DPDP Act Compliance

This page summarises how SmileDesk aligns with the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Detailed handling is in our privacy policy.

Roles under the Act

• The Clinic is the Data Fiduciary for its patients.
• SmileDesk (Poruz Systems) is the Data Processor, acting on the Clinic's instructions.

Lawful basis for processing

Patient data is processed for the legitimate use of "medical treatment" (§7(f) of the DPDP Act), which explicitly covers data needed to deliver healthcare. Consent for staff use of the platform is explicit at account creation.

Data localisation

All data is stored on servers physically located in India. Backups are regional. We do not transfer personal data outside India for storage or processing.

Notice and consent (§5, §6)

Clinics are provided with our privacy policy and terms at sign-up, and must explicitly accept them. Individual patients consent to the Clinic — not to us; we act on the Clinic's instructions.

Patient rights (§11–§14)

SmileDesk provides tools that let the Clinic honour a patient's rights:

• Right to access — patient detail page shows every record we hold; xlsx export available.
• Right to correction & updation — every field is editable by an authorised staff member.
• Right to erasure — patient records can be deleted (subject to clinical record-retention duties the Clinic may have under state dental council rules).
• Right to nominate — the Clinic can register a nominated person in the patient's contact fields.
• Right of grievance redressal — see our grievance officer contact below and in privacy policy §8.

Security safeguards (§8(5))

• Argon2id password hashing (OWASP-recommended parameters — 19 MiB memory, 2 iterations).
• TLS 1.2/1.3 for every request; HTTPS-only session cookies (HttpOnly, Secure, SameSite=Lax).
• Per-tenant data isolation at the database layer — every row carries tenant_id; queries enforce it.
• Session tokens are opaque; only their sha256 hash is stored server-side.
• Argon-hashed passwords, opaque session tokens, and RBAC-guarded routes together prevent stolen-DB attackers from forging valid sessions.
• Automated daily backups; retention per tier.

Breach notification (§8(6))

In the event of a personal-data breach, we will:

1. Notify the Data Protection Board of India as soon as we're aware, per the Act's timeline.
2. Notify affected Clinic owners by email + WhatsApp + in-app banner, with a plain-language description of what happened, what data was affected, and what we're doing about it.
3. Publish a post-incident report at smiledesk.in/status.

Children's data (§9)

Dental clinics treat patients under 18. The Clinic obtains guardian consent at registration. SmileDesk applies the same protections as adult data and does not target children with marketing.

Retention limits (§8(7))

Data is retained while the Clinic's account is active. After cancellation, 90 days for export, then permanent deletion — unless the Clinic requests earlier deletion.

Grievance officer

Purusothaman R.
Poruz Systems, Madurai, Tamil Nadu, India
support@poruz.com

Data Protection Board of India

If you're not satisfied with our response, you may escalate to the Data Protection Board of India per the DPDP Act's grievance redressal mechanism.