CERATICS & CLINICAL OS — STATUTORY MASTER PRIVACY POLICY & DATA GOVERNANCE FRAMEWORK
Effective Date: October 1, 2026 | Master Version 4.1
Operating Entity: Ceratics, a proprietorship registered under Udyam (UDYAM-MH-26-1256555)
Governing Law: Republic of India | Seat of Dispute: Pune, Maharashtra
Platform URLs: ceratics.com | clinicalos.ceratics.com
Summary of Key Privacy Principles
- Who we are: Ceratics develops and operates Clinical OS, a practice management platform for cosmetic dermatology and medical aesthetic practices in India.
- Our roles: The treating healthcare clinic is the Data Fiduciary for patient medical records. Ceratics is the Data Processor acting on clinic instructions. For clinic staff accounts, billing, website visitors, and security logs, Ceratics is the Data Fiduciary.
- Data storage: Primary databases and clinical media are stored in India (AWS Mumbai region and Cloudflare R2). Sub-processors route messages and process telemetry globally over TLS 1.3 encryption.
- No AI model training: We do not use clinical photos, injection coordinates, or medical notes to train or fine-tune artificial intelligence models.
- WhatsApp notifications: Messages contain only appointment confirmations and generic notices. Medical details and prescriptions are accessed via secure, time-limited portal links.
- Data retention: Clinical records are retained as directed by the clinic and applicable Indian medical regulations. Technical security logs are preserved for 12 months.
- Patient control: You may opt out of automated WhatsApp messages at any time by replying STOP.
- Grievance contact: For questions or data deletion requests, contact our Statutory Grievance Officer at privacy@ceratics.com.
1. Legal Architecture & Statutory Role Delineation
This Master Privacy Policy governs the processing of personal data across Ceratics and its clinical operating software, Clinical OS. In accordance with the Digital Personal Data Protection Act, 2023 and applicable Information Technology rules, legal roles are defined as follows:
- Data Fiduciary (The Healthcare Practice): The medical aesthetics, cosmetic dermatology, or plastic surgery clinic where the Data Principal (patient) seeks diagnosis or treatment acts as the statutory Data Fiduciary under the Digital Personal Data Protection Act, 2023. The clinic determines the purpose, collects patient consent, prescribes treatments, and governs patient records.
- Data Processor (Ceratics for Patient Records): Ceratics acts as a Data Processor under the Digital Personal Data Protection Act, 2023, providing multi-tenant cloud software, cryptographic storage, and API routing on documented instructions from the Data Fiduciary.
- Data Fiduciary (Ceratics for Direct Services): For clinic staff accounts, subscription billing, website visitors, cookies, and platform security logs, Ceratics determines the purposes and acts as the Data Fiduciary.
- Data Principal (The Individual): The patient, parent or lawful guardian, Registered Medical Practitioner (RMP), or clinic staff member whose personal data is processed.
- Data Storage & Infrastructure Locations: Primary databases, encrypted electronic medical records (EMR), clinical photographs, prescription ledgers, and automated backups are stored in the AWS Mumbai (
ap-south-1) region and Cloudflare R2 storage within India. Certain processing occurs outside India through named sub-processors, including Meta for WhatsApp message routing, Sentry for error telemetry, Resend for email delivery, and edge delivery networks over TLS 1.3 encryption.
