Privacy Policy
In short. HexSirius Private Limited runs SiriON, an app for dentists, dental students and others in dental practice in India. We collect what we need to run your account, your practice tools, Community and Jobs, and we use it only for those purposes. Patient records you keep in SiriON belong to your practice: you decide what goes in them and we process them only to provide the service to you. You can see, correct, export and delete your data from inside the app, and you can reach our Grievance Officer at grievance@sirionhealth.com.
1. Who we are
1.1 SiriON is provided by HexSirius Private Limited, a private company limited by shares incorporated in India under the Companies Act, 2013, with corporate identity number U62011TS2026PTC214071 and registered office at H.No. 18-2-34/4/9/A, Ghazi-E-Millath Colony, Bandlaguda, Hyderabad, Telangana 500005, India ("we", "us", "our").
1.2 "You" means the person who has created a SiriON account. "Patient" means a person whose details a clinician records in SiriON. "Service" means the SiriON app, its website at https://sirionhealth.com and the services we provide through them.
1.3 This policy explains what personal data we process, why, on what basis, with whom we share it, how long we keep it and what rights you have. It applies together with our Terms of Use.
2. Our role and your role
2.1 Where we decide. For your account, profile, subscription, device, usage, consent records, Community, Jobs and support data, we decide why and how the data is processed. For this data we are the data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
2.2 Where you decide. For patient records you create in SiriON (patient details, appointments, treatment notes, clinical photos and files, consent records and messages sent to patients), you or your practice decide what to record, about whom, why and for how long. For this data you are the data fiduciary and we are your data processor. We process patient data only to provide the Service to you, on the terms in our Clinician data processing terms. We do not use patient data for our own purposes, for advertising or to train artificial intelligence models.
2.3 If a patient contacts us about their data, we will pass the request to the clinician who holds the record and help the clinician respond.
3. Who can use SiriON
3.1 SiriON is for dental students, dentists and others who work in dental practice, who are 18 years of age or older and who are in India. We ask you to confirm that you are 18 or older before you use the Service.
3.2 We do not knowingly process the personal data of anyone under 18 as a user. If we learn that a user is under 18, we will close the account and delete its data as described in section 10. Patient records of children are entered by clinicians, who are responsible for obtaining the consent of the child's parent or lawful guardian.
3.3 The Service is offered in India only. This policy is written for the laws of India.
4. What we collect and why
| Data | Where it comes from | Why we use it | Basis |
|---|---|---|---|
| Account details: name, email address, mobile number, password (stored only as a secure hash), sign-in records | You | To create and secure your account and sign you in | Your consent |
| Profile: specialty, date of birth, city and state, years in practice, working days and hours, photo, chosen colours | You | To set up the app for your practice and show your profile where you choose | Your consent |
| Patient records: patient name, age or date of birth, sex, phone, email, address, medical history, OPD or IPD number, appointments, treatments, tooth details, notes, clinical photos and files | You, as a clinician | To provide scheduling, records, reminders and exports to you | Processed for you as your data processor (section 2.2) |
| Patient consent records and messages to patients: consent method, time and version, phone number, reminder and consent messages sent through WhatsApp | You and the patient's replies | To record the patient consent your practice collects and to send the messages you ask us to send | Processed for you as your data processor |
| Voice assistant input: speech you dictate and the text it produces | You | To fill in a booking from your dictation (section 6) | Your consent, given separately when you turn the feature on |
| Community: username, display name, bio, specialty, clinic name, credentials, headline, research profile links, photos, posts, comments, reactions, polls, follows, connections, direct messages, reports you make, members you block and any moderation decisions about you | You and our moderators | To run the professional Community you choose to join and keep it safe | Your consent |
| Jobs: vacancy details, clinic name and pincode level location, and, if you add it, the exact clinic location (a map pin, the address and landmark you confirm and the Google place identifier of the place you chose); your phone number if you choose to show it, saved jobs, reports | You | To publish vacancies and let members contact the poster | Your consent |
| Approximate location: coarse location, used once when you ask to sort jobs by distance | Your phone, with your permission | To sort jobs near you | Your consent, through the phone's permission prompt |
| Subscription: plan, store, status, renewal and expiry dates, store transaction identifiers | Apple App Store or Google Play, through RevenueCat | To give you the plan you paid for | Your consent and our contract with you |
| Device and usage: device name and model, operating system, app version, push notification token, feature usage counts, IP address of sessions and security events | Your device | To keep your account secure, show your signed-in devices, send notifications you allow and apply plan limits | Your consent and, for security, the legitimate uses the law allows |
| Consent records: which version of each policy you accepted or withdrew, when, the app version, platform, phone settings language and a shortened IP address | Your device and our servers | To prove what you agreed to and when | Compliance with law |
| Support and feedback: messages, bug reports and attachments you send us | You | To answer you and fix problems | Your consent |
| Crash reports: technical details of an app crash | Your device | To find and fix faults | Your consent |
4.1 We do not sell personal data. We do not show advertising in SiriON and we do not use analytics or advertising trackers.
