Privacy

Connec8 operates ClinicConnec8, software clinics use to run their own practice. Two different sets of people appear in it, and they are not treated the same way.

• Clinic staff — the owner and the people they give logins to. We are the controller of that account data.
• Patients— the people a clinic treats. Their records belong to the clinic. We hold and process them on the clinic's instructions and for no purpose of our own.

• Account data: name, email, mobile number, role and clinic for each staff login; the organization and clinic details entered at signup.
• Patient records entered by the clinic: name, age, gender, phone number, optional email, treatment history, appointments, therapy packages and sittings, payments, and any notes, diagnoses or prescription photographs the clinic chooses to attach.
• Operational data: staff attendance including, where a clinic switches the location check on, the distance between the person and the clinic at the moment they marked themselves present.
• Billing data: subscription payments and their gateway references. Card details are handled by the payment gateway and never reach our servers.
• Website enquiries: the name, clinic name, phone number and anything else you type into the demo form on this site.

Application data is stored in a managed MongoDB database in the Mumbai region, and the application runs on Google Cloud in the same region. Prescription photographs are stored in Google Firebase Storage. Each clinic's records are separated at the query level rather than by a filter in the interface.

We use a small number of processors, each for one job, and none of them are permitted to use your data for their own purposes:

• Google Cloud — hosting, storage and background jobs.
• MongoDB Atlas — the database.
• AiSensy or Fast2SMS — delivering WhatsApp messages to patients.
• Razorpay — subscription and online patient payments.
• ZeptoMail — transactional email such as invoices and alerts.
• Cloudflare — the anti-spam check on public forms.
• Google Gemini — reading a photographed prescription or matching the column headings of a patient list you upload, when a clinic uses those features.

We do not sell data, and we do not use patient contact details for advertising.

Only the clinic that entered it and the staff that clinic has given access to. Access is controlled by roles the clinic defines, and can be changed or withdrawn by the clinic at any time. Our own staff access production data only when it is necessary to operate or fix the service, and never to browse.

Clinic and patient records are kept for as long as the clinic's account is active, because a treatment history is only useful if it is complete. When an account closes, the clinic may export its data; we then delete or irreversibly anonymise it within ninety days, except where a law requires us to keep a financial record for longer. Website enquiries are kept for up to two years.

Under India's Digital Personal Data Protection Act, 2023, you may ask for a copy of your personal data, ask for it to be corrected, or ask for it to be erased. A patient should raise that with their clinic, which holds the record; we will support the clinic in answering it. Staff and website enquiries can write to us directly at [email protected], and we will respond within thirty days.

Traffic is encrypted in transit, passwords are hashed, and a session token expires after seven days. No system is beyond compromise: if a breach affects your data we will tell you and the relevant authority, and we will tell you what we know rather than what sounds best.

Connec8, House 22, Panchwati Colony, Bairagarh, Huzur Road, Airport Road, Bhopal, Madhya Pradesh, 462030, India. Write to [email protected].