2. Categories of Personal Data Processed & 1-to-1 Purpose Mapping
In accordance with the Digital Personal Data Protection Act, 2023 and Meta WhatsApp Cloud API Technology Provider Review standards, Ceratics processes only the minimum necessary personal data required to deliver clinical operating services. Every data category is mapped to a distinct operational purpose:
| Data Category | Specific Data Elements Collected | Lawful & Operational Purpose |
|---|---|---|
| Clinic Staff & Doctors | Full legal name, professional email, mobile phone number, clinic role/designation, NMC / State Medical Council registration number, digital signature tokens. | Authenticating staff accounts, enforcing Role-Based Access Control (RBAC), recording practitioner identities on statutory electronic prescriptions, and maintaining audit logs. |
| Patient Identifiers & Demographics | Patient full legal name, date of birth, biological sex, age affirmation (+18 status), normalized Indian mobile phone number (+91), residential address, emergency contact, and 6-digit PIN code. | Creating and maintaining clinical patient charts, routing appointment confirmations, and verifying age-gated consent pathways. |
| Minor Demographic & Parental Verification Data | Minor patient legal name, date of birth, verified parent or legal guardian name, relationship to minor, and affirmative parental consent verified via +91 WhatsApp OTP. | Enforcing statutory age gating and verifying lawful parental/guardian consent prior to processing minor patient data pursuant to the Digital Personal Data Protection Act, 2023. |
| Appointment Records | Appointment date, scheduled time slot, procedure/service requested, assigned treating doctor/RMP, clinic location, and booking status (confirmed, cancelled, rescheduled). | Orchestrating clinic calendar schedules, preventing practitioner double-booking, and triggering automated reminder notifications. |
| Message Content & Delivery Telemetry | WhatsApp message text (appointment reminders, general scheduling updates, secure portal access links), dispatch timestamps, delivery status (sent, delivered, read), and error codes. | Delivering transactional appointment alerts requested by the patient, displaying message history to authorized clinic staff, and tracking delivery status. Messages contain only appointment details and generic notices, with a secure link for anything clinical. |
| Verifiable Opt-In & Consent Records | Digital timestamp of consent, patient IP address, OTP verification log, Eighth Schedule language preference, and check-box selections. | Evidencing lawful opt-in consent pursuant to the Digital Personal Data Protection Act, 2023, telemedicine guidelines, and registered communication templates. |
| Sensitive Clinical & Prescription Records | Clinical dermatological histories, known drug allergies, procedural notes, 2D facial anatomy injection mapping coordinates, dosage records for Schedule H/H1 substances (Botulinum Toxin, Hyaluronic Acid dermal fillers, Isotretinoin), CDSCO batch/lot numbers, and digital prescriptions. | Facilitating in-clinic clinical care, medical safety tracking, CDSCO materiovigilance reporting, and statutory medical record keeping under applicable National Medical Commission regulations. |
| Diagnostic Procedural Photography | Pre-treatment, intra-procedure, and post-treatment clinical photographs of dermatological treatment areas. | Clinical diagnostic reference and procedural documentation. Stored in encrypted private Cloudflare R2 storage; we do not use patient photos for AI training, and photos are not used for marketing without standalone consent. |
| Billing & Tax Invoices | Practice GSTIN, treatment package redemptions, wallet ledger balances, Razorpay payment intent tokens, UPI transaction IDs, and 18% GST tax invoices with SAC codes 998314 / 999319. (Payment card numbers or CVVs are not processed or retained by Ceratics). | Generating statutory GST tax invoices, calculating package deductions, and complying with statutory cash receipt limits. |
| Technical Security Logs & Cookies | Session JWTs, CSRF security tokens, client IP address (hashed for rate limiting), device browser user-agent, Turnstile challenge tokens, and access logs. | Maintaining user authentication, enforcing tenant-isolated Row-Level Security, preventing CSRF and bot attacks, and fulfilling CERT-In reporting obligations. |
Cookies & Website Visitors
Ceratics acts as the Data Fiduciary for data collected from visitors to our public website and authenticated clinic staff accessing Clinical OS. We use strictly necessary functional and security cookies to operate our services:
| Cookie / Identifier | Provider & Type | Purpose & Description | Lifespan |
|---|---|---|---|
sb-*-auth-token | Supabase (First-Party) | Maintains authenticated clinic staff sessions across Clinical OS. HttpOnly, Secure, SameSite=Lax. | Session / Configurable |
clinic_idle_timeout | Ceratics (First-Party) | HMAC-signed security cookie to enforce automated logout after prolonged inactivity. | Session |
code_verifier | Supabase (First-Party) | PKCE security verifier used during passwordless email link authentication. | Temporary (Login) |
cf_clearance / Turnstile | Cloudflare (Third-Party) | Distinguishes human users from automated bots and protects against DDoS attacks. | Up to 1 Year |
NEXT_LOCALE | Ceratics (First-Party) | Remembers user interface language preference. | 1 Year |
We do not use third-party tracking or behavioral advertising cookies. To manage cookie preferences or for inquiries, contact us at privacy@ceratics.com.
3. AI Non-Ingestion Commitment (No Clinical Data for Model Training)
Ceratics makes a binding commitment to all Data Fiduciaries and Data Principals:
We do not ingest, aggregate, tokenize, sublicense, or utilize patient clinical photographs, facial mapping coordinates, skin lesion imagery, or practitioner clinical notes to train, fine-tune, evaluate, or benchmark artificial intelligence (AI), machine learning (ML), neural networks, or computer vision models. All clinical records remain the confidential property of the clinic and patient.
