Privacy Policy

This privacy notice for Clinirise & Buildsensy Innovate LLP (doing business as "Clinirise," "Company," "we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

• Visit our website at https://www.clinirise.com, or any website of ours that links to this privacy notice.
• Engage with us in other related ways, including any sales, marketing, customer support, or events.

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at connect@clinirise.com.

Summary of key points

• What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with Clinirise and the Services, the choices you make, and the products and features you use.
• Do we process any sensitive personal information? Yes, for patients who message a clinic through our WhatsApp assistant: we process health-related details (such as the reason for a visit) on the clinic's behalf, only after the patient's explicit consent. See Patient data in the Clinirise WhatsApp assistant.
• Do we receive any information from third parties? Only in the cases this notice describes: a clinic gives us the details of the staff and doctors it invites, WhatsApp (Meta) passes us the messages patients send to a clinic, and Google gives us your name and email if you choose Sign in with Google. We do not obtain information from marketing partners or social media platforms.
• How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with the law.
• In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties, such as essential service providers.
• How do we keep your information safe? We have organizational and technical processes in place to protect your personal information. However, no electronic transmission over the internet can be guaranteed to be 100% secure.
• What are your rights? Under applicable Indian laws, you have the right to access, correct, and request the erasure of your personal data, as well as the right to withdraw consent.

1. What information do we collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

The personal information we collect may include the following:

• Names
• Phone numbers
• Email addresses
• Job titles or Clinic details
• Staff sign-in details: a Google account, or an email address and password (Google's sign-in service checks the password; we do not store it), and the one-time sign-in codes we send on WhatsApp
• Billing addresses
• Payment details (processed securely via our third-party payment gateways)

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, location, and information about how and when you use our Services. This information is needed to deliver the Services and keep them secure. We do not use it for analytics, advertising or profiling (see section 5).

Information collected from other sources

In Short: We do not collect data about you from marketing partners or social media.

We receive personal information from other sources only as described in this notice: a clinic gives us the names and contact details of the staff and doctors it invites to Clinirise; WhatsApp (Meta) and our WhatsApp service provider pass us the messages that patients send to a clinic (section 4A); and Google gives us your name and email address if you choose Sign in with Google. We do not obtain information about you from marketing partners, affiliate programmes or social media platforms.

2. How do we process your information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts.
• To deliver and facilitate delivery of services to the user.
• To respond to user inquiries and offer support.
• To send administrative information to you.
• To fulfill and manage your orders and subscriptions.
• To save or protect an individual's vital interest (e.g., to prevent harm).

3. What legal bases do we rely on?

In Short: We process your data in compliance with applicable Indian laws, including the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023.

We only process your personal information when we believe it is necessary and we have a valid legal reason to do so:

• Consent: We may process your information if you have given us explicit permission to use your personal information for a specific purpose. You can withdraw your consent at any time.
• Legitimate Business Interests: We may process your data when it is reasonably necessary to achieve our legitimate business interests.
• Legal Obligations: We may process your information where we believe it is necessary for compliance with Indian legal obligations, such as cooperating with a law enforcement body or regulatory agency.

4. When and with whom do we share your information?

In Short: We may share information in specific situations and with essential third parties.

We may need to share your personal information in the following situations:

• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Service Providers: We may share data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf (e.g., hosting, AI, WhatsApp delivery, email delivery and payment processing). Section 4A names them and says where they process data.

4A. Patient data in the Clinirise WhatsApp assistant

In Short: When you message a clinic that uses Clinirise, the clinic is responsible for your data and we process it on the clinic's behalf, only after you consent. You can withdraw consent at any time by sending STOP.

Who is responsible: The clinic you message is the Data Fiduciary for your personal data under the Digital Personal Data Protection Act, 2023. Clinirise is its Data Processor and acts only on the clinic's instructions.

What we process:

• Your WhatsApp name and phone number
• Your messages and voice notes to the clinic
• Appointment details: date, time, doctor and reason for the visit
• Names of family members you book for
• Your language preference and your consent and opt-out records

Why: To book, reschedule, cancel and remind you of appointments; to check on you after a visit; to send you the clinic's Google review link, but only if you ask for one, and never for a child's visit; to answer your questions about the clinic; to pass your request to clinic staff when needed; and to keep the consent records the law requires. We do not use your data for advertising, and our AI providers do not use it to train their models.

The assistant is not a doctor: it is an automated assistant for appointments and clinic information. It does not give medical advice. In an emergency it tells you to call the clinic or 112, and if you mention self-harm it gives you Tele-MANAS (14416, free, 24x7) and 112.

Patients under 18: the assistant is for people aged 18 or over, or a parent or guardian booking for a child. After you consent, it asks whether the patient is 18 or older and keeps your answer. If the patient is under 18, no AI is used for that chat from then on: a parent or guardian confirms they are making the booking, and booking is done step by step with buttons and fixed messages. Appointment reminders and the short check-in after a visit still go to that number. Review links and recall reminders are never sent for a child's visit (see section 8).

Where your data is stored: in India. Our servers, the patient database and our application logs are in Mumbai. Google's own administrative audit logs for our cloud account, which record changes to our cloud set-up rather than your messages, are kept in Google's global location. Two things happen outside India: replies are written by an AI service, which processes your messages outside India, and WhatsApp (Meta) keeps copies of messages on its own servers outside India.

What the AI does not see: before anything goes to the AI, we replace the personal details our system holds or recognises in your messages with placeholders such as [NAME_1] or [PHONE_1]: your name, the names of family members you book for, your WhatsApp number and any phone numbers, email addresses, UPI IDs, date of birth or address you type. Aadhaar, PAN and card numbers are removed completely. The real details are put back in our own systems only after the AI replies, so the clinic still sees them. What you tell us about your visit, such as the reason or your symptoms, is still sent, because the assistant needs it to help you.

Service providers and where they process data:

• Google Cloud (Mumbai, India): our application servers and main patient database.
• Anthropic (United States company; processes data outside India): our main AI since 21 October 2026. It reads your message and writes the reply. Your name, phone number and the other personal details described above are replaced by placeholders first. What you say about your visit, such as the reason or your symptoms, is sent as you wrote it. Anthropic keeps requests for up to 30 days, longer only where the law or its usage-policy checks require it, and does not use them to train its models.
• Google Vertex AI, Gemini models (outside India possible): our backup AI, used when the main AI is not available. It gets the same message, with the same placeholders, through Google's global endpoint, which does not guarantee where the request is processed. Google does not use it to train its models. If Google's safety filters flag a request, Google may keep it for up to 90 days, for abuse checks only.
• Meta Platforms / WhatsApp (outside India): delivers messages between you and the clinic, and keeps copies on its own servers for a limited time.
• AiSensy (India): a WhatsApp Business Solution Provider. For clinics whose WhatsApp number is connected through AiSensy, it passes messages between that number and Meta, and keeps message records and delivery status on its platform. It also carries the one-time sign-in codes we send to clinic staff on WhatsApp.
• Sarvam AI (India): converts voice notes to text.
• Upstash (Mumbai, India): short-lived counters that protect the service from overload and stop the same message being handled twice. It holds no message content, names, phone numbers or health details.
• Qdrant Cloud (Frankfurt, Germany): holds only the clinic's own information, such as services and timings. To answer your question it receives a numeric search code made from your question, never the text itself, and stores nothing about you.
• Google Calendar (if your clinic connects it): your appointment is added to the clinic's calendar.
• Google Firebase Cloud Messaging and Apple's push service (outside India possible): deliver alerts to clinic staff's phones and browsers. An alert never contains what you wrote, the reason for your visit or your phone number; at most your first name and initial, if that staff member chose to see names.

Two more providers work for us but never receive patient data:

• GoDaddy (email): sends our emails to clinics and to our own team, such as billing notices and service alerts. These emails never contain patients' messages, names or phone numbers.
• Cashfree Payments (India): processes clinics' online subscription payments. It receives only the paying clinic's billing and payment details.

Each provider is bound by data protection terms. Transfers outside India are made under the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000, with your consent.

Withdrawing consent: Send STOP (or रोकें, थांबवा, "band karo"), or tap Opt Out, at any time. We then stop processing your messages and stop all reminders and check-ins, except where the law requires us to keep a record. If you later want to use the assistant again, we ask for your consent afresh.

Erasing your data: Send DELETE MY DATA and confirm with YES DELETE. We delete your conversations, session and profile, anonymise your appointment records (including the names of family members you booked for), and remove any copy on the clinic's Google Calendar. We keep a record that you consented and asked for erasure, with your number replaced by a one-way code, because the law requires us to be able to show this. Any request you made about your data or records is kept the same way: with that code instead of your number, and without your name or what you wrote. A request still open is closed.

