How we handle your information.

Who we are and what this covers

AutoClin is clinic management software for clinics in India: appointments, patient records, visit notes, billing, WhatsApp reminders and an AI layer that drafts, while people decide. This policy explains what information we handle, why, who sees it, and what you can ask us to do.

It covers this website (autoclin.com), the AutoClin web app and the AutoClin doctor app. In this policy, “we” and “AutoClin” mean the team that runs these services.

Two roles, and why they matter

• For clinic and staff accounts (the people who sign in) and for visitors to this website, AutoClin decides why and how the information is used. We are the responsible party.
• For patient information, the clinic decides why and how it is used. AutoClin stores and handles it on the clinic’s behalf, under the clinic’s instructions, and does not use it for its own purposes. If you are a patient, the clinic is who you should ask first (see “Your rights”).

What information we handle

Visitors to this website

• If you use the contact form: the name, clinic, email, mobile number, city and message you type. It is emailed to our team so we can reply, and it is not stored on our servers or added to any list.
• Ordinary connection details (such as your IP address and browser) that any website receives. We do not run advertising or analytics trackers on this site.

Clinic owners, doctors and staff

• Your name, email, mobile number, role, profile photo if you add one, and your doctor details if you add them (such as a registration number shown on prescriptions).
• Your password, stored only as a one-way hash, never in readable form.
• Sign-in sessions, and for the doctor app a phone alert token, so we can send you appointment alerts.
• A record of who did what in the app (the “audit log”). It keeps ids and the names of the fields that changed, never the values.

Patient information entered by clinics

Clinics decide what they record. Typically this is a patient’s name, mobile number, date of birth, gender, address, blood group, allergies and medical history; appointments; visit notes, diagnoses and prescriptions; lab orders and referrals; uploaded documents and images; signed consent forms; invoices and payments; and the messages sent to the patient. A clinic may also record an ABHA number if the patient shares it.

Messages and records of consent

We keep a log of the WhatsApp messages the app sends for a clinic (what kind, when, delivery status) and the patient’s replies to appointment buttons. Consents (for appointment messages, and separately for AI assistance) are kept in a log that is only added to, never edited, with the version of the notice the patient saw.

How we use it

• To run the service for clinics: appointments, records, billing, reminders, the doctor app and live updates between screens.
• To keep it secure: sign-in checks, limits on repeated attempts, and the audit log.
• To reply to messages and give support.
• To send you account emails, such as verification, password reset and team invitations.
• To meet legal obligations.

We do not sell personal information. We do not use patient information to advertise, and we do not use it to train AI models.

WhatsApp messages

With the patient’s agreement, clinics use AutoClin to send appointment confirmations, reminders, changes and, if requested, waiting-list openings on WhatsApp. These go through the WhatsApp Business Platform, run by Meta Platforms. Each clinic connects its own WhatsApp Business number and Meta account, and Meta’s own terms and privacy policy apply to messages carried by WhatsApp.

Messages use pre-approved templates and carry appointment details such as date, time, clinic and doctor, not clinical details. A patient can reply STOP to any message to stop receiving them, and can ask the clinic to turn them off.

Phone alerts in the doctor app show only a time, never a patient’s name or reason for visit. They are delivered through Expo’s push notification service.

AI features

AutoClin can help a doctor turn rough notes into a drafted visit note, give a short summary of a patient’s record before a visit, and, in the doctor app, write down spoken notes (dictation). These are off unless the clinic turns them on, and for a patient they are used only if the patient has agreed to AI assistance. A patient can say no, or withdraw, and their care stays the same.

