Privacy policy
Last updated 5 November 2026
OPD Sathi is software that dental clinics use to manage appointments, patient records and payments. This policy explains what personal data the service handles, why, and the choices you have.
Who is responsible for what
For clinic accounts (the clinic owner and staff who sign up and log in), we decide how that data is used, so we are the data fiduciary under the Digital Personal Data Protection Act, 2023.
For patient records that a clinic enters, the clinic is the data fiduciary and we process that data only on the clinic’s instructions, to provide the service. Patients should contact their clinic first about their records; we will help the clinic respond.
What we collect
- Clinic account details: names, email addresses, mobile numbers, role in the clinic, clinic name and city.
- Patient data entered by the clinic: name, phone, age or date of birth, gender, medical alerts, treatment notes, appointments, prescriptions, X-rays and photos, and payment records.
- Usage records: sign-in times and an audit log of changes made inside each clinic, so clinics can see who changed what.
How we use it
- To run the service: store records, show them to authorised staff, book appointments and calculate dues.
- To send messages the clinic asks for, such as appointment confirmations on WhatsApp, when the clinic turns this on.
- To keep the service secure, prevent misuse and fix problems.
- To contact clinic owners about their account, trial and billing.
We do not sell personal data, and we do not use patient data for advertising.
Who can see it
Each clinic’s data is kept separate. Inside a clinic, staff see what their role allows. Our team accesses clinic data only when needed to support the clinic or keep the service running.
We use these service providers to run OPD Sathi: Google Cloud / Firebase for hosting, database, file storage and sign-in; Meta’s WhatsApp Business Platform for messages, if the clinic enables them; and Razorpay for payments, when billing is enabled.
Where it is stored
The database that holds clinic and patient records is in Google Cloud’s Delhi region (India). Uploaded files such as X-rays and photos are currently stored with Google Cloud in the United States. Data is encrypted in transit and at rest.
How long we keep it
We keep a clinic’s data while its account is active. If a clinic closes its account, we delete its data within 90 days, unless the law requires us to keep some records longer. Clinics are responsible for retaining patient records for as long as medical regulations require them to, and can ask us for an export before closing.
Your rights
You can ask to access, correct or erase your personal data, and you can withdraw consent where processing is based on it. Clinic staff can update most details inside the app. For anything else, or to raise a grievance, email pareshgoel123@gmail.com. We will respond within 30 days. You may also approach the Data Protection Board of India.
Changes
If we make significant changes, we will tell clinic owners by email or in the app before they take effect.