Privacy Policy
We believe privacy is a right, not a feature. Here's exactly how we handle your data.
1. AmritSmile & our WhatsApp Tech Provider
AmritSmile is an independent product providing clinic-management software for dental practices ("the Service", "we", "us", "our").
To power our WhatsApp-based appointment reminders, patient communication and marketing broadcast features, AmritSmile connects to the WhatsApp Business Platform operated by Meta Platforms, Inc. Access to this platform requires Meta-approved "Tech Provider" status, which Meta grants only after verifying a GST-registered business. AmritSmile's WhatsApp integration runs under the Tech Provider registration held by 99KITCHEN COOK SERVICES, a separate, GST-registered business that completed Meta's verification for this purpose. 99KITCHEN COOK SERVICES' role is limited to holding this Tech Provider registration for WhatsApp API connectivity — it does not own, operate, or bill for AmritSmile, which remains an independent product.
2. Information we collect
We collect information you provide directly (such as your name, email address, clinic name, and payment details when you register), information we collect automatically when you use our services (including log data, device information, and usage analytics), and information from third parties where you have authorised such sharing.
Personal details: your name, phone number, and profile details, which we collect specifically for account creation and to identify you within the app.
Patient data entered into AmritSmile by doctors, dentists and other healthcare professionals — including treatment history, clinical notes and appointment records — is stored securely and is processed solely for the clinic's operational and record-keeping purposes, on behalf of the dental practice. AmritSmile acts as a data processor for such data under the Digital Personal Data Protection Act, 2023 (DPDPA), and does not access, use or share this data for any other purpose.
This includes any dental or medical details the doctor enters as part of a patient's record, and, at the doctor's discretion, clinical photographs the doctor chooses to upload. AmritSmile only records and stores this information as entered — we do not analyse it, generate any suggestion or recommendation from it, or cross-reference it against any other doctor's records or external medical reports. AmritSmile is a record-keeping tool, not a diagnostic or clinical decision-support tool.
3. Permissions we use
To power certain features, the AmritSmile mobile app requests the following device permissions. We only request permissions that are directly required for the feature they support.
- Camera & Storage
Used to capture, upload and attach clinical photos, documents and profile pictures within the app.
- Notifications
Used to send you appointment reminders, alerts and important account or clinic updates.
4. How we use your information
We use the information we collect to provide, maintain and improve our services; process transactions and send you related information including purchase confirmations and invoices; send you technical notices, updates, security alerts and support messages; respond to your comments and questions; and monitor and analyse trends, usage and activities.
We do not sell, trade or rent your personal information to third parties. We do not use patient health data for advertising or profiling purposes.
6. Data retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, accounting or reporting requirements. Patient health records are retained for a minimum of seven years from the date of the last clinical entry, consistent with Indian medical practice regulations.
Activity and audit logs (sign-ins, record changes and data exports by clinic staff) are kept for 3 years. The most recent 12 months stay in the live system; older logs are moved to encrypted archive storage in India (AWS Mumbai) and permanently deleted once they are 3 years old. Clinic admins can view the last 3 months in the app by default; access to older logs (up to 3 years) is available on request to support.
Clinic data export is available at any time, self-service, from within your admin portal login. To request deletion of your clinic's account and all associated data, submit our data-deletion consent form (or contact us at privacy@amritsmile.com); once confirmed, everything is permanently deleted within 48 hours. If a clinic instead simply stops using the platform, or its subscription is suspended, without an explicit deletion request, we retain the data for 3 consecutive months, after which we send an email notice that it is due for deletion — if we don't hear back by email within 7 days of that notice, the data is then permanently deleted.
7. Security
We implement and maintain appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include TLS 1.2/1.3 encryption for all data in transit, AES-256 encryption at rest for our database, its backups, server storage and document storage, and role-based access controls enforced on our servers on every request. Our application and database run on Amazon Web Services in the Mumbai region, so personal data is stored and processed in India. The database is not reachable from the public internet — only our application server can connect to it — and administrative access is restricted to authorised AmritSmile personnel using multi-factor authentication. Passwords and other secrets are kept in an encrypted secrets store and are never stored in source code.
We keep two independent layers of backups: automated daily database snapshots with point-in-time recovery, retained for 7 days, and a separate encrypted nightly copy, retained for 30 days. Data deleted at your request is removed from these backups as they expire.
Documents and files you upload — patient scans, prescriptions, reports and clinical videos — are stored separately in a private, access-controlled cloud storage bucket, served through a content delivery network. These files are never assigned a public or permanent URL; every view uses a short-lived, cryptographically signed link that expires automatically, and only staff a clinic has explicitly granted document access can retrieve them. When a file is deleted, it is not destroyed immediately — it is moved to a restricted, time-limited archive with a logged record of who deleted it and when, so it can be recovered if a deletion was made in error.
While we take commercially reasonable precautions, no security system is impenetrable. We encourage you to maintain strong passwords and report any suspected security incidents to security@amritsmile.com immediately.
8. Your rights
Under the DPDPA and applicable Indian law, you have the right to: access the personal data we hold about you; correct inaccurate or incomplete personal data; erase your personal data where there is no compelling reason for us to continue processing it; and withdraw consent where processing is based on consent.
To exercise any of these rights, contact us at privacy@amritsmile.com. We will respond within 30 days and will not charge a fee for responding to a reasonable request.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the effective date below. We encourage you to review this Privacy Policy periodically.
Continued use of our services after the effective date of a revised policy constitutes your acceptance of the revised terms.
11. Contact us
If you have questions about this Privacy Policy, please contact our Data Protection Officer at: privacy@amritsmile.com
AmritSmile is registered as a Micro Enterprise under the Udyam Registration Scheme, Ministry of MSME, Government of India (Udyam Registration No. UDYAM-BR-26-0243637).
For queries specific to our WhatsApp messaging integration, our Meta Tech Provider partner is 99KITCHEN COOK SERVICES.
Email our Data Protection Officer at privacy@amritsmile.com. We respond within 30 days.