4. Meta Platforms & WhatsApp Business Cloud API Disclosures
Ceratics and Clinical OS integrate with the Meta WhatsApp Business Cloud API, operated by Meta Platforms, Inc. (1601 Willow Road, Menlo Park, CA 94025, USA) and Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), to deliver automated transactional healthcare notifications on behalf of clinics. In accordance with Meta Platform Terms and Developer Policies, the following disclosures govern this integration:
1. Transmission Across Meta Servers & Application of Meta Terms
WhatsApp notifications, status updates, and inbound responses pass through WhatsApp and Meta's global cloud server infrastructure and telecommunications relays. While API payload data transmitted between Ceratics and Meta is encrypted in transit over TLS 1.3, the routing and processing of messages across Meta's network are governed directly by Meta's agreements:
2. Clinic Control vs. Technical Processor Delineation
The healthcare clinic (the treating practice) controls all patient data, determines which patients receive communications, schedules appointments, verifies informed consent, and governs messaging templates. Ceratics operates as a Technical Solution Provider and Data Processor, executing programmatic API calls to Meta solely on documented instructions from the clinic under a Data Processing Agreement. Ceratics does not initiate unsolicited marketing communications or sell patient telephone numbers.
3. Transactional Purpose Limitation & Reception Message History
In adherence with Meta developer guidelines, our WhatsApp Cloud API integration is restricted to operational purposes:
- Authentication & Security: Synchronous WhatsApp OTP login verification and device authorization.
- Appointment Reminders: Automated reminder notifications and scheduling confirmations.
- Pre-Care Preparation Alerts: General pre-treatment reminders and appointment check-in guidelines.
- Minor Parental Verification: Parental consent verification logs for minor patients under the Digital Personal Data Protection Act, 2023.
- Electronic Access Links: Time-limited, secure links (
/p/{token}) to view electronic prescriptions and GST tax invoices. - Reception Message History: Inbound patient replies (such as confirmations or rescheduling requests) are displayed as conversational history within the clinic's administrative dashboard to facilitate front-desk coordination.
4. Prohibition of Plaintext Protected Health Information
To protect patient privacy on mobile devices, messages contain only appointment details and generic notices. Full clinical diagnoses, detailed prescription regimens, and diagnostic photographs are not transmitted in plaintext inside WhatsApp message bodies. Patients view sensitive clinical details through secure, time-limited portal links (/p/{token}) requiring browser verification.
5. Cryptographic Webhook Verification & Ingestion Scope
Inbound webhook events from Meta are cryptographically validated using HMAC-SHA256 signature verification (X-Hub-Signature-256) against our registered Meta Application Secret. When processing callbacks, Ceratics ingests solely the Meta Message ID (wamid), recipient phone number (+91), delivery status (sent, delivered, read), patient response text, and delivery failure error codes.
6. Patient Opt-Out & Consent Revocation ("STOP")
Patients may revoke consent for automated communications at any time. Replying STOP, UNSUBSCRIBE, or REVOKE to any WhatsApp message logs an opt-out event and halts automated outbound messaging to that number.
5. Authorized Third-Party Sub-Processors
In accordance with the Digital Personal Data Protection Act, 2023, Ceratics engages vetted infrastructure sub-processors. Major third-party cloud infrastructure providers maintain independent SOC 2 Type II and ISO certifications:
| Sub-Processor | Corporate Entity | Purpose & Role | Data Scope Handled | Infrastructure Location |
|---|---|---|---|---|
| Supabase | Supabase, Inc. | Managed Relational Database (PostgreSQL), Auth & Multi-Tenant RLS | Encrypted EMR, Photos, User Auth, Audit Logs | AWS Mumbai (ap-south-1), India |
| Cloudflare | Cloudflare, Inc. | Cloudflare R2 Storage, Edge CDN, DNS & Turnstile Bot Defense | Encrypted Photos, Client IP (hashed), Turnstile Tokens | Indian Edge PoPs (Mumbai, Delhi) & Global Edge |
| Vercel | Vercel, Inc. | Application Edge Runtime & Serverless Compute | Ephemeral HTTP headers, Anonymized IP (hashed) | Edge PoPs (Mumbai bom1) & Global Edge |
| Meta Platforms | Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | WhatsApp Business Cloud API Messaging Gateway | Recipient Phone (+91), Delivery Status, Template Content | Global Routing / In-Transit TLS 1.3 |
| MSG91 | Walkover Technologies Pvt. Ltd. | Domestic TRAI DLT SMS Gateway & Critical 2FA OTPs | Recipient Mobile (+91), Transactional SMS Body | India Domestic Telephony Infrastructure |
| Razorpay | Razorpay Software Pvt. Ltd. | Payment Gateway & UPI Rails | Invoice Amount, Customer ID, VPA | Mumbai / Bangalore, India |
| Upstash | Upstash, Inc. | Serverless Redis Caching, Cron Locks & Rate Limiting | Rate limit counters, cron lock keys | AWS Mumbai (ap-south-1) / Global In-Transit |
| Resend | Resend, Inc. | Transactional Email Dispatch | Recipient Email, OTP Verification Token | Global Routing / In-Transit TLS 1.3 |
| Sentry | Functional Software, Inc. (Sentry) | Application Error Monitoring & Crash Telemetry | Software stack traces, client browser error events (PII scrubbing enabled) | Global Cloud / In-Transit TLS 1.3 |
6. Security Safeguards, Data Retention Schedules & Clinic Offboarding
Ceratics implements technical safeguards, access controls, and retention schedules calibrated to applicable Indian legal requirements:
1. Technical Security Safeguards & Access Controls
In compliance with the Digital Personal Data Protection Act, 2023 and Information Technology rules:
- Field-Level Encryption: Sensitive health records and 2D facial anatomy injection mapping coordinates are encrypted at rest using AES-256-GCM authenticated encryption.
