Introduction
SiriON is a digital clinical organization platform designed for licensed healthcare practitioners, postgraduate dental residents, clinics, and academic healthcare institutions.
This Privacy Policy explains how SiriON collects, processes, stores, secures, retains, transfers, and deletes personal data and clinical information in accordance with the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, applicable Indian healthcare regulations, and applicable governmental directions and notifications.
By using SiriON, you acknowledge that you have read and understood this Privacy Policy.
Definitions
Data Principal: For account-related information, the registered healthcare practitioner is the Data Principal. Patients whose information is uploaded to the Platform may also constitute Data Principals under applicable law.
Data Fiduciary: SiriON acts as the Data Fiduciary with respect to operation of the Platform, account administration, platform security, analytics, synchronization services, and related processing activities.
Practitioner: Any licensed dentist, medical practitioner, postgraduate resident, clinic owner, faculty member, healthcare institution representative, or authorized healthcare professional using SiriON.
Clinical Data: Case identifiers, clinical notes, treatment records, appointment information, radiographs, clinical photographs, academic logbook entries, and healthcare documentation.
Data Collection Notice
The following categories of personal data are collected: practitioner account information such as name, email address, mobile number, college name, department information, and profile photo where applicable; clinical documentation information such as patient name or initials, OPD/IPD number, age, sex or gender, treatment details, appointment records, clinical notes, radiographs, clinical photographs, and follow-up data; and technical information such as device information, session identifiers, application logs, audit logs, synchronization logs, and crash reports.
Purposes
SiriON processes information solely for legitimate purposes including creating and managing your account, clinical case organization, appointment scheduling and follow-up tracking, clinical documentation, academic logbook generation, synchronization between devices, security monitoring and fraud prevention, compliance with legal and regulatory obligations, and service maintenance and troubleshooting.
Minimization
SiriON is committed to collecting and processing only the minimum amount of information reasonably necessary for clinical documentation, academic reporting, appointment management, and platform functionality.
Where feasible, users should utilize patient initials, case identifiers, and registration numbers instead of full patient names.
Prohibited Data
Unless specifically required by applicable law and appropriately masked, users shall not upload Aadhaar numbers, PAN numbers, passport copies, voter identification numbers, banking credentials, financial account information, passwords, authentication tokens, or non-clinical biometric information.
Clinical Media
Users may upload clinical photographs, radiographs, CBCT images, and other clinical media solely for legitimate healthcare, educational, or documentation purposes. Users remain solely responsible for obtaining required patient authorizations, institutional approvals, and ethical permissions where required. SiriON does not independently verify patient consent.
Children's Data
SiriON does not intentionally provide services directly to children. Where healthcare practitioners document pediatric cases, such processing may rely upon applicable healthcare-related exemptions under the Digital Personal Data Protection Rules, 2025. SiriON does not profile children or conduct advertising directed toward children.
Data Sharing
SiriON does not sell personal data. Personal data may be shared only with service providers for hosting, storage, authentication, monitoring, communication, and security purposes; with regulatory authorities where required by law; with courts and law enforcement where legally compelled; and with professional advisors where reasonably necessary for legal, compliance, security, or audit purposes.
Security
SiriON implements reasonable security safeguards including encryption in transit, encryption at rest, role-based access controls, audit logging, authentication mechanisms, backup systems, and monitoring and incident response mechanisms. No system can guarantee absolute security, and users remain responsible for device-level security and credential protection.
Breach Response
In the event of a personal data breach, SiriON shall undertake investigation, containment, mitigation, and notification activities in accordance with applicable law and internal incident response procedures.
Retention
Personal data shall be retained only for as long as necessary for disclosed purposes, and retention periods may vary depending upon legal obligations, security requirements, audit requirements, academic requirements, and operational requirements.
Consent Withdrawal
You may withdraw consent for the processing of your personal data by deleting your SiriON account through Settings → Delete Account. Deletion of the account will result in cessation of future processing activities associated with the account, subject to applicable legal, security, audit, fraud-prevention, and regulatory retention requirements.
Rights
Subject to applicable law, you may access your personal information, correct inaccurate information, request deletion where legally permissible, withdraw consent, submit grievances, and nominate another person to exercise your rights in accordance with applicable law.
Grievance
If you have questions, concerns, or complaints regarding the processing of your information, you may contact the Grievance Officer at SiriON using privacy@sirionhealth.com. If you remain dissatisfied, you may exercise remedies available under applicable law, including approaching the Data Protection Board of India.