Clinician data processing terms
In short. When you keep patient records in SiriON, you or your practice decide what is recorded and why. You are the data fiduciary for that data and HexSirius Private Limited is your data processor. We process patient data only to provide SiriON to you, keep it confidential and secure, help you respond to patients, tell you about breaches and erase it when you ask. You remain responsible for having the patient's consent and for keeping records as your professional rules require.
1. Scope
1.1 These terms apply to "Patient Data": personal data about patients that you enter into SiriON or that patients send in reply to messages you send through it. This includes names, contact details, age or date of birth, sex, medical history, appointments, treatments, tooth details, notes, clinical photos and files, consent records and message records.
1.2 These terms form part of our Terms of Use. They apply to you, and to the practice you work for if you use SiriON for it.
2. Roles
2.1 For Patient Data you are the data fiduciary under the Digital Personal Data Protection Act, 2023, and we are your data processor. This is a valid contract for that purpose under section 8(2) of that Act.
2.2 You decide what Patient Data to collect, the purposes, who the patients are and how long the records are kept.
3. Your instructions
3.1 We process Patient Data only to provide the features of SiriON that you use, including storing, displaying, syncing, exporting and backing up records, sending the patient messages you ask us to send, recording patient consent and, if you use it, the voice assistant. Using these features is your instruction to us.
3.2 We do not use Patient Data for our own purposes, for advertising, for analytics about patients or to train artificial intelligence models, and we do not sell it.
3.3 If a law requires us to process Patient Data in another way, we will tell you first unless the law prevents it.
4. Confidentiality
4.1 Our staff may access Patient Data only where needed to fix a fault you report, to keep the Service secure or to meet a legal duty, and then only to the extent needed. They are bound to keep it confidential.
5. Security
5.1 We protect Patient Data with the measures in section 11 of our Privacy Policy, including encryption in transit, encryption of stored data by our hosting provider, database rules that let each account reach only its own records and an offline copy kept in the app's private storage on your device.
6. Sub-processors
6.1 You authorise us to use the service providers listed in section 9 of our Privacy Policy for the purposes shown there. The ones that process Patient Data are our hosting provider, Google (Gemini API, only if you use the voice assistant), your phone's speech recognition provider (only if you use the voice assistant), Exotel and WhatsApp (only for messages you send to patients), push notification services and our email provider for your data exports.
6.2 We use providers under terms that require them to protect the data. We remain responsible to you for their processing.
6.3 If we add or replace a provider that processes Patient Data, we will update the Privacy Policy and tell you in the app before the change takes effect.
7. Helping you with patient rights
7.1 You can find, correct, export and delete a patient's records in the app. If a patient contacts us directly, we will pass the request to you and help you respond.
8. Breaches
8.1 If we become aware of a personal data breach affecting Patient Data, we will tell you without delay with the information we have, so you can inform your patients and the authorities as the law requires. We will help you with the details you need.
9. Return and deletion
9.1 You can export Patient Data at any time from Settings, Request copy of data. When you delete records or your account, we erase the Patient Data as set out in our Data retention and deletion page, apart from encrypted backups that are replaced within 7 days.
10. Your responsibilities
10.1 You confirm that you:
- obtain and record each patient's consent, or rely on another basis the law allows, before recording their data, and for a child obtain the consent of a parent or lawful guardian;
- tell patients what you record and why; our Patient information notice can help;
- use Patient Data only for treating and managing your patients and for lawful purposes;
- keep it accurate and up to date;
- keep records for the period your professional rules require, including the Dental Council of India's requirement to keep records for at least three years from the start of treatment, and export them before deleting your account;
- keep patient information confidential under your professional code of ethics;
- never share identifiable patient information in Community;
- send messages to patients only with their consent and stop when they ask.
11. Contact
11.1 Soma Chanakya, Grievance Officer, grievance@sirionhealth.com, +91 73962 87866, H.No. 18-2-34/4/9/A, Ghazi-E-Millath Colony, Bandlaguda, Hyderabad, Telangana 500005, India.