- Encrypted Media Storage: Patient before-and-after clinical photographs and consent files are stored in private Cloudflare R2 vaults and accessed via signed, short-lived URLs.
- Row-Level Security (RLS) Multi-Tenant Isolation: Database access is governed by PostgreSQL Row-Level Security policies. Every query enforces tenant isolation, preventing any clinic from accessing another practice's records.
- Role-Based Access Control (RBAC): Access privileges are segregated between Registered Medical Practitioners (RMPs), clinical assistants, front-desk receptionists, and system administrators.
- In-Transit Encryption: All communications with the Meta WhatsApp Cloud API, payment gateways, and client browsers enforce TLS 1.3 with HSTS (HTTP Strict Transport Security).
2. Data Retention Schedules
Clinical records are kept for the period set by the clinic and applicable law; default and minimum periods are configured per clinic:
| Data Category | Statutory Basis / Authority | Retention Period | Post-Retention Action |
|---|---|---|---|
| Clinical EMR, Injection Notes & Prescriptions | National Medical Commission Guidelines & Clinic Policy | Period set by clinic (minimum 3 years under NMC guidelines) | Secure Database Purge |
| Diagnostic Procedural Photography | Medical Records Documentation & Clinic Policy | Co-terminus with clinical chart as set by clinic | Permanent Object Deletion |
| GST Tax Invoices & Billing Ledgers | Central Goods and Services Tax (CGST) Act | 6 Years (72 Months) from annual return due date | Ledger Decommissioning |
| Verifiable Consent & Opt-In Receipts | Digital Personal Data Protection Act, 2023 | Duration of clinical care + statutory medical retention | Permanent Record Erasure |
| WhatsApp Telemetry & Delivery Logs | Operational Audit & Troubleshooting | 90 Days | Automated Deletion |
| Technical Security & Processing Logs | CERT-In Directives & Security Baseline | 12 Months | Secure Log Purge |
3. Medical Record Retention & Erasure Override
Under National Medical Commission regulations, Registered Medical Practitioners must preserve clinical records for a minimum period (typically 3 years from the date of treatment).
Where a patient exercises their right to data erasure, the Digital Personal Data Protection Act, 2023 recognizes exceptions where data retention is required by other laws in force in India. In such cases, clinical records are retained in encrypted storage until the mandatory legal period expires, after which they are securely deleted.
4. Clinic Offboarding & Workspace Decommissioning Protocol
When a subscribing medical practice terminates its agreement or offboards from the platform:
- Data Export Window: The clinic is provided a transition window to export patient charts, registers, and billing history in standard formats (such as CSV, JSON, and PDF reports).
- Token & Credential Invalidation: Active WhatsApp credentials and session keys stored in active databases are cleared upon disconnection or service termination.
- Storage Decommissioning: Following the export window, active production databases are decommissioned, and any records subject to statutory retention are archived until the limitation period expires, after which they are permanently deleted.
5. Secure Deletion Standards
When data reaches the end of its retention lifecycle or is purged upon an approved erasure request, records are permanently deleted from active databases and object storage buckets using industry-standard secure deletion procedures.
