Privacy Policy

Clinixo is clinic-management software used by dental and medical clinics in India. Clinics use it to manage appointments, clinical records, prescriptions, billing and patient communication.

The clinic, not Clinixo, decides what patient data is collected and why. Under India's Digital Personal Data Protection Act, 2023, the clinic is the Data Fiduciary and Clinixo acts as a Data Processor on the clinic's instructions. If you are a patient, your clinic is your first point of contact for any request about your records.

Each category below is collected for the stated purpose only. Using it for anything else requires fresh consent.

• Patient details — name, phone, age, gender, date of birth, address, email, and the clinic's own chart or file number. Purpose: identifying you and contacting you about your care.
• Clinical records — consultation notes, diagnoses, prescriptions, treatment plans, dental charts, investigations and uploaded documents or images.
• Billing records — invoices, payments, discounts and refunds. Purpose: charging for treatment and keeping accounts.
• Clinic staff accounts — name, email, phone, role and sign-in activity. Purpose: controlling who can see patient data.
• Operational logs — an audit record of who accessed or changed sensitive data, kept so clinics can investigate misuse.

If your clinic has WhatsApp switched on, it can send you messages about your care from a Clinixo-operated WhatsApp business number. These are the only messages the system sends, and this is what each one contains.

• Registration — your name, the clinic name and the date.
• Appointment booked, moved or cancelled — your name, the doctor's name, the date and time, and the clinic's name and contact details.
• Appointment reminder — the same details, usually a day before and again shortly before the visit.
• After a consultation — your name, the doctor's name, the clinic name, the date of the visit and your next visit date. See the setting below.
• Payment reminder, if clinic staff send one — your name, the clinic name and the amount outstanding. No bill numbers and no treatment names.

Your clinic can choose to include clinical details in the after-visit message. This setting is off unless the clinic turns it on, and only the clinic's owner or admin can turn it on. When it is on, that message also contains your diagnosis (including which tooth, where one is recorded), the medicines prescribed with their dose and duration, and the advice your doctor recorded for you.

• The setting applies to the whole clinic, not to you individually. If you do not want your diagnosis or medicines sent over WhatsApp, tell your clinic — they can switch the setting off, or switch WhatsApp off for you.
• Long text is shortened before sending, so the message may not contain everything your doctor recorded. It is a convenience copy, not your medical record.
• No other WhatsApp message contains clinical information.

Files are not sent over WhatsApp. As of 23 August 2026, Clinixo sends text messages only — no prescription PDF, no bill, no lab report, no scan and no photograph. If that changes, this policy will be updated before it starts. Clinic staff can of course hand you or share a printed document themselves; that is the clinic's own action, not a message sent by Clinixo.

About WhatsApp itself. Messages are delivered through Meta's WhatsApp Cloud API, so Meta processes them under its own terms. A message arrives on the handset registered to the number your clinic holds for you — anyone with access to that phone can read it, and shared family numbers are common. Tell your clinic if your number changes, or if you would rather not receive messages at all; your preference is recorded and stops further WhatsApp messages from that clinic. Your treatment is unaffected either way.

Consent is recorded per purpose — for example WhatsApp notifications, treatment consent, or use of an AI assistant during a consultation — together with when it was given and by whom. Consent can be withdrawn, and withdrawal is recorded rather than overwriting the earlier record, so the history stays auditable.

• Transmitted over encrypted connections (HTTPS).
• Uploaded documents are held in private storage and served only through short-lived signed links, never public URLs.
• Each clinic's data is separated, and staff see only what their role allows.
• Access to sensitive records is logged, with personal details redacted from the logs themselves.

No system is perfectly secure. We do not claim otherwise, and clinics remain responsible for who they grant access to.

Clinical and billing records are retained for as long as the clinic needs them, which is generally governed by medical record-keeping obligations. Audit logs are removed automatically after their retention period. A clinic can request deletion of its data when it stops using Clinixo.

Under the Digital Personal Data Protection Act, 2023 you have the following rights over your personal data:

• Access — a summary of the personal data being processed about you and what it is being used for.
• Correction and completion — have inaccurate data corrected, incomplete data completed, and outdated data updated.
• Erasure — have your data deleted, unless it must be kept to comply with a law (see the limit below).
• Withdraw consent — at any time, as easily as it was given. See the next section.
• Grievance redressal — raise a complaint with us about how your data was handled, and get an answer.
• Nominate — name another person to exercise these rights on your behalf if you die or become unable to do so.

Because your clinic holds your medical record and decides what happens to it, contact the clinic first — they can action most requests directly. If you cannot reach them, or you are not satisfied, write to us at helpdesk@getclinixo.in. We will acknowledge your request and respond within 30 days.

The one limit on erasure. Clinics are required by law to keep certain medical and financial records for a set period. Where that applies, the record cannot be deleted on request until the period ends — we will tell you which records those are and why.

Withdrawal is as easy as consent was. Each of these works on its own:

• WhatsApp messages — tell your clinic you do not want them. They can switch messages off for you, or for the whole clinic. Messages stop; your treatment is unaffected.
• Any other consent — ask your clinic to withdraw it. Every consent is recorded per purpose and can be withdrawn on its own, without withdrawing the others.
• If the clinic cannot be reached — email helpdesk@getclinixo.in and we will pass it on and record it.

Withdrawing consent stops future processing for that purpose. It does not undo what was lawfully done beforehand, and it does not delete a medical record the clinic is required to keep.

For a patient under 18, consent is given by a parent or guardian, and the guardian's name is recorded with it. Clinixo does not track children, does not profile them, and shows no advertising to anyone. Where an age is unknown, the system refuses to assume the patient is an adult and asks for it.

If you are unhappy with how your data has been handled, contact our Grievance Officer:

Nikhil Sharma
Clinixo Healthcare Technologies Private Limited
648/A, 4th Floor, Binnamangala 1st Stage, Indiranagar, Bangalore, Karnataka, India — 560038
helpdesk@getclinixo.in

We will acknowledge your complaint and respond within 30 days. If you remain dissatisfied, you may complain to the Data Protection Board of India, which is the statutory body for such complaints under the Digital Personal Data Protection Act, 2023. You are expected to raise the matter with us first.

Clinixo relies on service providers to run the product: cloud hosting and database, object storage for uploaded documents, and Meta's WhatsApp Cloud API for notifications. They process data only on our instructions and only to provide those services.

We do not sell your data. We do not share it with advertisers, data brokers or insurers, and we do not use patient data to train AI models. Data is disclosed outside the clinic only where the law requires it.

Where data is stored. Data is held on infrastructure in India. Where a provider processes data outside India, that transfer is made only to countries not restricted by the Central Government under the Digital Personal Data Protection Act, 2023.

If a breach affects your personal data, we will notify the affected clinics and, where required, the affected individuals and the Data Protection Board of India, within the timelines the law sets.

If this policy changes materially, the date above is updated and clinics are notified.

Clinixo Healthcare Technologies Private Limited (“Clinixo”) is the Data Fiduciary for the account data described above, and the Data Processor acting for each clinic in respect of its patient records.
648/A, 4th Floor, Binnamangala 1st Stage, Indiranagar, Bangalore, Karnataka, India — 560038
helpdesk@getclinixo.in