1. Who We Are

MyClinicDesk is a clinic management platform operated by Streets & Commons. We help small clinics in India digitize patient registration, treatment records, billing, and communication.

2. What Data We Collect

Clinic owners & staff: Name, email address, phone number, clinic details, and payment information (processed by Razorpay, we never store card details).

Patients: Name, age, sex, phone number, address, medical history, chief complaint, e-signature, and treatment records, as entered by the clinic or by the patient via the registration form.

Automatically collected: IP address, browser type, and basic usage analytics via PostHog (privacy-friendly, no cross-site tracking).

3. How We Use Your Data

To provide the clinic management service you signed up for
To send transactional emails (welcome, password reset, trial reminders)
To process payments via Razorpay
To improve our product based on aggregated, anonymized usage patterns

We do not sell, rent, or share your data with third parties for marketing purposes. Ever.

4. Data Isolation & Security

Each clinic's data is completely isolated, no clinic can see another clinic's data
All data is encrypted in transit (TLS/HTTPS) and at rest
Passwords are hashed using scrypt with unique salts
Daily automated backups
Backup exports exclude password hashes
Rate limiting on authentication endpoints

5. Patient Data

Patient data belongs to the clinic, not to MyClinicDesk. We act as a data processor on behalf of the clinic (the data controller). We access patient data only to provide the service and never for any other purpose.

Clinics can export all patient data as CSV at any time. If a clinic deletes their account, all associated data is permanently deleted within 30 days.

6. DPDP Act 2023 Compliance

We are committed to complying with India's Digital Personal Data Protection Act, 2023. This includes:

Processing data only for the purpose it was collected
Allowing data principals (patients and clinic owners) to request access or deletion of their data
Maintaining reasonable security safeguards
Not retaining data beyond what is necessary

7. Third-Party Services

Razorpay: payment processing (PCI DSS compliant)
Resend: transactional email delivery
PostHog: privacy-friendly product analytics
Railway: cloud hosting infrastructure
Anthropic Claude: AI-powered form extraction (data is not stored by the AI provider)

8. Cookies

We use essential cookies only, session authentication cookies (HttpOnly, Secure, SameSite=Lax). We do not use advertising or cross-site tracking cookies.

9. Your Rights

You can request access to, correction of, or deletion of your personal data at any time by contacting us at the details below. Clinic owners can also export all data from within the application.

10. Contact

For any privacy-related questions or data requests:

WhatsApp: +91 9600160297

Email: [email protected]

Privacy Policy