Privacy Policy

Product: RehabDesk AI
Operated by: RehabDesk AI (the "Company," "we," "us," or "our")
Effective Date: 1 September 2026
Last Updated: 1 September 2026
Governing Law: India (Digital Personal Data Protection Act, 2023)

1. Introduction and Who This Policy Applies To

RehabDesk AI is a cloud-based practice management Software-as-a-Service (SaaS) platform designed for multi-session healthcare clinics - including physiotherapy, chiropractic, dermatology, dental, Ayurveda, and related specialties. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over your data.

This Policy applies to three distinct groups of people:

1. Clinic Owners and Staff ("Clinic Users") - Healthcare professionals and administrative staff who subscribe to and use the RehabDesk AI platform to manage their clinic operations.

2. Clinic Patients ("Patients") - Individuals whose health and personal data is entered into the platform by the clinic with which they have a treatment relationship. If you are a patient, please note: Your data is primarily managed by your clinic, who acts as the data controller for your personal information. RehabDesk AI processes that data as a data processor on behalf of your clinic. For requests regarding your patient data, please contact your clinic directly; see also Section 13 for how to contact us.

3. Website Visitors - Anyone visiting the RehabDesk AI marketing website (rehabdesk.app) without an account.

2. Who Is the Data Fiduciary / Data Controller?

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"):

• For Clinic User account data: RehabDesk AI is the Data Fiduciary - we determine the purpose and means of processing your registration, billing, and usage data.

• For Patient data entered by clinic staff: The individual clinic (the subscribing business) is the Data Fiduciary/Data Controller for their patients' personal data. RehabDesk AI acts as a Data Processor - we process patient data only as instructed by and on behalf of the subscribing clinic. A separate Data Processing Agreement governs this relationship.

• For website visitor data (analytics, cookies): RehabDesk AI is the Data Fiduciary.

3. What Personal Data We Collect and Why

3.1 From Clinic Owners and Staff (Account Data)

Legal Basis: Contract performance (providing the service you subscribed to); compliance with legal obligations; legitimate interest (security monitoring, product improvement).

3.2 From Patients (Clinical and Operational Data - entered by clinic staff)

Legal Basis for processing patient data: The subscribing clinic is the Data Fiduciary and is responsible for establishing the legal basis for processing their patients' personal data (typically: healthcare treatment, legitimate interest, or patient consent as applicable). RehabDesk AI processes this data only as instructed by the clinic. See our Data Processing Agreement.

3.3 From Website Visitors

4. Third-Party Integrations and Data Flows

RehabDesk AI integrates with three major third-party platforms as part of its Pro plan features. Each integration involves data flowing to those platforms servers. We describe each clearly:

4.1 WhatsApp Business Cloud API (Meta Platforms, Inc.)

What flows to Meta:

• Patient phone numbers (in E.164 format, e.g., +919876543210), normalized before transmission
• Outbound message content (invoice notifications, appointment reminders, marketing broadcast text using pre-approved Meta message templates, review request messages)
• Inbound message content from patients who initiate WhatsApp contact with the clinic (processed by our AI chatbot)
• The clinic WhatsApp Business Account ID and Phone Number ID (used for API authentication)

What does NOT flow to Meta:

• Raw patient health/clinical records, diagnosis notes, treatment plan details
• Internal patient IDs or database UUIDs
• The clinic RehabDesk login credentials

Meta role: Meta is an independent data controller for data transmitted through WhatsApp infrastructure, governed by Meta own Privacy Policy and WhatsApp Business Terms. We cannot control how Meta processes data on their infrastructure.

Opt-in requirement: Marketing broadcast messages are only sent to patients who have explicitly opted in to receive marketing communications from the clinic. Clinics are contractually obligated under our Acceptable Use Policy to maintain opt-in records. Transactional messages (invoice delivery, appointment confirmations) are sent as part of the treatment relationship.

Data retention at Meta: Subject to Meta own data retention policies.

4.2 Instagram / Messenger (Meta Platforms, Inc. via Instagram Graph API)

What flows to Meta:

• Instagram Direct Message content from users who message the clinic Instagram Business account (processed by our AI chatbot)
• AI-generated response messages sent back to the Instagram user
• The clinic Instagram Page Access Token (stored encrypted server-side, never transmitted to browser)
• The clinic Instagram Page ID and Instagram Business Account ID

What does NOT flow to Meta from our system:

• Patient health records or clinical data
• RehabDesk internal identifiers

Meta role: Meta independently controls the Instagram/Messenger infrastructure. Our AI chatbot reads incoming DMs and sends automated replies. The content of those DMs may include personal information shared by the person messaging the clinic.

