This Privacy Policy explains how Viyora Tech (“we”, “our”, “us”) collects, stores, processes and protects personal information when you use Viyora, our cloud-based clinic management platform.
Viyora is developed and operated by Viyora Tech.
This Privacy Policy complies with the Digital Personal Data Protection Act, 2023 (India), the Information Technology Act, 2000 and other applicable laws.
Throughout this policy:
- Viyora refers to the software platform.
- Viyora Tech refers to the legal business operating the platform.
1. Data we collect
a) Account & clinic data
- Name, work email, phone, clinic name, GSTIN, PAN, business address
- Doctor / staff role, licensing state, working hours
- Billing address and Razorpay-issued payment identifiers (we do not store card numbers or CVV)
b) Patient records (uploaded by clinics)
- Name, contact details, date of birth, gender
- Medical history, allergies, special conditions, dental charts, treatment notes
- X-ray images (when uploaded), consent form signatures, warranty cards
- Appointment history, invoices, prescriptions
c) Technical data
- IP address, browser, device, and OS metadata
- Session cookies (essential only; no tracking cookies without consent)
- Product analytics via PostHog (anonymised where possible)
2. How we use your data
- To provide, maintain, and improve the Service
- To generate AI-assisted clinical suggestions using Anthropic Claude (via the Emergent LLM proxy — data is not used to train third-party models)
- To send appointment reminders, consent links, and warranty notifications via WhatsApp (Gupshup) on your clinic’s behalf
- To process subscription payments through Razorpay
- To detect fraud, abuse, and enforce our Terms
- To comply with legal, tax, and regulatory obligations
3. Legal basis (DPDP Act, 2023)
We process personal data on the basis of your consent, contractual necessity, and legitimate purposes as defined under Section 7 of the DPDP Act. For patient records uploaded by clinics, the clinic acts as the Data Fiduciary and warrants that consent has been obtained from the patient. Viyora acts as a Data Processor and processes such data solely on the clinic’s instructions.
4. Data sharing & sub-processors
We do not sell your personal data. We share it only with vetted sub-processors under written data-processing agreements:
- Razorpay — payment processing (PCI-DSS compliant)
- Gupshup — WhatsApp message delivery (Meta BSP)
- Anthropic (via Emergent LLM proxy) — clinical AI reasoning (data not retained for model training)
- Supabase — authentication and social login
- MongoDB Atlas / Cloud Kubernetes hosting — primary database and application hosting (India / Asia region preferred)
Where cross-border transfer occurs, we rely on the standard contractual clauses and the whitelist mechanism under the DPDP Act.
5. Data retention
- Active clinic account: retained for as long as your subscription is active.
- After account closure: exported on request, then permanently deleted within 30 days.
- Financial records (invoices, GST) are retained for 8 years as required by Section 36 of the CGST Act.
- Backup snapshots are rotated on a 30-day cycle.
6. Data security
- TLS 1.2+ encryption in transit; AES-256 at rest for databases and backups.
- Bcrypt-hashed passwords with per-user salts. JWT session tokens.
- Row-level tenant isolation via
clinic_id-scoped queries and MongoDB compound indexes. - Role-based access control (Admin, Doctor, Receptionist).
- Razorpay webhook and payment signatures verified via HMAC-SHA256.
- Least-privilege access to production systems. Access reviews every 90 days.
7. Your rights (Data Principal rights)
Under the DPDP Act you have the right to:
- Access the personal data we hold about you.
- Request correction or update of inaccurate data.
- Request erasure (subject to legal retention requirements).
- Withdraw consent at any time. Withdrawal does not affect prior lawful processing.
- Nominate an heir to receive your data in the event of death or incapacity.
- File a grievance with our Data Protection Officer.
8. Grievance officer
In accordance with Section 8(9) of the DPDP Act, our Grievance Officer is:
Viyora Tech
Email: admin@viyora.co.in
Response time: within 15 working days
9. Children’s data
Where a patient is a minor (below 18), the clinic must obtain verifiable consent from a parent or lawful guardian before uploading records to Viyora, in line with Section 9 of the DPDP Act.
10. Changes to this policy
We will notify you by email at least 14 days before material changes take effect. The date at the top of this page indicates the most recent revision.
11. Google API user data & Limited Use
Where a doctor connects a Google Calendar to Viyora, we request the narrow scopes calendar.events and calendar.calendarlist.readonly only. Viyora’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used for advertising and never used to train AI/ML models. See our Limited Use disclosure for the full breakdown, retention rules, and revocation instructions.
12. Contact
For any privacy-related questions or requests, please contact:
Viyora Tech
Email: admin@viyora.co.in
Website: https://viyora.co.in
Phone: +91 9810453892