1. Introduction & Who We Are
This Privacy Policy explains how Clinitto ("Clinitto", "we", "us", or "our"), operated by Magicraft Solutions, collects, protects, processes, and handles personal data when you visit our website (clinitto.com), subscribe to our Software-as-a-Service (SaaS) Clinic ERP and Electronic Health Record (EHR) platform, or access our mobile applications (iOS and Android).
We believe that clinical software must treat patient confidentiality as an unyielding obligation, not an afterthought. This policy outlines our commitments under the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the Digital Information Security in Healthcare Act (DISHA) guidelines, the Health Insurance Portability and Accountability Act (HIPAA, United States), and the General Data Protection Regulation (GDPR, European Union & UK).
2. Dual Legal Capacity: Fiduciary vs Processor
Healthcare software requires a clear, legally distinct boundary between who controls the data and who processes it on behalf of another entity. Clinitto operates in two separate legal capacities:
A. Clinitto as a Data Fiduciary / Controller
When you browse our public marketing website, register for early beta access, subscribe to a paid clinic tier, or interact with our customer support, Clinitto acts as a Data Fiduciary (under the DPDP Act) and Data Controller (under GDPR). We determine the purposes and means of processing your clinic account registration, billing credentials, and administrative contact details.
B. Clinitto as a Data Processor / Intermediary / Business Associate
When a subscribing clinic, doctor, or authorized medical staff member enters, uploads, or stores Patient Health Information (PHI) — including consultation clinical notes, diagnosis, prescriptions, before/after clinical photographs, treatment package records, and patient invoices — Clinitto acts strictly as a Data Processor, Data Intermediary, and Business Associate. The subscribing Clinic or Healthcare Provider remains the sole Data Fiduciary and Covered Entity. We process patient health records exclusively pursuant to the clinic's contractual instructions and for the sole purpose of operating the ERP platform.
3. Information We Collect (Web & Mobile)
We collect information across three categories, adhering strictly to the principle of data minimization:
A. Website Visitors & Prospective Inquiries
- Lead Information: Doctor name, clinic name, work email address, and mobile phone number provided voluntarily when requesting private beta access or product demonstrations.
- Website Telemetry: Anonymized IP addresses, browser user agent, device operating system, referring URLs, and interaction timestamps. Telemetry is collected with privacy-first scrubbers that strip query parameters.
B. Subscribing Clinic Administrators & Staff Accounts
- Identity & Contact Data: Full name, professional role (Doctor, Receptionist, Billing Clerk, Clinic Owner), clinic branch assignment, work email, and mobile phone number.
- Authentication Credentials: Password hashes (stored using industry-standard salted hashing algorithms), multi-factor authentication tokens, and session revocation timestamps.
- Fiscal & Billing Information: Clinic legal entity name, GSTIN (Goods and Services Tax Identification Number), registered business address, and payment card/bank tokens securely tokenized via PCI-DSS Level 1 payment processors.
C. Mobile App Telemetry & Hardware State
- App Performance: Crash diagnostics, network latency metrics, and API error reports logged via Sentry with client-side PII scrubbing.
- Device Sandbox State: Authenticated session tokens stored securely in local hardware sandboxes (Apple Keychain / Android EncryptedSharedPreferences).
4. How We Use Your Information
We use personal data strictly for specified, lawful purposes:
Platform Provision & Core ERP Services
Authenticating clinic users, managing appointment calendars, issuing gap-free GST invoices, managing OPD queues, and syncing data across web and mobile.
Platform Security & Multi-Tenancy Enforcement
Validating cryptographic tenant IDs on every API transaction, detecting brute force attacks, and maintaining immutable audit logs of record modifications.
Transactional Alerts & Service Updates
Dispatching transactional notifications, account security notices, subscription invoice receipts, and scheduled maintenance bulletins.
Legal & Fiscal Compliance
Fulfilling Indian GST accounting mandates, company law retention requirements, and cooperating with authorized regulatory authorities.
