacted the clinic or attended a dental camp.

We process this data only to provide the Service to the clinic, as set out in our Terms of service. We do not sell it, use it for advertising, or use it for any purpose of our own. Our staff access it only when needed to provide support the clinic has asked for, to keep the Service secure, or when the law requires it.

4. Data we are responsible for

• Account data: the name, email address and role of each clinic owner and staff member, the clinic's name, address, GSTIN and contact details, and sign-in records (time, device and browser type, IP address).
• Billing data: details needed to invoice the clinic for the Service [once paid plans start].
• Support messages: what you send us by email or through the contact form, and our replies.
• Website and security logs: our hosting provider processes IP addresses and request details to deliver pages and protect against abuse. This website does not use analytics or advertising trackers.

5. Why we use the data we control

• To create and secure accounts, including sending one-time sign-in codes by email.
• To provide, maintain and improve the Service, and to fix problems.
• To answer support requests and send important notices about the Service (not marketing).
• To invoice clinics and keep the records that tax and other laws require.
• To detect and prevent fraud, abuse and security incidents.

We rely on your consent or on a legitimate use permitted by Section 7 of the DPDP Act, such as data you provide voluntarily for a specific purpose, or compliance with law. Where we rely on consent you can withdraw it at any time by writing to support@dentoblaze.com; this does not affect processing that already took place. We will only send marketing emails if you have opted in, and every such email will let you opt out.

6. Sub-processors

We use a small number of service providers to run DentoBlaze. Each is bound by a contract that requires it to protect the data and use it only to provide its service to us.

When automatic WhatsApp messaging becomes available, messages will be sent through the clinic's own WhatsApp Business account, and we will add the provider to this list first. We will give clinics at least [30 days'] notice of any new sub-processor that handles clinic data. We may also disclose data where the law requires it, for example to comply with a lawful order of a court or government authority.

7. Where data is stored

Clinic data is stored in India, in a data centre in Mumbai. Some services, such as content delivery and email, may process data briefly outside India. Any transfer outside India is made only as permitted by Section 16 of the DPDP Act and never to a country the Government of India has restricted.

8. How we protect data

• Encryption in transit (HTTPS) everywhere, and encryption at rest by our database provider.
• Each clinic's data is kept separate by database-level access rules, so one clinic can never read another's records.
• Role-based access inside each clinic (owner, doctor, receptionist), so staff see only what their job needs.
• Sign-in with one-time email codes, no shared passwords, and sessions that expire.
• An audit trail of important changes inside each clinic.
• Backups [confirm frequency], access to production systems limited to the people who need it, and logs kept for [at least one year] to detect and investigate incidents.

No system is perfectly secure, but we take the reasonable security safeguards that Section 8(5) of the DPDP Act requires.

9. Personal data breaches

If we become aware of a breach affecting clinic data, we will tell the affected clinic without undue delay and in any case within [24 hours], with what we know about its nature, extent and likely impact and the steps we are taking. As Data Fiduciary the clinic informs the Data Protection Board of India and affected patients; we will give the clinic the information and help it needs to do so. For data we control, we will inform the Board and the affected people ourselves, as the DPDP Act and Rules require.

10. Retention and deletion

• Clinic data is kept for as long as the clinic's account is active, or until the clinic deletes it.
• Clinics can export their data at any time. When an account is closed, the clinic has [30 days] to export it, after which we delete it from our live systems; copies in backups are deleted within [a further 30 days].
• Clinics remain responsible for keeping clinical records for as long as the law and their professional regulations require, and should export them before closing their account.
• Account and billing records we control are kept while the account is active and afterwards for as long as tax and other laws require.

11. Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data processed about you and how it is processed;
• have your data corrected, completed, updated or erased;
• withdraw consent you have given;
• have your grievances addressed; and
• nominate someone to exercise your rights if you die or become unable to do so.

For patient records, contact your clinic. For data we control, email support@dentoblaze.com with "Privacy" in the subject. We may need to confirm your identity before acting on a request. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

12. Children

Clinics treat children, so DentoBlaze may hold children's health records. The clinic, as Data Fiduciary, is responsible for obtaining verifiable consent from a parent or lawful guardian where the DPDP Act and Rules require it, subject to any exemption that applies to healthcare providers. DentoBlaze does not track children's behaviour or show anyone targeted advertising. Our own website and accounts are meant for adults and are not directed at children.

13. Cookies and browser storage

• This website does not set advertising or analytics cookies. It remembers your light or dark theme choice in your browser's local storage. Our hosting provider may set strictly necessary security cookies.
• The DentoBlaze app uses strictly necessary cookies to keep you signed in, and local storage to remember your preferences and load faster. These are needed for the app to work and are not used for tracking.

14. Grievance officer and contact

For questions or complaints about personal data, contact our grievance officer, [name], at support@dentoblaze.com (subject: "Privacy"), or write to [registered address]. We will acknowledge your message promptly and respond within [30 days], and in any case within the time the DPDP Rules allow.

15. Changes to this policy

We may update this policy as DentoBlaze or the law changes. We will post the new version here with a new date, and tell clinic owners by email before any change that affects how clinic data is processed takes effect.