Privacy Policy

This policy covers both products operated by Klintro (“we”, “us”): the clinic practice-management platform used by clinic staff and their patients, and the Klintro Health Network, a public professional/patient network. If you use either product, this policy applies to you.

Address: Hyderabad, Telangana 500085, India. Contact: hello@klintro.com, phone +91 97119 78105 (call line).

Depending on how you use the platform, we collect:

• Account and identity data — name, phone number, email address, password (stored only as a salted hash, never in plain text), profile photo.
• Clinical and health data (Sensitive Personal Data under DPDP) — visit notes, diagnoses, prescriptions, vitals, allergies, chronic conditions, lab/investigation records, and — where a patient links it — their ABHA (Ayushman Bharat Digital Mission) health ID. This category receives the highest level of access control in the system.
• Financial data — invoices, payment status, and subscription billing records. Card and payment-instrument details are never stored on our servers; payments are processed directly by Razorpay, our payment processor.
• Professional verification data — for doctors, clinics, and other professional accounts on the Health Network, we collect registration numbers, degree/qualification documents, and organization registration documents to verify credentials before granting a verified badge.
• Communications — messages sent through the platform (patient–clinic messaging, Health Network direct messages), and the content of SMS/WhatsApp/email notifications we send on a clinic's or your behalf.
• Usage and device data — pages visited, actions taken, IP address, browser/device type, and login history — used for security (rate-limiting, audit logs) and to operate the service.

• Directly from you, when you sign up, book an appointment, or fill in a form.
• From clinic staff, when they record clinical visits, prescriptions, or invoices on behalf of a patient they treat.
• Automatically, through OTP-based sign-in (no passwords on the Health Network) and ordinary server logs.

• To provide the core service — scheduling, records, billing, messaging, and the professional network.
• To verify professional credentials before a doctor, clinic, or other professional account is marked verified and made publicly discoverable.
• To send appointment reminders and transactional notifications (SMS, WhatsApp, email) that you or the clinic you interact with has enabled.
• To detect and prevent abuse — rate limiting, fraud detection, audit logging.
• To provide the AI-assisted features described in Section 6. Clinic features (such as the consultation scribe, patient summaries, the clinic chat assistant and review replies) run on the clinic's own AI provider account; Health Network and Klintro's own tools run on Klintro's account.
• To comply with legal, tax, and healthcare record-keeping obligations.

Where DPDP requires consent as the basis for processing, we ask for it explicitly at the point of account creation — you'll see this policy and a consent checkbox before an account is created. We record the date and policy version you consented to. You can withdraw consent at any time by closing your account (see Section 8); withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and does not require us to delete records we are legally obligated to retain (e.g. billing records, or clinical records under applicable medical record-keeping law).

We do not sell personal data. We share it only with the service providers (“processors”) that help us run the platform, each only for the specific purpose named:

• Razorpay — payment processing.
• Resend — transactional email delivery.
• Meta (WhatsApp Business API), MSG91/Twilio — WhatsApp and SMS message delivery, where a clinic has enabled these channels.
• Groq and Google (Gemini API) — AI text and speech processing for the Health Network and for Klintro's own tools, as described below.
• DigitalOcean — cloud hosting and file storage infrastructure.
• Sentry (where enabled) — error monitoring, to help us find and fix bugs.

AI features

Klintro's AI features send data to an AI provider only when someone uses the feature. Which provider account is used depends on whose feature it is.

Clinic features run on the clinic's own AI account. A clinic that wants AI features connects its own account with an AI provider (currently Groq or Google Gemini) by adding its own key in Klintro's settings, and chooses which one is active. The clinic chooses the provider and the plan, free or paid, and the provider's terms for that account, including whether it keeps or uses the data it receives, are between the clinic and the provider. The clinic is responsible for that choice. Klintro is the software that sends the request and shows the result; it never uses its own AI account for a clinic's features. If a clinic has not connected an account, these features are simply unavailable. The clinic features are:

• Consultation scribe: when a doctor uses it, the consultation recording or typed transcript is sent to turn it into a draft visit record for the doctor to review. Names, contact details and ID numbers are masked in typed and transcribed text first, as far as they can be recognised. A recording itself cannot be masked and is sent as recorded.
• Patient summary: when clinical staff ask for one, the patient's age band, sex and blood group, allergies, conditions and medications, recent visits (reason, diagnosis, vitals and prescriptions), open treatment plans, pending recalls and outstanding balance are sent to produce the summary. The patient's name and contact details are not sent.
• Clinic chat and WhatsApp assistant, where a clinic has enabled it: the patient's message and the conversation so far, with the clinic's own details, to answer the patient.
• Reviews: a review's star rating and text, when clinic staff ask to analyse it or suggest a reply (see Section 14).
• Clinic marketing content: drafts for a clinic's website, blog, SEO pages, emails and social posts, from what the clinic submits.
• In-app help and the clinic analytics assistant: the question asked, with the clinic's own summary figures for analytics.