4.2 We collect only what is needed for the purposes above. If we want to use your data for a new purpose, we will ask you first.
5. Health data and patient records
5.1 Health information is sensitive. Patient records are visible only to the clinician account that created them. Our staff do not look at patient records except where needed to fix a fault you report, to keep the Service secure or to meet a legal duty, and then only to the extent needed.
5.2 Before you record a patient, you must have the patient's consent or another lawful basis, as our Terms of Use explain. SiriON provides a way to record that consent in person or through a WhatsApp confirmation.
5.3 Clinical photos you choose to share in Community must not identify the patient. You confirm this before sharing.
6. The voice assistant and other AI features
6.1 The voice assistant lets you dictate a booking. It works like this:
- Your phone's built-in speech recognition (provided by Apple on iPhone and by Google or your phone maker on Android) turns your speech into text. Depending on your phone and its settings, that provider may process the audio on its own servers under its own privacy terms.
- The text and the current date and time are sent from our server to the Google Gemini API. Your list of patients is not sent. We match the name you said to your patients ourselves, on your phone and on our servers.
- Gemini returns the booking details it found. You see them on screen and must check and confirm them before anything is saved.
6.2 We do not store the audio of your dictation and we do not store the dictated text. Only the booking details you confirm are saved, as part of your records. We keep a count of how many times you used the assistant and its technical size, to apply your plan's monthly limit.
6.3 We use Gemini under Google's paid API terms. Under those terms Google does not use the content to improve its products and keeps it only for a limited time to detect misuse and meet legal duties.
6.4 Results can be wrong. You are responsible for checking every detail before you save it. The assistant is only for booking appointments. It does not give medical advice.
6.5 You can turn the voice assistant off at any time in Settings, Legal and policies, Permissions. More detail is in our AI features notice.
7. Community and Jobs
7.1 Community is a professional space for members. Your profile, posts, comments and reactions are visible to other signed-in members. Media you post is stored at web addresses that anyone holding the exact link can open, so do not post anything you would not want shared.
7.2 Direct messages are visible only to the people in the conversation. If someone in the conversation reports a message, a copy of that message is shared with our moderators so they can review it.
7.3 Jobs listings show the clinic name, the approximate location from the pincode, the role details and the poster's name as shown on their Community profile. A phone number is shown only if the poster chooses, only to signed-in members who ask to see it, and the number of times a member can do this is limited. If the poster adds the exact clinic location, members who can see the listing also see the pin, the address and the landmark the poster confirmed. Full rules are in our Jobs Board terms.
7.4 If you allow location, the app reads your approximate (coarse) location once, while the app is open, to sort jobs by distance. It is used for that search and is not stored in your profile. You can search by city or pincode instead.
7.5 Maps. Maps in Jobs are provided by Google Maps. When a map is shown, your phone downloads the map from Google, and Google receives the usual technical data of such a request, such as your device's IP address and the area of the map being shown. When a poster searches for their clinic or asks for an address from the pin, the search text or that point goes to Google from our server, not from your phone, so Google does not receive who you are. We keep none of the coordinates Google returns; we keep only the place identifier of the place the poster chose. Showing the exact clinic location does not use your phone's location. Use of maps is also subject to the Google Maps Terms of Service and Google's Privacy Policy.
