1. Who We Are
Caresensy, a product of CENITPRO. CENITPRO, 5/23 Netaji Nagar, Regent Park, Kolkata, West Bengal 700040, India (care@cenitpro.in), provides patient retention and appointment management software for healthcare clinics in India.
Clinics that use Caresensy decide what patient information is collected and how it is used. CENITPRO processes that information on the clinic's behalf, only to provide the service.
2. Data We Collect
We collect data that clinics enter on behalf of their patients: name, phone number, email address, age, gender, treatment type, appointment records, health history forms, and feedback. We also collect clinic account information (name, email, address).
Where a patient is under 18, the booking is made by a parent or guardian, who confirms this at the time of booking.
3. How We Use Data
Patient data is used solely to provide the Service to the clinic — scheduling appointments, sending reminders and follow-ups, collecting feedback, and generating reports. We do not sell patient data to third parties.
4. Messaging (WhatsApp and Email)
On behalf of clinics, we send appointment confirmations, reminders, follow-ups and feedback requests by email and, where the patient has agreed to it, through the WhatsApp Business Platform provided by Meta. A patient's phone number and the message content are shared with Meta only to deliver these messages, and are also subject to WhatsApp's own privacy policy.
When a patient books through Caresensy, they are shown a notice and choose separately what they agree to: appointment management and reminders (needed to book), WhatsApp as a channel, follow-up and check-up reminders, private feedback requests, and occasional health updates from the clinic. Every optional choice is off unless the patient turns it on, and saying no never stops a patient from booking. We keep a dated record of each choice and of the notice the patient saw.
Messages never name a patient's condition or treatment, and health updates never contain offers or discounts.
5. Withdrawing Consent
A patient can withdraw any consent at any time, as easily as they gave it:
- by replying STOP to any WhatsApp message;
- by using the unsubscribe link in any non-appointment email;
- by telling their clinic; or
- by emailing care@cenitpro.in.
Messages of that kind stop as soon as the withdrawal is received. Withdrawing consent does not affect messages already sent, and does not delete medical records the clinic is required by law to keep.
6. Data Storage and Security
Data is stored in a PostgreSQL database hosted on Neon in its Singapore region, which is outside India. File uploads are stored on Cloudflare R2, and the application is hosted on Vercel. All data is encrypted in transit (TLS) and at rest.
Inside each clinic account, access is limited by staff role, and sensitive actions such as viewing health history forms or exporting data are recorded in an audit log, which we keep for at least one year. One clinic can never see another clinic's patient records, even when the same doctor works at both.
7. Data Breaches
If we become aware of a breach affecting personal data we hold for a clinic, we will tell that clinic without delay, and in any case within 24 hours, with what we know about what happened, the data affected and the steps we are taking. This lets the clinic meet its own legal duty to inform affected patients and the Data Protection Board of India. We will help the clinic with that process.
8. Third-Party Services
We use Zoho ZeptoMail for transactional email, Meta (WhatsApp Business Platform), with Zoho CPaaS as our WhatsApp service provider, for WhatsApp messaging where enabled, and Neon, Cloudflare and Vercel for storage and hosting. Where a clinic turns on Google Calendar sync, business search or its Google Business Profile connection (section 9), Google services are used for that feature. Subscription payments are made by UPI or bank transfer, or through a third-party payment provider; we do not store card or bank details. Each provider has its own privacy policy governing its use of data.
We will update this list before adding any new provider that handles patient data.
9. Google Business Profile
If a clinic chooses to connect its Google Business Profile, the clinic signs in with its own Google account and gives Caresensy permission on Google's consent screen. We then read the reviews and star rating on that clinic's own profile, and we post a reply to a review only when a member of the clinic's staff writes and sends it from Caresensy. Patients' Caresensy data is never sent to Google through this connection.
We use the information we receive from Google only to show the clinic its own reviews and rating and to let it reply. We do not use it for advertising, we do not sell it, and we do not share it with anyone other than the clinic, our hosting providers that process it for us, or where the law requires. People at CENITPRO do not read it except to support the clinic at its request.
Caresensy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
A clinic can disconnect at any time from within Caresensy, or by removing Caresensy at myaccount.google.com/permissions. When it does, we stop accessing its profile and delete the Google access tokens and any copy of its reviews that we hold, within 30 days.
10. Data Retention
Patient data is retained as long as the clinic account is active. Clinics may delete patient records at any time from within the platform. If a clinic closes its account, or on a written request to care@cenitpro.in, we delete the associated data within 30 days, except where the law requires us to keep it.
11. Your Rights
Under India's Digital Personal Data Protection Act, 2023, patients have the right to:
- get a summary of the personal data held about them and how it is used;
- have it corrected, completed or updated;
- have it erased, except where the clinic must keep medical records by law;
- withdraw consent (see Section 5);
- nominate another person to exercise these rights if they die or become unable to; and
- raise a grievance (see Section 11).
Patients can make a request to their clinic directly or by emailing care@cenitpro.in. Because the clinic is responsible for a patient's records, we may pass the request to the clinic and help them complete it. If a patient is not satisfied with how a grievance is handled, they may complain to the Data Protection Board of India.
12. Grievance Officer
For complaints or concerns about how personal data is handled, contact our Grievance Officer, Alok Kumar (Founder, CENITPRO), 5/23 Netaji Nagar, Regent Park, Kolkata, West Bengal 700040, at care@cenitpro.in. We aim to respond within 30 days.
13. Contact
For privacy-related queries: care@cenitpro.in
Caresensy, a product of CENITPRO.