Privacy Notice

This Privacy Notice explains how Jaiswal & Jain ("AesthOS", "we") collects and processes personal data through the AesthOS Clinic Suite (the "Service"). It applies to clinic staff who use the Service and to patients whose data is entered into a clinic's workspace.

1. Our Role

For clinic staff accounts, AesthOS is the data controller. For patient records entered by a clinic into its workspace, the clinic is the data controller and AesthOS is a data processor acting on the clinic's instructions. Patients should direct privacy requests about their treatment records to their clinic in the first instance.

2. Personal Data We Collect

• Account & staff data: name, email, mobile, role, login credentials, audit logs.
• Clinic data: clinic name, address, GSTIN, branding, branches, service catalog.
• Patient data (entered by the clinic): name, contact details, date of birth, gender, medical history, clinical notes, photos, prescriptions, consent forms, appointment history, invoices, payments.
• Usage telemetry: device, browser, IP address, pages visited, feature usage, error logs.
• Support communications: emails and messages you send us.

3. Purposes & Legal Basis

• Providing the Service (contract): account provisioning, hosting clinic data, sending appointment reminders on the clinic's behalf.
• Security & fraud prevention (legitimate interest): audit logs, abuse detection, rate limiting.
• Product improvement (legitimate interest): aggregated usage analytics; we do not train AI models on patient records.
• Billing & tax compliance (legal obligation).
• Customer support (contract / legitimate interest).
• Marketing to clinic prospects (consent or legitimate interest); patients are never marketed to by AesthOS.

4. Data Sharing

We share personal data only with:

• Sub-processors that help us operate the Service: cloud hosting (Supabase / Cloudflare), email delivery, WhatsApp Business API providers, error monitoring, analytics. A current list is available on request.
• Payment processors for subscription billing (when enabled).
• Professional advisers (legal, accounting) under confidentiality.
• Authorities where required by law, court order, or to protect rights and safety.

We never sell personal data. We never share patient records with third parties for advertising.

5. International Transfers

Clinic and patient data is primarily hosted in India / Asia-Pacific regions. Some sub-processors may process limited operational data (e.g. error logs, billing) outside India under appropriate safeguards.

6. Retention

Clinic Data is retained for as long as the workspace is active. On cancellation, data is kept for 30 days to allow export, then deleted from active systems within 60 days; backups are purged within 90 days. Billing records are kept for 8 years as required by Indian tax law. Audit logs are retained for 2 years.

7. Security

We implement appropriate technical and organisational measures, including encryption in transit (TLS 1.2+), encryption at rest, row-level security on the database, role-based access controls, audit logging, and least-privilege access for our staff. No system is perfectly secure; clinics should use strong passwords and enable available account protections.

8. Your Rights

Subject to applicable law (including India's Digital Personal Data Protection Act, 2023), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion (subject to legal retention obligations).
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the Data Protection Board of India.

Clinic staff can exercise these rights from account settings or by emailing support@aesthosclinicsuite.com. Patients should contact their clinic directly. See also our data deletion page.

9. Cookies

We use strictly necessary cookies for authentication and security. Analytics cookies, where used, are aggregated and do not identify individuals. The Service does not place advertising cookies.

10. Children

The Service is intended for use by clinics and their authorised staff. Patient records about minors are entered by the clinic under parental/guardian consent obtained by the clinic.

11. Changes

We may update this Notice. Material changes will be notified by email or in-app at least 14 days before they take effect.

12. Contact

Jaiswal & Jain — Ahmedabad, Gujarat, India. Privacy queries: support@aesthosclinicsuite.com.