Before clinic data is sent to an AI provider, we remove or mask the patient's name, contact details and demographic identifiers. Masking is automatic: it covers the names, phone numbers, email addresses, addresses and ID numbers held in the patient's record, and phone numbers, email addresses and ID numbers (such as Aadhaar, PAN and ABHA) that follow a recognisable format in text that staff or patients type. It cannot catch everything, for example a name that is not in the record and is written in free text. Clinic marketing drafts (website, blog, SEO pages, emails and social posts) are written from what the clinic submits and are not masked, so a clinic should not enter patient details there. The one other exception is a consultation recording for the scribe: audio cannot be masked, so the recording is sent to the clinic's AI provider as recorded.

Health Network and Klintro's own tools run on Klintro's AI account, with Groq or Google (Gemini API) as our processor:

• Health Network: posts, comments, messages, reviews and other member content are checked for safety after contact details and ID numbers are removed, patient health questions are sent to add an educational safety note, and members can ask for help drafting posts, job listings, profile text, case write-ups, quizzes, paper summaries or translations from what they enter.
• Running Klintro: support tickets, billing reminders, sales leads, audit logs, usage and sign-in activity of clinic accounts, so Klintro staff can draft replies and spot problems.

Some of these providers may process data outside India. Where that happens, we rely on the provider's own contractual and security commitments, and use this only where necessary to operate the service.

We may also disclose data where required by law, court order, or a valid request from a government authority.

• Clinical and financial records are retained for as long as your account (or the clinic's account) is active, and thereafter for the period required by applicable medical record-keeping and tax law.
• Professional verification documents for a rejected application are deleted 30 days after rejection, once the appeal window closes.
• Read in-app notifications are deleted after 90 days.
• These retention rules run automatically as a scheduled job, not manually.

Under DPDP, you have the right to:

• Access a summary of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Erasure — request that your personal data be erased. Where clinical or financial records must legally be retained, we anonymize rather than delete: your name and identifying details are stripped from the record while the underlying clinical/financial history is preserved for legal compliance, in a form no longer linkable to you.
• Withdraw consent at any time, as described in Section 5.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, contact us at privacy@klintro.com. If you're a patient of a specific clinic, you can also ask that clinic directly — they can action an erasure request for records they control.

• All traffic is encrypted in transit (TLS 1.2/1.3).
• Passwords are never stored in plain text — only as salted bcrypt hashes.
• Access to clinical data is scoped per clinic; one clinic's staff cannot see another clinic's patients.
• Sensitive actions (logins, password resets, admin actions) are rate-limited and recorded in an audit trail.
• Verification documents and other uploaded files are stored privately and served only via short-lived signed URLs, never a public link.

We use essential cookies to keep you signed in — these aren't optional, since the service can't function without them. A clinic may separately enable third-party analytics (e.g. Google Analytics) on its own public website; where enabled, that clinic's site will disclose it separately.

The platform is intended for use by adults managing their own or a family member's healthcare. Where a parent or guardian registers a minor as a patient, the consent and rights in this policy are exercised by that parent or guardian on the minor's behalf.

We update the “Last updated” date above whenever this policy materially changes. Each account records the version of this policy that was in force when the account was created.

If you have a complaint about how we've handled your personal data, or about anything else on the platform, contact our Grievance Officer:

Shiva Rama Krishna, Grievance Officer
Email: srk@klintro.com

We acknowledge a grievance within 24 hours and aim to resolve it within 15 days of receiving it. We aim to complete a request to exercise your rights under Section 8 within 30 days; if we need longer, we will tell you why.

If you are a patient and your complaint is about a clinic's handling of your records, you can also raise it with that clinic, which decides how your records there are used.

If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act, after first using this grievance process.

Some Klintro features work with a Google account, but only if you choose to connect one. This section explains what we access through Google's APIs, why, how we look after it, and what happens when you disconnect.

What we access, and why

• Google Calendar (permission: calendar.events), for each doctor whose calendar is connected. We use it for two things only. First, we create, update and delete an event in that calendar for each of the doctor's Klintro appointments, so the appointment appears there and moves or disappears when it is rescheduled or cancelled. The event carries the minimum: by default “Appointment – Klintro”, the time, the clinic's name as the location and a link back to Klintro, or, if the clinic chooses, the patient's first name and visit type as well. It never includes a phone number, reason for visit, diagnosis or notes, and it is marked private. Second, we read the start and end times of the doctor's other events for the next three weeks, so those times show as busy in Klintro and cannot be booked. We never read event titles, descriptions, locations or guest lists. The only other details we read are whether an event is cancelled or marked as free, whether the doctor declined it, and whether it is one of Klintro's own events, so those don't block a slot.
• Google Business Profile (permission: business.manage), for clinics that connect their profile. We read the names and addresses of the business locations the connected Google account manages, so the clinic can choose its own. For that location we read its Google reviews (the reviewer's display name, star rating, review text, date and any reply) and copy them into Klintro's reviews screen, refreshing them regularly. When clinic staff write a reply to a review in Klintro, we post that reply to Google for them. We do not change the business listing itself (its hours, address, photos or other details).
• “Continue with Google” sign-in on the Klintro Health Network (permissions: openid, email, profile). Google shares your Google account ID, your email address (and whether Google has verified it), your name and your profile picture. We use these to sign you in, to link Google to an existing Network account with the same confirmed email, and, if you are new, to create your account with your name and picture as your profile name and photo. Sign-in gives us no access to anything else in your Google account, and we don't keep any Google token for it.

How we store and protect it

• The tokens Google gives us for Calendar and Business Profile are encrypted at rest (AES-256-GCM), are only ever sent to Google, and are never written to our logs or error messages.
• For Calendar we keep the connection (encrypted tokens and sync status), the Google event ID of each appointment we added, and the busy slots we blocked, labelled only “Busy on connected Google Calendar”. Busy slots in the past are deleted automatically.
• For Business Profile we keep the connection (encrypted tokens and the chosen location) and a copy of the location's reviews.
• For sign-in we keep your Google account ID with your Network account, alongside the email, name and photo described above.
• All of it is protected by the measures in Section 9. We keep the tokens and the Calendar data only while the connection is in place.

Who sees it, and sharing

We do not sell Google user data, use it for advertising, or transfer it to anyone except as needed to provide the feature you are using, for security, or as the law requires.

• Calendar busy times are used only to mark slots as unavailable in Klintro, including on the clinic's online booking page, which shows the slot as taken and nothing else. They are not sent to anyone else.
• Copied reviews are shown to the clinic's staff in Klintro. Like reviews the clinic adds itself, they can also appear on the clinic's own Klintro website: its average rating and review count, and a few recent 4 and 5 star reviews with the reviewer's display name, all of which are already public on Google.
• If a staff member asks Klintro to analyse a review or suggest a reply, the review's star rating and text (not the reviewer's name) are sent to the AI provider account the clinic has connected (Section 6) to produce that result. It is shown only to staff and is posted to Google only if they choose to post it.
• All of this data is stored with our hosting provider (Section 6).

Disconnecting, revoking and deleting

• Google Calendar. The clinic can disconnect a doctor's calendar at any time in Klintro's integration settings. We then immediately delete the stored tokens, the busy slots we copied and our record of which events we created, remove the doctor's upcoming Klintro appointment events from their Google Calendar, and ask Google to revoke Klintro's access. Past appointment events stay in the calendar as the doctor's own history, and the doctor can delete them in Google Calendar at any time. If Google access had already been withdrawn, we can't remove the upcoming events either, so the doctor can delete them in Google Calendar. When a patient's record is erased, we also remove that patient's appointments from connected calendars.
• Google Business Profile. The clinic can disconnect it at any time in Klintro's integration settings. We then ask Google to revoke Klintro's access and delete the stored tokens and chosen location. Reviews already copied stay in the clinic's reviews list as part of its records; the clinic can ask us to delete them using the contact details in Section 8.
• Google sign-in. You can unlink your Google account from your Network account at any time in your Network account settings, or ask us to using the contact details in Section 8, as long as you have a confirmed email address or phone number to sign in with instead. Closing your Network account removes your email, name, photo and Google account ID.
• You can also revoke Klintro's access at any time from your Google Account at https://myaccount.google.com/permissions. Klintro then stops syncing; to have us delete what we stored, also disconnect in Klintro or contact us.

Limited Use

Klintro's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data to develop, improve or train generalised AI or machine-learning models.