5. Patient Health Data (EHR) Safeguards
Electronic Health Records (EHR) and Protected Health Information (PHI) stored in Clinitto receive our highest tier of cryptographic and procedural protection:
The subscribing clinic is the Data Fiduciary. Patients seeking access, copies, corrections, or updates to their clinical notes, prescriptions, or medical photos should contact their treating healthcare provider directly. Clinitto provides full technical tooling for clinics to export or rectify records upon request.
- Zero Monetization Guarantee: We do not monetize, sell, license, share, or broker patient health data. We do not use clinical data or consultation notes to train public foundation artificial intelligence models.
- Role-Based Access Controls (RBAC): Clinical staff members are restricted to information required for their specific duties. For example, billing clerks can view invoice line items but cannot inspect clinical treatment notes.
- Clinical Photography & Media Isolation: High-resolution dermatological and cosmetic treatment photos are stored in private Cloudflare R2 object buckets isolated by tenant UUIDs. Image URLs are generated dynamically with short-lived presigned tokens expiring in 15 minutes.
6. Mobile Applications & Device Permissions
Our mobile application for iOS and Android is designed exclusively for authorized clinic practitioners and staff. To fulfill App Store Review Guidelines (Apple Guideline 5.1) and Google Play Data Safety requirements, we detail all device permissions below:
Hardware & Operating System Permissions Matrix
| Permission & Scope | Clinical Purpose | Privacy Guarantee |
|---|---|---|
| Camera (NSCameraUsageDescription / CAMERA) | Used solely when a practitioner explicitly takes a patient before/after clinical photo or scans a paper prescription in the active foreground. | Never accessed in the background. Photos are uploaded directly over TLS 1.3 to encrypted tenant storage. |
| Photo Library & Media Storage (Photo Picker) | Used only when the practitioner chooses to attach pre-existing diagnostic images or PDF lab reports from the device. | The app only accesses the specific files selected by the user. Zero scanning or indexing of your personal photo gallery. |
| Push Notifications (APNs / FCM) | Sends real-time operational clinic updates: appointment bookings, queue check-ins, and doctor schedule alerts. | Zero sensitive diagnostic or clinical notes are included in plaintext notification payloads. |
| Biometric Authentication (Face ID / Touch ID / BiometricPrompt) | Provides convenient, hardware-backed session unlock on clinical workstations and mobile devices. | Biometric data never leaves your device. Handled exclusively by Apple Secure Enclave or Android Hardware KeyStore (TEE). |
| Encrypted Local Sandbox Storage | Caches today's appointment list and basic patient registers to ensure uninterrupted clinical care during internet outages. | Stored in the app's encrypted sandbox (SQLCipher / Secure Storage) and automatically purged upon session logout. |
In-App Account Deletion (Apple Guideline 5.1.1(v))
Practitioners and staff members can request immediate account deletion directly within the mobile application settings. Upon confirmation, login credentials, authentication tokens, and personal profile records are deleted immediately. Note: Consultations and clinical records authored by the practitioner remain archived in the clinic's tenant database pursuant to statutory medical retention obligations.
7. WhatsApp Reminders & Messaging
Clinitto integrates with the official Meta WhatsApp Business Cloud API to deliver appointment confirmations and visit reminders to patients:
- Explicit Manual Staff Dispatch: In strict adherence to our platform rules, appointment reminders and invoice links are dispatched solely when explicitly triggered by authorized clinic staff. We do not operate autonomous automated marketing bots that contact patients without clinic oversight.
- Approved Meta Templates Only: All patient communications utilize pre-approved transactional WhatsApp templates. Freeform, unsolicited promotional messaging is strictly prohibited.
- Patient Opt-Out: Patients can opt out of WhatsApp notifications at any time by replying 'STOP' or by requesting clinic staff to update their notification preference in their profile.