8. Notifications
8.1 With your permission we send push notifications through Apple Push Notification service and Google Firebase Cloud Messaging, for reminders, Community activity and account messages. To do this we store a notification token for your device. You can turn notifications off in your phone's settings.
9. Who we share data with
9.1 We share personal data only with the service providers below, only for the purposes shown and under contracts or terms that require them to protect it. Some of them process data outside India. We transfer data outside India only as the DPDP Act and any rules or government orders under it allow.
| Provider | What they do for us | Data involved | Where |
|---|---|---|---|
| Supabase Inc., using Amazon Web Services | Hosts our database, files, sign-in and server functions | All data held in the Service | Servers in Mumbai, India; Supabase staff may access it from other countries for support and security |
| Hostinger International Ltd | Hosts our website at https://sirionhealth.com | Website visitors' IP address, browser details and the pages requested, in server logs | The data centre chosen for our website |
| Google LLC (Gemini API) | Turns dictated text into booking details | Dictated text, date and time | Google's global facilities |
| Apple, Google or your phone maker | Speech recognition on your phone | Audio of your dictation, under their terms | Their facilities |
| RevenueCat, Inc. | Manages subscriptions and purchases | Your account identifier, purchase and subscription records, device and store information | United States |
| Apple (App Store) and Google (Google Play) | Take payment and manage your subscription | Payment and subscription details, under their own terms | Their facilities |
| Apple Push Notification service and Google Firebase Cloud Messaging | Deliver push notifications | Notification token and notification content | Their facilities |
| Functional Software, Inc. (Sentry) | Records app crashes | Technical crash data, device model and operating system | United States |
| Exotel Techcom Private Limited, with WhatsApp (Meta) | Sends appointment reminders and consent messages that your practice sends to patients | Patient phone number and message content | India and WhatsApp's facilities |
| Resend, Inc. | Sends emails, such as your data export link | Your email address and the message | United States |
| Google LLC (Google Maps Platform) | Shows maps in Jobs and finds a clinic or an address for a poster | Map requests from your phone (IP address and map area); for posters, search text or a map point sent from our server | Google's global facilities |
| Google Fonts | Supplies the fonts the app displays | Your device's IP address when a font is downloaded | Google's facilities |
| OpenAlex, Semantic Scholar and the DOI system | Look up publications you link to your Community profile | The publication identifiers you enter | Their facilities |
9.2 We may disclose personal data where the law requires it, for example to comply with a court order or a lawful request from a government agency, and to protect the rights, property or safety of our users or the public.
9.3 If our business is merged or sold, personal data may pass to the new owner, who must continue to protect it under this policy or tell you before anything changes.
10. How long we keep data
| Data | How long we keep it |
|---|---|
| Account and profile | While your account is open. After you delete your account we erase it within 30 days. |
| Registration details (name, email address and mobile number) | 180 days after your account is deleted, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require, then erased |
| Patient records, appointments, clinical files and photos | Until you delete them or delete your account. Export them first if you need to keep them. |
| Community posts, comments, media and messages | Until you delete them or delete your account |
| Content removed for breaking our rules or under a legal order | 180 days after removal, for investigation, as the law requires |
| Jobs listings | Active for 30 days unless renewed. Your phone number is erased 30 days after a listing expires. Expired or filled listings are erased after a year, and removed or rejected listings after 90 days. An exact clinic location is erased when the poster removes it or deletes the listing, and within a day when a listing is removed or rejected. |
| Voice assistant audio and dictated text | Not stored by us |
| Subscription records | While your account is open |
| Security logs, sign-in records and the IP addresses in them | At least 180 days and no longer than two years, including after account deletion, without your name. Technical request logs: a few days. |
| Notification tokens | Until you sign out on that device or delete your account |
| Data export files | Deleted 30 days after they are created |
| Consent records | While your account is open and for 3 years after it is deleted, in a form that no longer shows your name or email address, so we can show what was agreed if a legal claim arises |
| Crash reports | Up to 90 days |
| Backups | Deleted data can remain in encrypted backups for up to 7 days before the backups are replaced |
10.1 Where a law requires us to keep data for longer, we keep it for that period and then erase it.
11. How we protect data
11.1 We protect data with these measures:
- Data travels between your device and our servers over encrypted connections.
