DPDP Act

We collect only the personal data needed to run Clicovery, use it only for the purposes in our Privacy Policy, protect it with reasonable security safeguards, and delete it when it is no longer needed and the law does not require us to keep it. We are aligning our practices with the DPDP Act and its Rules as their provisions come into force.

Clicovery as data fiduciary

For the accounts of clinic owners and staff, and for demo and support requests, Clicovery decides how the data is used. We process it to provide the service you signed up for, which is the lawful basis under the DPDP Act, and to meet our legal obligations.

Clicovery as data processor

For patient data, each clinic is the data fiduciary. It decides what to record and why, and is responsible for giving patients notice and obtaining consent. Clicovery processes that data only on the clinic’s behalf, under our Terms of Service.

As a data principal, you have the right to:

• Information — a summary of your personal data we process, how we process it, and who we have shared it with.
• Correction and erasure — to have inaccurate or incomplete data corrected or updated, and data we no longer need erased, unless the law requires us to keep it.
• Withdraw consent — where processing relies on your consent, as easily as you gave it. Processing already done remains lawful.
• Grievance redressal — to have complaints handled by our Grievance Officer before going to the Data Protection Board of India.
• Nomination — to name someone to exercise your rights if you die or become unable to.

• Email security@clicovery.com from the email address registered to your Clicovery account, stating which right you want to exercise.
• We acknowledge your request within 3 business days. We may ask you to confirm your identity before acting on it.
• We respond within 30 days. If we cannot do what you ask — for example because the law requires us to keep billing records — we will explain why.

If you withdraw consent or ask us to erase data that is essential to your account, we may no longer be able to give you access to Clicovery. Records showing who did what at a clinic belong to the clinic and may be kept for its own records and legal obligations.

• Keep each clinic’s data separate, and limit access within a clinic to the staff and branches the clinic allows.
• Use only service providers bound to protect personal data, and share only what each one needs.
• Keep personal data accurate where we are responsible for it, and delete it when its purpose is served, subject to legal retention.
• Help clinics respond to their patients’ requests, and process patient data only on the clinic’s instructions.
• Publish the contact details of our Grievance Officer.

If a personal data breach occurs, we will:

• act straight away to contain and investigate it;
• tell affected clinics without undue delay, so they can inform their patients; and
• notify the Data Protection Board of India and affected people in the form and time the law requires.

Report suspected breaches to security@clicovery.com.

If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is operational.