Privacy Policy

Careflow ("we", "us", "our") is a clinic management software product of Webneco Infotech, the parent company that develops and operates the platform. Careflow provides tools for doctors and clinics, including patient records, appointments, billing, WhatsApp messaging, recalls, and reviews.

Unless the context requires otherwise, references to Careflow in these policies include Webneco Infotech in its capacity as operator and merchant of record for platform subscriptions.

For privacy questions, contact [email protected].

When a clinic uses Careflow to manage patient data, the clinic is typically the Data Fiduciary / Controller for patient information. Careflow acts as a Data Processor / Service Provider processing that data on the clinic's instructions.

For account, billing, and website data about clinic staff who sign up for Careflow, Careflow is the Data Fiduciary / Controller.

Depending on how the product is used, we may process:

• Account data: name, email, phone, role, clinic name, login credentials (hashed passwords)
• Clinic configuration: settings, doctor profiles, service catalog, WhatsApp Business configuration
• Patient data entered by the clinic: demographics, contact numbers, medical history fields, appointments, consultations, consent records, invoices, recalls, and related notes
• Communications metadata: WhatsApp message logs, delivery status, and related template keys
• Technical data: device/browser type, IP address (for security and consent audit), cookies, and usage logs
• Payment and subscription data processed via our payment partners (for example Razorpay), as needed to bill the clinic for Careflow plans. Platform fees are collected on behalf of Webneco Infotech, the parent company and merchant of record

We use data to:

• Provide, secure, and improve the Careflow service
• Enable multi-tenant clinic isolation so one clinic cannot access another's data
• Send transactional product messages (password-related, service notices)
• Enable clinic-configured WhatsApp patient communications when the clinic chooses to use them
• Comply with law, prevent abuse, and enforce our Terms
• Provide support and investigate incidents

Processing is based on performance of a contract with the clinic, legitimate interests in securing and operating the platform, consent where required (for example certain cookies or patient WhatsApp marketing if used), and legal obligations.

Clinics are responsible for having a lawful basis and appropriate notices/consents for patient data they enter into Careflow.

We do not sell personal data. We may share data with:

• Infrastructure and database providers hosting Careflow
• Official WhatsApp Business Platform / Meta when a clinic connects messaging
• Payment processors for clinic subscription billing
• Professional advisors or authorities when required by law
• Sub-processors engaged solely to deliver the service, under confidentiality and security obligations

Data may be processed on infrastructure located in or outside India depending on hosting configuration. We take reasonable contractual and technical steps appropriate to the transfer and the nature of the data.

We retain account and clinic data for the life of the subscription and for a reasonable period thereafter for backups, disputes, and legal compliance. Patient records are retained as instructed by the clinic and as described in our Data Retention Policy, subject to mandatory medical record retention rules that may apply to the clinic.

We use encryption in transit (HTTPS/TLS), access controls, password hashing, multi-tenant data scoping by clinic, and operational monitoring. No method of transmission or storage is 100% secure. See our Security Policy for more detail.

Depending on applicable law (including India's Digital Personal Data Protection Act, 2023), individuals may have rights to access, correction, erasure, withdrawal of consent, and grievance redressal.

Patients should primarily contact their clinic for rights requests about clinical data. Clinic staff may contact us for account data requests. We will assist clinics with patient requests as a processor, where required.

Careflow is a B2B product for clinics. Clinics may enter data about minors as patients. Clinics are responsible for obtaining parental/guardian consent where required for treatment and communications.

We may update this policy from time to time. The "Last updated" date at the top will change when we do. Material changes may be communicated via the product or email where appropriate.