- Our hosting provider encrypts stored data.
- Each account can reach only its own data, enforced inside the database.
- The copy of your data kept on your phone for offline use stays in the app's private storage, protected by your phone's own security such as its passcode. Keep a passcode on your phone.
- Passwords are stored only as secure hashes, and you can turn on two-step sign-in with an authenticator app.
- Access by our staff is limited to what their work needs.
11.2 We keep a record of security events in your account, such as sign-ins, password and two-step sign-in changes, data exports and deletion requests, with the time, the IP address and the device. This record is stored in India and kept for at least 180 days and no longer than two years, including after your account is deleted, in a form that no longer shows your name. Our hosting provider also keeps technical logs of requests to our servers for a few days.
11.3 No system is completely secure. If you think your account has been misused, write to grievance@sirionhealth.com straight away.
12. If there is a breach
12.1 If a personal data breach affects you, we will tell you without delay through the app or by email. We will say what happened, what it means for you, what we are doing and what you can do. We will report the breach to the Data Protection Board of India and to CERT-In within the times the law sets.
13. Your rights
13.1 Under the DPDP Act you have the right to:
- Access. Get a summary of your personal data and how we process it, and the list of those we share it with. In the app go to Settings and choose Request copy of data, or write to us.
- Correction. Correct, complete or update your data. You can edit most of it in the app.
- Erasure. Have your data erased. Delete your account in Settings, or write to us. Some data is kept for the periods in section 10.
- Withdraw consent. Withdraw consent as easily as you gave it (section 14).
- Nominate. Name another person to exercise your rights if you die or cannot act. Write to us with the nominee's name and contact details.
- Grievance redressal. Complain to our Grievance Officer (section 17).
13.2 Send requests from the email address on your account, or tell us your registered email address or mobile number so we can identify you. We acknowledge requests within 24 hours and complete them within 7 days. If we need more information to identify you, we will ask.
14. Withdrawing consent
14.1 You can withdraw consent to the voice assistant and other AI features, to Jobs and to patient records processing in Settings, Legal and policies, Permissions. The feature then stops, and we stop the processing that relies on that consent within a reasonable time.
14.2 Our Terms of Use, Privacy Policy, End User Licence Agreement and Community Guidelines are needed to provide the Service at all. To withdraw your consent to them, delete your account.
14.3 Withdrawing consent does not affect processing that took place before.
15. Our website
15.1 Our website at https://sirionhealth.com sets no cookies, runs no analytics or advertising and loads nothing from other companies' servers, such as fonts, scripts, maps or videos. Its preview of the app runs inside your browser with made up people and data and sends nothing to us.
15.2 Our website host keeps standard server logs of each request to the website: your IP address, the page or file requested, the time, the result and the browser's user agent. We use them only to keep the website running and secure. The host keeps them for a short period that it sets.
15.3 Our legal pages may ask our database, run for us by Supabase, for the newest published version of a document, so that you always see the version in force. That request carries your IP address and browser details, as any web request does, and no identifier of you.
16. Changes to this policy
16.1 We may update this policy. Each version has a number and an effective date, and earlier versions stay available on our website. If a change is material, the app will show you a summary and ask you to accept the new version before you continue. Minor changes, such as clearer wording, take effect without a new acceptance. We also remind you of our policies and their key terms at least once every three months.
17. Contact and grievances
17.1 Our Grievance Officer is Soma Chanakya, Grievance Officer.
- Email: grievance@sirionhealth.com
- Phone: +91 73962 87866
- Post: H.No. 18-2-34/4/9/A, Ghazi-E-Millath Colony, Bandlaguda, Hyderabad, Telangana 500005, India
17.2 We acknowledge every complaint within 24 hours and resolve it within 7 days. Our Grievance redressal policy explains the process.
17.3 If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act after using our grievance process.