Privacy Policy

This notice covers the WhatsApp Business API integration inside the DermaAI clinical EMR (the "WhatsApp integration"), operated in coexistence mode — your clinic's existing WhatsApp app on your phone and the DermaAI integration both work side-by-side on the same WhatsApp number.

It applies only to data exchanged through WhatsApp. Other DermaAI data (clinical records, prescriptions, billing) is governed by your clinic's data-processing agreement with us.

1. Who we are

The WhatsApp integration is operated by Haiku Studio, the company behind DermaAI.

Registered office: A 301, Elevate, Golf Course Extension Road, Sector 59, Gurugram, Haryana 122011

Contact: nikhil@dermaai.in

2. What we collect through WhatsApp

• Patient WhatsApp phone numbers
• Profile names as shown on WhatsApp
• Message content sent to and received from the clinic
• Attachments (PDFs, images, voice notes) sent through the conversation
• Message timestamps and delivery/read status
• Template message identifiers and Meta-side approval status

3. How we use it

• Deliver appointment reminders the clinic has scheduled
• Send signed prescription PDFs and clinical follow-up notes after a visit
• Show inbound patient messages in the clinic's DermaAI inbox so staff can reply
• Send promotional or marketing messages where the patient has opted in — the clinic is responsible for collecting and recording that consent
• Meet Meta's WhatsApp Business policy requirements (template moderation, opt-out handling, delivery diagnostics)

4. Who we share it with

• Meta / WhatsApp, as the transport for every message — this is intrinsic to using the WhatsApp Business API.
• The operating clinic. Every patient conversation belongs to the clinic that initiated it. Clinic staff with inbox access can read, reply to, and delete it.
• Our hosting providers. Data is stored on Google Cloud Platform (region asia-south1, Mumbai).

We do not sell patient data. We do not share patient data with third parties for advertising. We do not use patient WhatsApp content to train any AI model outside the scope of your clinic.

4a. Website, live demo & security

Our website uses Cloudflare Turnstile to protect the live AI-scribe demo from automated abuse. Turnstile may process limited device and network information to distinguish people from bots; this processing is described in the Cloudflare Turnstile Privacy Addendum.

If you try the demo, the mock-consultation recording you make is processed to generate the sample prescription and is deleted after the demo. Demo recordings are never used to train AI models. We use Google Analytics and Microsoft Clarity on the website to understand how visitors use it.

5. Data residency

Patient data is stored in India (Google Cloud asia-south1, Mumbai). WhatsApp messages transit Meta's global infrastructure but are stored at rest by us in India.

6. How long we keep it

• Active conversations: kept while the patient is an active patient at the clinic.
• After a patient is archived or the clinic asks us to delete a conversation: deleted within 30 days.
• Backups: deleted within 90 days of the primary deletion.
• Template message identifiers (numbers, not content): kept for one year for Meta delivery audit purposes.

7. Your rights (patients)

You can ask the clinic that messaged you to:

• See what we hold about you
• Correct anything that is wrong
• Delete your WhatsApp data
• Stop messaging you — you can also reply STOP in WhatsApp to opt out instantly

If the clinic does not respond, contact us directly at nikhil@dermaai.in. We respond within 30 days as required by the DPDP Act 2023.

For step-by-step instructions, see our Data Deletion Instructions.

8. Security

• All data encrypted in transit (TLS 1.2+) and at rest
• Access restricted to clinic-allowlisted Google accounts
• Full audit log of every WhatsApp send
• Routine third-party security review

9. Legal basis

We process personal data under (a) the patient's consent, collected by the clinic before any WhatsApp message is sent, and (b) legitimate use for delivery of clinical services the patient has requested. This is consistent with the Digital Personal Data Protection Act, 2023.

10. Changes

We may update this policy. The effective date above shows the current version. Material changes will be notified to clinic admins by email.

11. Governing law

This policy is governed by the laws of India. Disputes are subject to the courts of [city of jurisdiction — to be confirmed].

Contact

Privacy queries: nikhil@dermaai.in