Privacy Policy

This Privacy Policy explains how Tootica (“we”, “us”) collects, uses, shares and protects personal information when you use the Service as a staff member of a clinic. We are committed to protecting your information and the information of the patients your clinic serves, and to handling it in accordance with applicable data-protection laws, including India’s Digital Personal Data Protection Act, 2023.

Your clinic decides what patient information is collected and why, and so acts as the controller (data fiduciary) of that information. Tootica processes it on the clinic’s behalf to provide the Service.

Account information: your name, email address, role, and the clinic and branch you belong to, together with your password (stored only in encrypted/hashed form) and security codes used for login and password reset.

Clinic and patient information entered into the Service: patient names and contact details, appointment details, medical and dental history, treatment notes, and related records that staff record as part of running the clinic.

Communications data: appointment-related messages sent by email or WhatsApp, including inbound WhatsApp booking requests and the phone numbers involved.

Technical data: session cookies and basic log information (such as the time of access and actions taken) that are needed to keep you logged in securely and to operate and safeguard the Service.

We use the information to authenticate and secure your account; to provide the practice-management features you and your clinic use (managing branches, staff, patients, appointments and records); to send appointment and account-related communications; to maintain the security, integrity and availability of the Service; and to comply with legal obligations.

We do not sell personal information, and we do not use patient information for advertising.

We process your account information to provide the Service you have been given access to and to meet our legitimate operational and legal obligations. Patient information is processed on the instructions of, and under the lawful basis established by, your clinic. By accepting this Policy you consent to the processing of your own account information as described here.

Within the Service, information is visible only to authorised users according to their role and branch. We share information with trusted service providers who help us run the Service — for example hosting, email delivery, and messaging providers used to send WhatsApp and one-time-password messages — and only to the extent needed to perform those services.

We may disclose information where required by law, regulation or valid legal process, or to protect the rights, safety and security of patients, clinics, our users or the Service.

We take reasonable technical and organisational measures to protect information against unauthorised access, loss or misuse. These include encrypted storage of passwords, access controls that limit data to authorised roles, secure session handling, and transmission over secure connections. No system is completely secure, so we also rely on you to keep your credentials confidential and to report any suspected incident promptly.

We retain information for as long as your clinic’s account is active and as needed to provide the Service, and thereafter only as required to meet legal, regulatory, accounting or legitimate record-keeping obligations. Patient records are retained according to the clinic’s instructions and applicable medical record-keeping requirements. When information is no longer needed it is deleted or anonymised.

Subject to applicable law, you have the right to access the personal information we hold about you, to request correction of inaccurate information, to withdraw consent, and to raise a grievance about how your information is handled. Requests relating to patient information should be directed to the clinic that controls that information. To exercise your rights, use the contact details below.

The Service uses strictly necessary cookies to keep you securely signed in and to operate core functionality. These are essential to the Service and are not used for advertising or cross-site tracking.

Patients, including minors, do not log in to the Service; their information is entered and managed by clinic staff. Where patient information relates to a minor, the clinic is responsible for ensuring the appropriate consent of a parent or lawful guardian under applicable law.

We may update this Privacy Policy from time to time. When we make material changes we will update the effective date shown above and, where appropriate, ask you to review the updated Policy. Please check this Policy periodically.

For questions, requests or complaints about this Privacy Policy or your information, contact us at privacy@tootica.com. (Replace with your operating entity, registered address and the name and contact of your designated grievance officer before go-live.)