Privacy Policy

The dental clinic decides which patients it treats, what it records about them and why. In data protection language the clinic is the data fiduciary, or controller.

Zeliks acts on the clinic's instructions and does not decide what happens to patient information. We are a data processor. We do not sell patient information, we do not use it to advertise to anyone, and we do not use one clinic's patient data for another clinic.

If you are a patient or a parent and want your information corrected or removed, the fastest route is your clinic, because it holds the relationship and the record. You can also come to us directly and we will act on it. Seedeleting your information.

When a clinic signs up we collect the dentist or practice name, clinic name, email address, mobile number, city, working hours, treatments offered and the settings for the assistant. We store a hashed password, never the password itself.

If the clinic connects Google, we store an encrypted authorization token to read its primary Calendar and open Tasks, and make the booking, event or task changes its authorized staff request. Calendar changes stay on the connected primary calendar. The clinic can revoke access at any time from Google or from the dashboard.

The dashboard Schedule shows Zeliks bookings and open Google Tasks. It does not list ordinary Google Calendar events or copy them into patient records.

A booking record contains the patient name, the accompanying parent or guardian's name where given, an age, a contact phone number or email address, the appointment date and time, and the treatment booked.

Where a patient contacts the clinic through the assistant, we process the conversation to understand the request. What is kept from the conversation, and for how long, is set out below.

This includes health information. A booked treatment says something about a person's health, and Indian law treats medical records and health condition as sensitive personal data. We handle it accordingly: restricted access, encryption in transit and at rest, and no use beyond running the clinic's scheduling.

Many clinics using Zeliks treat children, and Indian law defines a child as anyone under eighteen.

Where a booking is for a child, we expect the clinic to have the consent of a parent or guardian, and we record the guardian's name and contact details alongside the booking so that all communication goes to an adult. We do not knowingly collect information directly from a child, we do not profile children, and we never use a child's information for advertising or behavioural tracking of any kind.

To show a clinic its diary, to offer appointment times that are genuinely free, to make and change bookings, to keep the clinic's Google Calendar in step, to send appointment confirmations and reminders the patient has agreed to receive, to let clinic staff manage their day over connected messaging channels, to keep the service secure and working, and to meet our legal obligations. We do not process it for any other purpose.

We send a patient an appointment message only where they have given their number and agreed to receive messages of that kind. Reminders about a booking and marketing messages are treated as separate agreements, and agreeing to one is not agreement to the other. Every message tells the recipient how to stop.

We keep clinical detail out of messages deliberately. A reminder names the clinic and the time, not the treatment.

We use the services below to run Zeliks. Each one sees only what it needs, and none of them is permitted to use clinic or patient information for their own purposes.

We also disclose information where the law requires it, and to professional advisers under a duty of confidence. We do not sell information to anyone, in any circumstances.

Our application servers are in Mumbai, India. Our database is hosted by Neon in Singapore. Some of the services listed above operate globally, so information may be processed outside India.

Where information leaves India we require the receiving service to protect it to a standard at least equal to the one described here.

When a clinic closes its account we keep its data for 90 days, then delete it. Those 90 days exist so a clinic that changes its mind, or that still needs an export, is not stranded. A clinic can ask us to delete sooner and we will.

While a clinic is a customer, a patient's record and the messages about their care are kept for 2 years after their most recent appointment, and every new booking starts that clock again. A patient who keeps coming back keeps their history; one who stops is cleared. We keep the conversation as well as the booking so a clinic can see what was actually discussed last time, which is part of treating someone properly rather than a separate purpose.

We do not use any of it to train the assistant. That would be a different purpose and would need a patient's own permission, not a clinic's. If that ever changes we will ask, and the service will keep working if the answer is no.

How long a medical record must be kept is the clinic's legal duty and its decision, not ours, and a clinic may ask us to hold or remove its records on a different schedule.

A conversation transcript is kept on the same 2 year clock as the appointment it belongs to. Security and access logs are kept for one year.

These 90 days are the automatic clock that starts when an account closes. Asking us to delete something is separate and faster: see deleting your information.

Information is encrypted in transit and at rest. Google Calendar and Tasks tokens are separately encrypted. Access to production systems is restricted and logged. Passwords are stored only as salted hashes. Each clinic's data is separated so no clinic can reach another's. We keep logs that let us detect and investigate unauthorised access. Before a change is released we test it against the cases that would expose or lose data: one clinic reaching another's records, a booking written twice, a cancellation that leaves the slot occupied.

No system is perfectly secure. If a breach affects your information we will tell you and the relevant authority as required by law.

You can ask us to show you what we hold about you, correct it, or delete it. You can withdraw consent to messages at any time, and withdrawing it is as easy as giving it.

To request deletion, email support@zeliks.tech with the words "delete my data" and enough detail for us to find the record: the clinic name, and the phone number or email address used for the booking. We will confirm within seven days and complete the deletion within thirty.

If you signed in with Google or connected Google Calendar, revoking access in your Google account disconnects it immediately; email us as well if you also want the stored record removed.

Where a clinic is the controller of the record, we will act on your request and tell the clinic, because the clinic may have its own legal duty to retain a medical record even after you ask us to remove it.

If something about how we handle your information is not right, you can complain and we must respond. Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, we publish a Grievance Officer:

Grievance Officer, ZELIKS
Meerut, Uttar Pradesh 250002
support@zeliks.tech

The Grievance Officer is a role rather than a named individual, and the address above is monitored. We acknowledge complaints within 48 hours and resolve them within one month.

If we change how we handle information in a way that affects you, we will update this page and change the date at the top. Where the change is significant we will tell clinics directly rather than relying on you noticing.

ZELIKS, a sole proprietorship of Ammar Mahmood, registered at Meerut, Uttar Pradesh 250002. Udyam registration UDYAM-UP-56-0173102. Email support@zeliks.tech.