Privacy Policy

1. Who we are

Clinic VoiceOps is operated by [Registered legal entity name](“FreeFast”, “we”, “us”), registered at [Registered office address, India]. We provide patient-operations software (AI voice booking, WhatsApp reminders, secure report delivery, missed-call recovery) to healthcare clinics.

For most personal data we handle, the clinic is the Data Fiduciary (it decides why and how patient data is used) and FreeFast is its Data Processor(we process data on the clinic’s documented instructions). For our own account, billing, and website data, FreeFast is the Data Fiduciary.

2. Personal data we process

• Patient data (on behalf of the clinic):name, mobile number, language preference, appointment details, and, where the clinic uses report features, diagnostic report metadata and secure links. This may include health information (“sensitive” in nature) entered by clinic staff.
• Communication records: WhatsApp message status, voice-call session metadata, consent and opt-out records.
• Clinic staff data: name, work email, role, and authentication credentials (passwords are stored only as salted hashes).
• Technical data: log and audit records, IP address, and device/usage information needed to operate and secure the service.

3. Why we process it

• To book, confirm, remind, and follow up on appointments on the clinic’s behalf.
• To deliver WhatsApp messages and (where enabled) AI voice calls the clinic has configured.
• To deliver diagnostic reports securely and capture patient feedback.
• To authenticate staff, maintain audit trails, prevent abuse, and secure the service.
• To provide support, billing, and to comply with applicable law.

We rely on the consent obtained by the clinic from its patients, and on legitimate uses permitted under the DPDP Act. Patients may withdraw consent at any time (see section 6); WhatsApp messaging honours opt-out replies and recorded opt-outs.

4. Sharing and sub-processors

We do not sell personal data. We share it only with vetted service providers who process it under contract and solely to operate the service. Examples include the WhatsApp Business Cloud API (Meta) for message delivery, our cloud hosting provider for infrastructure, and, where a clinic enables voice, the configured voice provider. The current list and purposes are maintained in our Data Processing & Sub-processors page.

5. Storage, security, and retention

Data is hosted on infrastructure located in/served to India and protected with encryption in transit, role-based access control, hashed credentials, audit logging, and tenant isolation between clinics. We retain personal data only as long as needed for the purposes above or as the clinic instructs, after which it is deleted or anonymised. Clinics can configure a data-retention window in their settings.

6. Your rights as a data principal

Subject to the DPDP Act, you may request to:

• access a summary of your personal data and how it is processed;
• correct, complete, or update inaccurate data;
• erase your data where it is no longer required;
• withdraw consent (including WhatsApp opt-out); and
• nominate another person to exercise your rights in case of death or incapacity.

Because the clinic is the Data Fiduciary, please raise patient-data requests with your clinic first. You may also contact us and we will assist the clinic in responding.

7. Children’s data

Where a clinic serves patients who are children, the clinic is responsible for obtaining verifiable parental/guardian consent as required by the DPDP Act. We do not knowingly use children’s data for tracking, behavioural monitoring, or targeted advertising.

8. Grievance redressal

If you have a concern about how your data is handled, contact our Grievance Officer:

• Grievance Officer: [Grievance Officer name]
• Email: [[email protected]]
• General support: [email protected]

We aim to acknowledge grievances promptly and resolve them within the timelines required by law.

9. Changes to this policy

We may update this policy as the service or the law evolves. Material changes will be reflected by an updated effective date and, where appropriate, communicated to clinics.