8. Third-Party Sub-Processors
We engage enterprise-grade infrastructure and technology sub-processors bound by strict confidentiality and data protection agreements:
| Sub-Processor | Service Purpose | Data Categories Handled | Data Center Region |
|---|---|---|---|
| Cloudflare, Inc. | Edge compute (Workers), security CDN, DDoS mitigation, and encrypted object storage (R2). | Encrypted API traffic, clinical photo files, and static assets. | Global Edge / India |
| Supabase, Inc. / AWS | Managed PostgreSQL cloud database hosting with Row-Level Security. | Tenant relational data, encrypted PII, appointments, and billing. | Mumbai, India |
| Razorpay / Stripe / Cashfree | PCI-DSS Level 1 payment processing for SaaS subscriptions and clinic billing. | Payment tokens, transaction amounts, and invoice references. | India / Global |
| Meta Platforms, Inc. | WhatsApp Business Cloud API messaging gateway. | Patient mobile phone number and pre-approved appointment template parameters. | Global / India |
| PostHog, Inc. | Privacy-first product usage analytics with zero PII tracking. | Anonymized page views, feature adoption, and UI performance metrics. | EU / US |
| Functional Software, Inc. (Sentry) | Application error monitoring and runtime exception diagnostics. | Software error stack traces and crash logs with automated PII scrubbers. | US |
9. Security & Encryption Fortress
We implement robust physical, technical, and organizational security safeguards to defend clinic data against unauthorized access, alteration, or disclosure:
- Encryption in Transit: All data exchanged between browsers, mobile devices, and our edge APIs travels exclusively over TLS 1.3 (Transport Layer Security) with modern cryptographic cipher suites.
- Field-Level Encryption at Rest: Sensitive patient PII fields — including patient.mobile, patient.address, and consultation.notes — are encrypted at rest using authenticated AES-256-GCM encryption with securely managed vault keys.
- Row-Level Multi-Tenant Isolation: Every database query executes with mandatory tenant_id isolation enforced by PostgreSQL Row-Level Security (RLS). One clinic can never access or query records belonging to another clinic.
- Immutable Audit Logging: All creation, viewing, modification, printing, and exporting of patient health records produces an immutable entry in our audit log containing actor ID, timestamp, tenant ID, and IP address.
- Automated Production Backups: Production databases undergo daily automated snapshots with point-in-time recovery (PITR) retained for 30 days to protect against accidental data loss.
10. Data Retention vs Medical Statutes
We balance data minimization principles with statutory medical record retention laws:
Statutory Medical Retention Override: Under Indian medical council regulations (including National Medical Commission guidelines and State Clinical Establishment Acts), healthcare practitioners are legally mandated to preserve outpatient records and consultation notes for a minimum of 3 years (and up to 7–10 years for clinical procedures). When an individual requests the deletion of their medical record, the statutory medical retention obligation legally supersedes the general right to erasure.
- Non-Clinical Data: Account profiles, customer support communications, and marketing inquiries are retained only as long as necessary to fulfill the operational purpose or until consent is revoked.
- Tenant Termination: Upon termination of a clinic subscription, the clinic is granted a 30-day grace period to perform a one-click export of all clinic data in open formats (JSON/CSV). Following this period, tenant data is securely queued for cryptographic shredding and archival purging.
11. Your Rights & In-App Deletion
Depending on your jurisdiction and relationship with Clinitto, you possess specific statutory rights regarding your personal data:
- Right to Access: You have the right to request a summary of personal data being processed and the identities of any data fiduciaries or processors with whom it has been shared.
- Right to Correction & Completion: You have the right to correct inaccurate data or complete incomplete records.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time.
- Right to Data Portability: Clinics can export complete patient rosters, invoices, and clinical timelines in standard, machine-readable formats at any time without fees.
- Right of Grievance Redressal: You have the right to readily available grievance redressal mechanisms with our Data Protection Officer.
13. Grievance Redressal & DPO Contact
In compliance with Section 8(10) and Section 13 of the Digital Personal Data Protection Act, 2023, Clinitto has appointed a designated Grievance Officer and Data Protection Officer:
Designated Grievance Officer / Data Protection Officer
Grievance Officer, Magicraft Solutions
Clinitto Clinic ERP & EHR
If you are not satisfied with the resolution provided by our Grievance Officer, you have the right to escalate your complaint to the Data Protection Board of India.