7. User Data Deletion Instructions & Meta Developer Policy § 4.b Runbook
In compliance with Meta Developer Policy Section 4.b, the WhatsApp Business Terms of Service, and the Digital Personal Data Protection Act, 2023, Ceratics provides protocols for clinics and patients to request the erasure of personal data and messaging identifiers:
Method 1: Self-Service Deletion for Healthcare Clinics (Meta WABA Disconnection)
Healthcare clinics utilizing the Meta WhatsApp Business Cloud API integration may disconnect their WhatsApp Business Account (WABA) at any time:
- Sign in to your authenticated clinic administrative console (
[clinic-slug].clinicalos.ceratics.com). - Navigate to Settings > Integrations > WhatsApp Business API.
- Click "Disconnect Integration & Clear System Tokens".
- Upon confirmation, the platform unsubscribes our application from the clinic's WhatsApp Business Account (via Meta's subscribed_apps endpoint), invokes Meta Graph API permission revocation to invalidate access tokens, and permanently purges stored access credentials and webhook configurations from active databases.
Method 2: Assisted Erasure for Patients (Data Principals)
Patients receiving automated appointment reminders or digital prescriptions via WhatsApp have two pathways to delete their data:
- Instant WhatsApp Opt-Out: Reply "STOP", "UNSUBSCRIBE", or "REVOKE" directly to any inbound WhatsApp message to halt automated messaging to that number.
- Formal Data Deletion Request (Email / Portal): Dispatch an erasure request to our Statutory Grievance Redressal Cell at privacy@ceratics.com with the subject:
DATA DELETION REQUEST - [10-Digit Mobile Number], or submit via our dedicated public portal at ceratics.com/data-deletion . Please include: Full Legal Name, 10-digit Indian Mobile Number (+91), Treating Clinic Name, and Desired Deletion Scope.
3. Scope of Messaging & Account Data Purged
Upon verified execution of an erasure request, Ceratics deletes:
- Stored WhatsApp Phone Number IDs and account associations.
- Meta Message IDs (
wamid) and delivery status logs. - Temporary messaging session tokens and portal link credentials.
- Conversational message histories and customer contact mappings.
- Non-statutory demographic profiles and notification preferences.
4. Execution Timelines & Verification
- 48-Hour Acknowledgment: We aim to acknowledge deletion requests within 48 business hours with a tracking reference.
- 30-Day Purge SLA: Verified non-statutory personal data is expunged from active databases within 30 calendar days.
- Statutory Medical Retention: As detailed in Section 6, clinical EMR charts and prescription records are preserved in accordance with applicable medical regulations until the statutory retention period expires.
- Confirmation: Written confirmation of deletion is issued to the requesting party via email upon completion.
8. Statutory Data Principal Rights & Consent Revocation
Under Chapter III of the Digital Personal Data Protection Act, 2023, every patient, parent/guardian, healthcare practitioner, and clinic staff member (Data Principal) possesses statutory rights:
Obtain a digital summary of personal data and processing activities conducted by Ceratics, along with the identities of authorized third-party sub-processors.
Request correction of inaccurate, obsolete, or incomplete contact details or demographic information across clinic records.
Withdraw consent at any time and obtain erasure of non-statutory personal data. Opt out of WhatsApp messaging immediately by replying "STOP". Clinical records remain subject to statutory medical retention rules.
Access our designated Statutory Grievance Redressal Officer with written acknowledgment within 48 business hours and resolution within 30 calendar days.
Nominate a representative or legal heir to exercise data principal rights on your behalf in the event of death or incapacity.
9. Cybersecurity Incident Notification & Policy Revision Procedures
In accordance with the Information Technology Act, 2000, CERT-In directions, and the Digital Personal Data Protection Act, 2023:
1. CERT-In Incident Reporting
Ceratics maintains operational incident response procedures. Any confirmed cybersecurity incident or server compromise will be reported to the Indian Computer Emergency Response Team (CERT-In) within six (6) hours of confirmation in accordance with applicable directives.
2. Notification to Affected Clinics
In the event of a verified security incident affecting personal or health data, Ceratics will notify affected clinic administrators without undue delay following confirmation, detailing the nature of the incident and containment measures, and supporting clinics in issuing required notices.
3. Effective Date & Notice of Material Policy Modifications
This Master Privacy Policy is effective as of October 1, 2026. Ceratics reviews this policy periodically to maintain alignment with Indian statutory amendments and Meta Platform policies. Material revisions will be communicated to subscribing clinics via registered administrative email or platform alerts at least fifteen (15) to thirty (30) days prior to the effective date. Continued use of Ceratics services after the effective date constitutes acknowledgment of the revised terms.
10. Statutory Grievance Redressal Officer Disclosures
In accordance with the Digital Personal Data Protection Act, 2023 and applicable Information Technology rules: