This policy is for NaadiOS, a clinic-operated patient messaging and workflow platform used for appointment operations, reminders, follow-ups, staff workflows, billing support, and related clinic communications. The clinic is the primary controller / Data Fiduciary for the patient and staff data it processes; NaadiOS acts as the clinic's Data Processor, except for limited security and platform-administration processing NaadiOS performs on its own initiative.
NaadiOS also collects limited personal and business-contact information from website visitors and prospective clinic customers who submit the public demo-request form before they become a clinic customer.
This information is used only for evaluating and following up on demo or signup interest, including sales contact and onboarding discussions. It is not used as clinic-operational messaging data.
This website lead information is not WhatsApp or patient messaging data, and it is not patient operational data processed on behalf of a clinic. It is retained for a reasonable period for sales follow-up, onboarding administration, and related internal recordkeeping, and can be deleted on request where applicable.
Submitting the public demo-request form does not by itself create a clinic-customer relationship or start clinic-operational data processing. That separate processing begins only if and when the clinic is onboarded to the platform.
NaadiOS is not a diagnosis engine, treatment-recommendation engine, or emergency-response channel, and must not be operated as one.
The platform processes personal data only for limited clinic-operational purposes: account creation and access control; appointment scheduling and patient communication; reminders, follow-ups, and staff workflow coordination; consent recording and communication governance; billing and payment support; service reliability, fraud and abuse prevention, and audit logging; and legal, contractual, and security compliance. The platform does not use patient data for unrelated advertising or resale.
Where required, processing relies on one or more of: patient consent for WhatsApp and similar clinic communications; performance of the clinic's service relationship with the patient; compliance with legal or regulatory obligations; legitimate operational and security interests where permitted by law; and employment or contractor administration for clinic staff accounts. Where the clinic relies on consent, the clinic is responsible for the consent language, collection channel, recordkeeping, and withdrawal path.
WhatsApp consent is treated as channel-specific; send eligibility is tied to active consent state in the runtime trust model. The clinic decides the patient-facing consent copy. Patients are told messaging is for appointment and clinic-support workflows and not for emergencies. Sensitive-health messaging is minimized.
ap-south-1) — primary application database; all structured clinic, staff, patient, and operational data.asia-south1) — application hosting / compute (Cloud Run) and database (Cloud SQL, where applicable); data in transit during request processing.Primary database storage and application compute are both hosted in India (Supabase and/or Google Cloud, Mumbai ap-south-1 / asia-south1, depending on migration stage). Transactional email is delivered via Resend, which may process data outside India. Some limited processing therefore occurs outside India even though primary storage and compute are in India.
Retention is limited to what is needed for ongoing clinic operations, auditability and dispute handling, security investigations, and legal or regulatory obligations. Patient data export and erasure are available via operator-run Data Subject Request (DSR) tooling (authorized, audit-logged, approval-gated). Financial and audit records are retained and anonymized rather than deleted.
The platform uses role-based access controls, salted-and-hashed dashboard PINs with per-credential lockout, server-side session-token hashing, structured request logging with PHI scrubbing, cross-instance rate limiting on authentication and public routes, and webhook ingress controls including shared-secret validation and inbound replay protection. These controls reduce risk but do not eliminate it.
Subject to applicable law, patients and staff may access their personal data, correct inaccurate data, withdraw consent where consent is the basis, request deletion (subject to legal and operational retention limits), and raise a grievance. To exercise these rights, contact privacy@naadios.com. Requests are identity-verified and fulfilled using the platform's DSR tooling.
Clinics using the platform for pediatric or other sensitive contexts must obtain any legally required guardian or representative authorization and avoid over-disclosing sensitive health details in messages.
Material changes to this policy are announced to clinics and, where appropriate, to patients, before they take effect.