Privacy notice

Your clinic does. Under India's Digital Personal Data Protection Act, 2023, the clinic is the data fiduciary for its patients' data, and Syncure processes that data on the clinic's behalf. For staff accounts and the clinic's own details, Syncure is the data fiduciary.

About patients: name, mobile number, and, if the clinic adds them, age and sex; each appointment (doctor, date and time, how it was booked, its status and changes); a short visit reason when the desk notes one; the messages exchanged with the clinic's booking chat and whether they were delivered; and when and how you agreed to messages.

About clinic staff: name, work email, role, a scrambled form of the password (never the password itself), and a log of sign-ins and changes made in Syncure.

We do not keep medical records, prescriptions, test results or payment details. Messages to patients never include the visit reason.

• To book, confirm, move and cancel appointments, on WhatsApp and at the desk.
• To send the messages you asked for or agreed to: confirmations, reminders, and notices when a doctor is running late or on leave.
• To give the clinic's owner a monthly report of bookings and no-shows.
• To keep accounts secure and to know who changed what.

We do not sell data, show advertising, or use it for anything else.

The first time you message a clinic, its booking chat asks you to agree before anything is booked. Clinics can also record your agreement at the desk. You can stop messages at any time by sending STOP in the chat, or by asking the clinic; send START to turn them back on. Stopping messages does not cancel your appointments.

When a parent or guardian books for a child on their own number, they agree on the child's behalf.

• Meta (WhatsApp) carries the messages between you and the clinic. WhatsApp's own privacy policy applies to your use of WhatsApp.
• Telegram, only when a clinic is trying Syncure with our test bot.
• Our hosting, database and email providers, who store and send data for us under contract and may not use it for themselves.

Data travels encrypted. Each clinic sees only its own patients, and each person sees only what their role needs: a doctor sees their own day, the front desk the clinic's bookings, and only the owner manages staff. Messages from WhatsApp and Telegram are checked for their senders' signatures before we read them.

We keep a clinic's records while it uses Syncure. When a clinic leaves, we delete its patients' data within 30 days of its request, except security logs that Indian law requires us to keep for 180 days.

You can ask to see the data held about you, to correct it, or to have it deleted, and you can withdraw your consent at any time. Patients: ask your clinic first, since it decides about your data; we help it answer you. You can also write to us at privacy@syncure.app. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

If we change this notice we update the date above, and tell clinics before a change that affects them. The terms for clinics are on the terms page.