Important note: The Instagram AI chatbot is available to Pro plan clinics only. DMs captured via the chatbot that result in appointment bookings are stored in our database as standard appointments only with information extracted from the conversation (name, preferred date/time, therapy type). Full DM logs are optionally stored in a dedicated and secure conversation log, scoped to the clinic.

4.3 Google Business Profile API (Google LLC)

What flows to Google:

• The clinic Google Account credentials (OAuth 2.0 refresh token, stored encrypted server-side)
• Patient phone numbers, when a review request is sent via WhatsApp (the review link itself is a Google public URL - no patient health data flows to Google)
• Post content (when creating automated Google Business posts)
• Requests to fetch business performance metrics (impressions, calls, direction requests)

What does NOT flow to Google:

• Patient health records or clinical data
• RehabDesk internal identifiers or patient data beyond the phone number used for WhatsApp delivery of review request links

Google role: Google independently controls the Google Business Profile and Google Maps infrastructure, governed by Google Privacy Policy.

4.4 n8n Automation Layer

What is n8n: n8n is a workflow automation platform used as RehabDesk backend orchestration engine for AI chatbot processing, WhatsApp broadcast delivery, and GMB review campaigns.

What flows to n8n:

• Inbound WhatsApp/Instagram webhook payloads (containing patient messages and contact numbers)
• Broadcast recipient lists (patient names and phone numbers, for the duration of the broadcast job)
• Invoice delivery payloads (patient contact, invoice URL, amount)

Important: n8n processes these payloads transiently as part of the workflow execution. RehabDesk AI n8n instance is configured to not retain raw patient PII beyond the immediate processing window. The n8n instance is operated by RehabDesk AI and is not a separate third party - it is part of our infrastructure.

4.5 Stripe (Stripe, Inc.)

What flows to Stripe:

• Clinic subscription payment information (credit/debit card details, billing address) - processed directly by Stripe payment infrastructure
• Subscription plan type and billing amounts

What does NOT flow to Stripe: Patient data of any kind.

Stripe role: Stripe is an independent data controller for payment data, governed by Stripe Privacy Policy.

4.6 Supabase (Supabase, Inc. / AWS infrastructure)

Our database and authentication infrastructure. All data stored in RehabDesk AI (clinic profiles, patient records, invoices, session logs, messaging logs, audit logs) is stored in Supabase-hosted PostgreSQL databases. Supabase acts as a data processor for RehabDesk AI under its own Data Processing Agreement.

Infrastructure location: Supabase infrastructure is hosted on AWS. Depending on the AWS region configured, data may be stored on servers outside India. See Section 10 on Cross-Border Data Transfers.

5. Multi-Tenant Data Isolation

RehabDesk AI is a multi-tenant platform - multiple clinics (tenants) use the same underlying infrastructure. We implement the following technical and organizational measures to ensure strict data isolation:

• Row-Level Security (RLS): Every database table that contains clinic data has Supabase PostgreSQL Row-Level Security policies enforced at the database layer. These policies are enforced by the database itself - they cannot be bypassed by application code.
• Tenant Key: Every record in the database carries a unique clinic identifier, and every database query includes this filter. A logged-in staff member of Clinic A cannot read, write, or enumerate data belonging to Clinic B.
• Middleware Enforcement: Our application middleware validates that the authenticated user clinic ID matches the clinic slug in the URL before processing any request.
• No Shared State: Client-side application state is scoped per clinic and cannot simultaneously hold data from multiple tenants.

Our commitment: Patient data from Clinic A is never visible to, accessible by, or mixed with data from Clinic B under any circumstances, including infrastructure failures, bugs, or malicious requests.

6. How We Use Personal Data

We do not: Sell, rent, or monetize any patient or clinic user data to third parties. We do not use patient data to train AI models or for advertising purposes.

7. Data Retention

Important: After a clinic subscription is cancelled and the 90-day grace period expires, all clinic and patient data is permanently deleted from our systems except for invoice records which are retained for 7 years as required by Indian accounting law.

Detailed procedures are in our Data Deletion Policy.

8. Patient Rights (Under DPDP Act 2023 and Generally)

If you are a patient whose data is held by a clinic using RehabDesk AI:

Your primary relationship for data rights is with your clinic (the Data Fiduciary). Your clinic is responsible for:

• Giving you access to your records
• Correcting inaccurate data
• Deleting your data upon request

To exercise these rights: Contact your clinic directly.

If your clinic does not respond or you have a concern specifically about how RehabDesk AI (as Data Processor) has handled your data, contact our Grievance Officer at the address in Section 13.

Clinic Users Rights (under DPDP Act):
You have the right to:

1. Access - Request confirmation of what personal data we hold about you and receive a copy.
2. Correction - Request correction of inaccurate or incomplete data.
3. Erasure - Request deletion of your personal data (subject to legal retention obligations).
4. Grievance Redressal - File a complaint with our Grievance Officer; see Section 13.
5. Nominate - Nominate another individual to exercise these rights on your behalf in the event of death or incapacity (as per DPDP Act provisions).
6. Withdraw Consent - Where processing is based on consent (e.g., marketing emails), you may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise these rights, email our Grievance Officer (see Section 13) with your full name, email address associated with your account, and the specific right you wish to exercise. We will respond within 30 days.

9. Security Measures

We implement the following measures to protect your data:

• Encryption in Transit: All data transmitted between your browser/device and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• Encryption at Rest: Database data is encrypted at rest using AES-256 encryption provided by the Supabase/AWS infrastructure.
• Row-Level Security: PostgreSQL RLS policies enforce clinic-level data isolation at the database layer (see Section 5).
• Authentication: Supabase Auth with OTP (one-time password) verification. Session tokens are server-side validated on every request.
• API Key Security: Integration credentials (WhatsApp access tokens, Instagram tokens, Google refresh tokens) are stored server-side only, never transmitted to browser clients.
• Role-Based Access Control: Four staff roles (owner, doctor, receptionist, staff) with enforced permissions on both application and database layers.
• Security Audit Logs: All significant actions (inviting staff, deleting patients, role changes) are recorded in an immutable audit log.
• Service Role Key Isolation: Our Supabase service role key (which bypasses RLS) is used only in specific, audited server-side API routes, never in client-accessible code.

Disclaimer: No system is 100% secure. While we take reasonable and industry-standard measures to protect your data, we cannot guarantee absolute security. In the event of a data breach, we will notify affected parties as described in our DPDP Act Compliance document.

10. Cross-Border Data Transfers

RehabDesk AI infrastructure involves the following services that may store or process data outside India:

Database Location - India: Our primary database is hosted on Supabase's AWS infrastructure in the South Asia (Mumbai) region - ap-south-1. All patient health records, clinical data, invoices, and audit logs are stored on servers physically located within India. This significantly reduces cross-border transfer risk for the most sensitive data categories.

Remaining Cross-Border Transfers: Message content transmitted via WhatsApp (Meta, USA/Global) and Google Business Profile API calls (Google, USA/Global) involve cross-border data flows. These are limited to message text and OAuth tokens respectively - not raw patient health records.

Current DPDP Status: As of the effective date of this Policy, the Indian government has not yet finalized the country whitelist under DPDP Act Section 16. The remaining cross-border transfers to Meta and Google are governed by those companies' own compliance frameworks. We will assess and update this Policy once the whitelist is published.

11. Children Data

RehabDesk AI is a business management tool used by healthcare clinics. Clinics may register minor patients (under 18 years of age) as part of their clinical practice.

• The clinic is responsible for ensuring they have appropriate parental or guardian consent before entering a minor health data into the platform.
• RehabDesk AI does not independently verify patient ages.
• Our marketing website and subscription portal are not directed at minors; we do not knowingly collect personal data from minors through our marketing channels.

If you believe we have inadvertently collected personal data of a minor through our website without appropriate consent, please contact us immediately using the details in Section 13.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to all active clinic account holders
• Display a notification within the RehabDesk AI platform

Continued use of the platform after the effective date of an updated Policy constitutes acceptance of the changes.

13. Grievance and Contact Details

For any privacy-related questions, data rights requests, or complaints about how we handle your personal data, please contact us through the following channels:

Privacy and Grievance Contact
RehabDesk AI
Email: grievance@rehabdesk.app
Response Time: We will acknowledge your complaint within 48 hours and aim to resolve it within 30 days.

Note: We are in the process of formally designating a named Grievance Officer as required under the Digital Personal Data Protection Act, 2023. This designation will be updated in this Policy once completed. In the interim, all grievance communications sent to grievance@rehabdesk.app will be handled by the founding team directly.

Escalation: If your grievance is not resolved satisfactorily, you may file a complaint with the Data Protection Board of India once the Board is constituted under the DPDP Act.

General Privacy Inquiries:
Email: legal@rehabdesk.app

Registered Address:
RehabDesk (Krishnam Rastogi, Proprietorship)
338C/1C/1, 60 Feet Harsh Nagar Road, Meera Pur,
Prayagraj, Uttar Pradesh - 211003, India
GSTIN: 09HRJPR8371G1ZZ | Udyam: UDYAM-UP-03-0155023

This Privacy Policy was last reviewed on 1 September 2026.