• The AI is sent only the text a task needs. We do not send patient names or phone numbers.
• It never reads the database by itself; it receives text the app builds and answers in a fixed format.
• It only drafts. A doctor reads, edits and approves anything before it becomes part of a record, and the app keeps a note of who approved it and which fields were changed.
• We record how much AI was used and what it cost, but not the content of what was sent.
• The AI service is provided by OpenAI. We do not allow patient information to be used to train its models. If the AI is unavailable, the app falls back to typing.
• Dictation. When a doctor records spoken notes in the doctor app, the recording is sent to OpenAI to be turned into text. AutoClin does not store the recording, the phone deletes its copy once it is sent, and the words are not written to our logs. The doctor reads and corrects the text before anything is drafted. We do not allow patient information to be used to train OpenAI’s models. Please do not say a patient’s name when dictating.

Who we share it with

We share information only with the providers that help us run the service, and only what each needs:

Some of these providers may process information outside India. We also disclose information when the law requires it, to protect people’s safety, or to protect our rights. If AutoClin is ever sold or merged, we will tell clinics and the information would stay under this policy.

Within a clinic, the owner decides who can see what. Front-desk staff cannot open clinical records, and one clinic can never see another clinic’s data.

How we protect it

• Every connection to AutoClin is encrypted in transit (HTTPS).
• Each clinic’s data is kept separate, and every request is checked against the signed-in person’s clinic and role. We test this with automated checks that try to reach one clinic’s data from another.
• Passwords are hashed. WhatsApp access tokens are encrypted. One-time links and codes are stored only as hashes.
• Repeated sign-in attempts and public requests are rate limited. Logs do not keep passwords, tokens or request contents.
• Access to patient records is written to an audit log.

No system is completely secure. If we learn of a breach that affects personal information, we will tell the affected clinics without undue delay, and help them meet their own duties to patients and regulators.

How long we keep it

Clinics decide how long patient records are kept, because medical and billing records must be kept for periods set by law and good practice. We keep information for as long as an account is active and for as long as needed to provide the service, meet legal requirements and settle disputes. Website contact messages are not stored by us beyond the email we receive.

Erasing a patient removes their identity and contact details and the records the law does not require us to keep; the part that must be kept is kept, and the clinic is told why. When a clinic closes its account, ask us and we will delete or anonymise its data, except what the law requires us to retain.

Your rights and how to use them

Under India’s Digital Personal Data Protection Act, 2023, you can ask to see the personal information held about you and get a copy, ask for it to be corrected or completed, ask for it to be erased, withdraw your consent at any time, and nominate someone to exercise these rights for you. You can also complain to us, and if you are not satisfied, to the Data Protection Board of India.

• If you are a patient, ask your clinic first. It controls your record and can export, correct or erase it using tools in AutoClin. If you cannot reach the clinic, write to us and we will pass your request on.
• If you are a clinic or staff member, you can change most of your details in the app. For anything else, write to us.
• We will reply within a reasonable time, and no later than the law requires.

Deleting your data

In the doctor app, open the Account tab and choose Delete account. A doctor, or an owner with another owner in the clinic, is signed out everywhere straight away, and we then erase the rest of their personal details except what the law requires us to keep, such as their name on the medical records they wrote. A clinic’s only owner sends us a request instead, because deleting that account closes the clinic. You can also have your AutoClin account or your clinic’s data deleted by email: email contact@autoclin.com from the email address on the account, with the subject “Delete my data”. We will confirm who you are, tell you what will be removed and what must be kept by law, and then delete it. Patients can ask their clinic to erase their record in the same way. The full steps, and what is kept, are on Delete your account.

Children

The website and the sign-in are for adults. A clinic may record information about a child who is a patient; the clinic is responsible for getting a parent or guardian’s consent when the law requires it.

Cookies and similar storage

This website sets no cookies. The AutoClin app uses only the cookies and device storage it needs to keep you signed in and remember settings such as your theme. We do not use advertising cookies.

Changes to this policy

When we change this policy in a way that matters, we will update the date at the top and tell clinics through the app or by email. The latest version is always on this page.

Contact and grievance officer

For questions, requests or complaints about personal information, contact the AutoClin Grievance Officer:

• Email: contact@autoclin.com
• Phone: +91 63884 06765 or +91 81782 93028
• Country: India

We will acknowledge a complaint promptly and aim to resolve it within 30 days.