Your rights and complaints: You can ask to access, correct or erase your data, or nominate someone to act for you, by contacting your clinic or our Grievance Officer (section 11), or by sending one of these words, as the whole message, to the clinic's WhatsApp number:

• MY DATA: a copy of the personal data the clinic holds about you.
• CORRECT MY DATA: correct, complete or update that data.
• NOMINEE: name someone to act for you if you die or are unable to act yourself.
• PRIVACY COMPLAINT: a complaint about how your data was handled.
• MY RECORDS: a copy of your medical records (MY MEDICAL RECORDS works too).

The same requests work in Hindi and Marathi, for example मेरा डेटा or माझा डेटा. You get a request number. Before answering, the clinic checks that it is really you. Requests about your data are answered within 30 days, and medical records are given within 72 hours. If you are not satisfied with the response, you can complain to the Data Protection Board of India.

5. Do we use cookies or tracking technologies?

In Short: No. Our website sets no cookies and uses no tracking technologies. It saves two display preferences on your own device.

Our website (clinirise.com) does not set cookies. It does not use web beacons, pixels, analytics, advertising or social media tracking tools, or any other third-party scripts.

The website saves two preferences in your browser's local storage, on your device only, so that the site looks the way you chose on your next visit:

• clinirise-theme: whether you chose the light or dark theme.
• clinirise-chat-lang: the language you picked in the sample chat on our home page.

These preferences are not sent to us or to anyone else, and they do not identify you. You can remove them at any time by clearing your browser's site data for clinirise.com; the site then uses its default settings.

Like any website, the website is delivered by our hosting provider, Google, which receives your IP address and browser details when your browser requests a page, so that it can deliver the page and protect the service. We do not use this information to track you.

If we ever start using cookies or similar technologies, we will update this notice before we do and, where the law requires it, ask for your consent first.

6. How long do we keep your information?

In Short: We keep patient data for the set periods below, then delete or anonymise it. A daily check applies these periods automatically.

For patients who message a clinic through the Clinirise WhatsApp assistant:

Your clinic may also keep its own records, outside Clinirise, for longer where the law requires it to, for example medical records.

We keep other information, such as clinic staff accounts and billing records, while the clinic uses our Services, and afterwards only as long as the law requires (for example, for tax and accounting). When we no longer need it, we delete or anonymise it.

7. How do we keep your information safe?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Transmission of personal information to and from our Services is at your own risk.

8. Do we collect information from minors?

In Short: A child's booking on WhatsApp uses no AI, and a parent or guardian must confirm it. We do not market to children.

Our website and the Clinirise staff app are for adults. We do not market to children under 18.

A parent or guardian can book for a child on the clinic's WhatsApp. This is how it works:

• After the person messaging gives consent, the assistant asks whether the patient is 18 or older. We rely on the answer given.
• If the patient is under 18, no AI replies are used in that chat from then on. Booking is done step by step, with buttons and fixed messages only.
• A parent or guardian must confirm they are making the booking by tapping a button. We keep a record of that tap.
• No review links or recall reminders are sent for a child's visit.
• Doctors' notes for a number used to book for a child are kept for 21 years, as the clinic's medical record (see section 6).

9. What are your privacy rights?

In Short: Under Indian law, you have specific rights regarding your personal data.

Depending on your use of our Services, you have the following rights regarding your personal data:

• Right to Access: You can request copies of your personal data held by us.
• Right to Correction: You can request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to Erasure: You have the right to request that we erase your personal data, under certain conditions.
• Right to Withdraw Consent: If we are processing your personal information based on your consent, you have the right to withdraw your consent at any time.
• Right to Nominate: You can name a person to exercise your rights for you if you die or are unable to act yourself.
• Right to Grievance Redressal: You can complain about how your data is handled; if you are not satisfied with the answer, you can complain to the Data Protection Board of India.

To exercise any of these rights, please contact our Grievance Officer using the details provided below. If you are a patient of a clinic that uses Clinirise, you can also send the WhatsApp requests described in section 4A. We answer every request and complaint within 30 days of receiving it.

10. Do we make updates to this notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant Indian laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date and will be effective as soon as it is accessible. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

11. Grievance Officer & contact information

In accordance with the Information Technology Act, 2000, and the rules made thereunder, the name and contact details of the Grievance Officer are provided below. Grievances are resolved within one month of receipt.

If you have any further questions or comments about this notice, you may contact us by post at our registered office: