Privacy Policy
This policy explains how Insightics Dental CRM handles information in its sales website, manual clinic onboarding, hosted clinic workspace, support process and centralized communication features. Each subscribed clinic remains responsible for its patient relationship, patient-facing notice and authorized use of patient information.
1. Scope and current operating model
This policy applies to visitors of the Insightics Dental CRM website, clinic owners and authorized users manually onboarded by Insightics, and support interactions related to the product.
Insightics currently uses a manual onboarding model. The Insightics Super Admin creates the clinic tenant, creates or authorizes users, assigns the selected plan and enables access. Public self-service signup, automatic tenant provisioning and automatic subscription renewal are not part of the current production model.
2. Insightics and dental-clinic responsibilities
The clinic determines why patient information is collected and used for appointments, treatment, prescriptions, billing, follow-ups and clinic operations. The clinic is responsible for patient-facing notice, appropriate communication choices, data accuracy and authorized-user access.
Insightics provides the CRM software, hosting-related processing, tenant isolation, access controls, plan enforcement, technical support and agreed communication infrastructure. Insightics does not provide dental treatment and does not replace the clinic-patient relationship.
The precise legal roles and instructions should be recorded in the signed Customer Agreement or Data Processing Agreement according to the actual commercial arrangement.
3. Dental clinic and patient notice
Each clinic should display a clear patient privacy notice at reception or another visible place. The notice should explain that the clinic uses Insightics Dental CRM for clinic operations and that appointment or follow-up reminders may be delivered through an Insightics-operated communication number on behalf of the clinic.
A reception notice supports transparency, but the clinic remains responsible for handling patient questions, corrections and requests to stop reminders.
4. Information we may process
Website, sales and onboarding
- Name, clinic name, phone, email, enquiry, selected plan and onboarding details.
- Payment reference, subscription validity and authorized signatory information where recorded.
- Technical/security logs generated by the application or hosting environment.
Clinic and authorized users
- Clinic profile, address, logo, contact and registration details.
- User name, email, phone, role, login/security records and helpdesk history.
Patient and clinic operational records
- Patient name, contact information, age and clinic notes.
- Appointments, visits, treatments, prescriptions and follow-up information.
- Invoices, payments, medicine items and inventory movements.
- Uploaded clinic or patient documents where an upload feature is used.
- Reminder history, audit/security records and technical error logs.
Data minimization: Clinics should avoid entering unrelated government identifiers, financial credentials or information not required for the clinic workflow.
5. How information is used
- To provide and operate the clinic-management workspace.
- To manage patients, appointments, treatments, billing, inventory, reports and follow-ups.
- To configure plans and enforce patient, user and message limits.
- To deliver clinic-service communications where enabled and instructed.
- To maintain authentication, tenant isolation, troubleshooting, audit, security and error records.
- To process onboarding, support, renewal, cancellation and offboarding.
- To meet contractual, legal, security and dispute-resolution needs.
Insightics does not claim ownership of clinic patient records. Software, code, design and platform intellectual property remain subject to the applicable Insightics agreement.
6. Centralized WhatsApp reminder service
- The clinic is responsible for providing the patient's correct mobile number, appropriate notice and communication preference.
- Messages should be limited to authorized clinic-service purposes such as appointments and follow-ups.
- Operational reminders and promotional marketing should be treated as separate purposes.
- A patient may ask the clinic to stop reminders; the clinic should promptly notify Insightics or use the available clinic process to suppress future messages.
- Message submission, failure and usage records may be stored for operations, limits, security and troubleshooting.
- Meta/WhatsApp and other communications providers may process message-related information under their applicable terms.
Default message transparency
Default reminders should clearly name the clinic and may state that the message was sent through Insightics Dental CRM on behalf of the clinic. Messages should avoid unnecessary treatment details that could appear in notification previews.
7. Sharing and service providers
Information may be made available only as reasonably required to the clinic's authorized users, authorized Insightics personnel, hosting/email/messaging providers used to operate the service, and authorities or professional advisers where required or permitted by applicable law or contract. Insightics does not sell patient records as a data-broker product.
8. Security safeguards
Current safeguards include tenant-scoped access, role authorization, secure session cookies, session-ID rotation, login rate limiting, CSRF protection on tested write actions, file-type and file-size checks, audit/error records and protected helpdesk workflows. No online service can be guaranteed to be completely risk-free.
Clinics must protect credentials, avoid password sharing, remove departed staff access promptly and report suspected misuse.
9. Retention and deletion
Retention depends on the record category, clinic instructions, subscription status, contractual requirements, dispute/security needs and applicable legal obligations. The clinic should define its clinical and billing retention policy.
- Active tenant data may be retained while the service relationship continues.
- Premium tenant Audit Log visibility is limited to the last 60 days under current product rules. That visibility rule is separate from authorized backend preservation for security or administrative purposes.
- After termination, export, live-data deletion and backup treatment follow the signed agreement and operational process.
Open operational control: Backup restore verification and automatic-backup confirmation remain part of the wider operational control program.
10. Access, correction, erasure and communication choices
Patients should normally contact their clinic first because the clinic controls the patient relationship and can verify the relevant record. Insightics will assist the clinic according to the signed agreement and applicable law.
- Request access to relevant personal information.
- Request correction of inaccurate or incomplete information.
- Request erasure where applicable, subject to clinical, billing, legal, security or contractual retention needs.
- Raise a grievance or ask about processing.
- Ask the clinic to stop appointment or follow-up reminders.
Requests must be verified to reduce unauthorized disclosure or alteration.
11. Children and guardian-managed records
Dental clinics may treat minors. The clinic is responsible for applying an appropriate parent or lawful-guardian process and for determining required notice or consent before entering or using a minor's information. Insightics does not independently verify a guardian relationship unless specifically agreed.
12. Security incidents
Suspected unauthorized access, disclosure, alteration, destruction or loss of access should be reported promptly. Insightics may preserve logs, contain access, rotate credentials, investigate the affected tenant or system, coordinate with the clinic and take remediation steps. Notification obligations should be evaluated with qualified legal advice based on the incident and applicable law.
13. Changes to this policy
Insightics may update this policy when the product, consent facilities, onboarding model, service providers, commercial terms or legal requirements change. The effective date should be updated and material changes communicated through an appropriate channel.
14. Contact and grievance channel
For a patient request, include the clinic name and enough information for the clinic to verify the request. Do not send passwords, OTPs or unnecessary medical details by email or WhatsApp.
Legal reference and review
This policy supports the current manual onboarding and centralized reminder model. The Digital Personal Data Protection Act, 2023 includes subjects covering notice, consent, general obligations, access, correction/erasure and grievance redressal. The Ministry of Electronics and Information Technology has published the Digital Personal Data Protection Rules, 2025 and related enforcement materials.
Legal review recommended: A qualified Indian lawyer should review this policy, the Customer Agreement, Data Processing Agreement, retention/deletion practices, refund/cancellation terms and clinic patient notice before public-scale launch.