Privacy policy

This platform

Clinic desk is a WhatsApp messaging platform for skin and hair clinics, operated by Chikuclinicos HQ. Clinics use it to send appointment messages to patients on WhatsApp. This policy explains what personal data the platform stores, why it is stored, and how to ask for it to be deleted.

Clinic and platform roles

The clinic decides why patient data is used. The clinic is the data controller, and the Data Fiduciary under the Digital Personal Data Protection Act, 2023. Chikuclinicos HQ processes that data only to run Clinic desk. We are the data processor, and the Data Processor under that Act. We do not decide which patients a clinic messages.

What we store

For each clinic that uses the desk, the platform stores:

• Clinic staff accounts: name, work email, and a password hash.
• Patient name and WhatsApp number.
• Appointment times.
• Message logs: the text that was sent or received, and whether it was delivered.
• The clinic's WhatsApp Business connection, including an access token.

Clinic desk does not store clinical notes, diagnoses, photographs, or other medical records. We do not sell personal data, and we do not share it for advertising.

Why we store it

Staff accounts let the clinic sign in. Patient names, WhatsApp numbers, and appointment times let the clinic send the reminders and related messages it has chosen. Message logs show staff whether a message was sent, delivered, or needs a person to reply. The WhatsApp access token lets the platform send those messages from the clinic's own WhatsApp Business number.

How it is protected

WhatsApp access tokens are encrypted at rest. Patient WhatsApp numbers are encrypted at rest. Staff passwords are stored only as a hash. Access to the desk is limited to staff the clinic has signed in.

WhatsApp and Meta

Messages are delivered through the WhatsApp Business Cloud API. Meta receives what is needed to deliver the message, under WhatsApp's own terms and the WhatsApp Business Policy. A clinic may message a patient only when that person has opted in. See the terms of service.

How long we keep it

We keep a clinic's data while that clinic uses Clinic desk, so staff can see upcoming visits and past messages. When a clinic leaves, or when a clinic or patient asks for deletion, we delete the data covered by that request within 30 days. The data deletion page explains how to ask.

Rights under the DPDP Act

The Digital Personal Data Protection Act, 2023 gives a person the right to ask for access, correction, and erasure of their personal data, and to raise a grievance. Patients should contact their clinic first, because the clinic is the Data Fiduciary. They may also email us, and we will act with the clinic. Clinic staff may email us about their own account.

Data deletion

A clinic, or a patient of that clinic, can ask Chikuclinicos HQ to delete personal data we hold for Clinic desk. Email siddharth.mishra@outlook.com and say whether the request is for one person or the whole clinic. We complete a confirmed request within 30 days.

The data deletion page explains what is removed, and what may remain in WhatsApp.

Contact

Chikuclinicos HQ, operator of Clinic desk. Email siddharth.mishra@outlook.com.