Privacy Policy

1. Commitment to Data Privacy

ReplaceRoots Healthcare Technologies India is committed to protecting the privacy, confidentiality, and security of your personal and health-related data. This Privacy Policy sets forth our practices regarding the collection, handling, disclosure, and safeguarding of information under India's Digital Personal Data Protection (DPDP) Act 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.

2. Categories of Information Collected

We may collect and process the following categories of information:

• Account Details: Email address, hashed authentication credentials, and user display preferences. We strictly do not store mobile numbers as primary login identifiers.
• Booking & Enquiry Information: Patient name, contact mobile number, preferred consultation city, specific dental implant condition (e.g. single missing tooth, full arch loss), and preferred appointment dates.
• Voluntary Medical Documents: Radiographic images (OPG/CBCT scans), dental case summaries, or medical notes uploaded voluntarily by you for clinic consultation reviews.
• Technical & Telemetry Data: IP address, device operating system, browser type, location approximations (city level), and anonymized interaction statistics.

3. Purpose of Data Processing

Your personal data is processed solely for lawful and explicit healthcare marketplace purposes:

• Facilitating clinical appointment enquiries and routing requests to your chosen verified clinic.
• Preventing fraudulent clinic reviews, spam enquiries, and account takeovers.
• Generating aggregated, non-personally identifiable marketplace insights (e.g., regional implant price benchmarks).
• Fulfilling legal compliance, tax obligations, and statutory requirements under Indian law.

4. Patient Document Storage & Retention

All medical radiographs, scans, and health records uploaded by patients are encrypted at rest using AES-256 and stored in private cloud buckets with time-restricted signed URLs. Medical documents are retained for consultation purposes and automatically purged following 90 days of inactivity, or immediately upon a verified patient deletion request.

5. Non-Disclosure & Third-Party Sharing

ReplaceRoots will never sell, trade, or rent your personal health data to pharmaceutical companies, advertisers, or third-party data brokers. Data is shared exclusively with:

• The specific clinic and treating implantologist you deliberately select for appointment routing.
• Trusted infrastructure service providers (cloud storage, SMS DLT gateways, transactional email) under strict confidentiality agreements.
• Law enforcement or regulatory authorities only when strictly required by a court order or applicable Indian statute.

6. Your Rights under the DPDP Act 2023

Under the DPDP Act 2023, you hold the right to:

• Access: Obtain a summary of the personal data we hold about you and the processing activities undertaken.
• Correction & Updating: Request the correction of misleading or inaccurate personal information.
• Withdrawal of Consent & Erasure: Withdraw your consent for data processing and demand the complete deletion of your account and uploaded medical documents.
• Nomination: Nominate an individual who may exercise your privacy rights in the event of incapacity or death.

7. Grievance Officer & Data Inquiries

If you have questions, concerns, or requests regarding this Privacy Policy or your data rights, contact our appointed Grievance Officer: