This policy covers the ToothLink patient app for Android (package
in.dscyberspace.dentasetu.patient) and the patient portal it shares an account with. The app is made
by DS Technology, trading as DS Cyberspace. It is for patients of dental clinics that use
ToothLink, and it shows each patient their own file at their own clinic.
Who is responsible for your data
Your records belong to your clinic. The clinic created your file and decides what goes in it, so under India's Digital Personal Data Protection Act, 2023 it is the data fiduciary. DS Technology is the data processor: we run the software and keep the data on the clinic's behalf. We do not sell it, rent it, use it for advertising, or use it to train anything.
Signing in: your mobile number and a one-time code
- You sign in with the mobile number your clinic has on file. There is no password and no sign-up, so only someone a clinic has already registered can sign in.
- We send a 6-digit code to that number on WhatsApp or SMS, whichever your clinic has set up. To deliver it, the number and the code go to WhatsApp (Meta) or to the clinic's SMS gateway, and nothing else does.
- A code works for 10 minutes and for 5 tries. We keep it only in scrambled (hashed) form, and it is blanked out of our message logs.
- If one number is on more than one file, for example a family sharing a phone, you choose who is signing in.
- Once you are signed in, the app keeps its sign-in token in your phone's secure storage (the Android Keystore). Signing out deletes it.
What the app collects and why
- Mobile number: to sign you in and send the code. It is the number on your clinic file.
- Name, file number and clinic: shown from your clinic file, so you know whose record you are looking at.
- Appointment requests: the doctor, date, time and, if you add one, the reason for the visit. The reason may describe a health problem. It goes to your clinic, which confirms the booking.
- Home visit address: where your clinic makes home visits and you ask for one, the address and landmark you type. They are kept on that booking and seen by the clinic staff who make the visit.
- Messages: what you write in the chat with your clinic. Messages are stored with your file and read by your clinic's staff.
- Camera and microphone: used only while you are on a video consultation. See below.
The app also shows you what your clinic has recorded: your visits, diagnoses, prescriptions and bills, with what was paid and what is due. These come from your file. The app does not ask you to enter them, and it never asks for card or bank details.
Home visits and live tracking
When the doctor sets off for a home visit, the app can show you where the doctor is on a map. That position comes from the doctor's phone, not yours. It is shown only while the visit is "on the way" and only if it is less than 15 minutes old, and it stops once the doctor arrives. The ToothLink app never asks for or reads your location, and it has no location permission.
Video consultations
- The camera and microphone are used only while a call is open. Android asks your permission the first time.
- The call goes directly between your phone and the doctor's (WebRTC) and is encrypted. The sound and picture do not pass through our servers.
- Calls are never recorded or stored, by us, by the clinic's software or by the app.
- To connect, both phones ask a public connection server (STUN, provided by Google) for their internet address. That server sees the address and nothing of the call.
- The room opens 15 minutes before your appointment and closes 2 hours after it.
Medicine reminders
While a course on one of your prescriptions is running, the app puts a reminder on your phone for each dose: morning (9 am), afternoon (2 pm) and night (9 pm), as the prescription says, for up to 14 days ahead. The reminders are scheduled on your phone, so nothing about them is sent anywhere when they go off. The app refreshes them each time you open it. You can switch them off on the home screen, or turn off the app's notifications in your phone's settings.
Prescriptions, bills and documents
A prescription or invoice opens through a link that is signed for you and expires after 30 days. Anyone you forward the link to can open it until then, so share it with care.
Chat with your clinic
The chat is between you and your own clinic. Nobody else can write to you there, and patients cannot write to each other. Before your first message you agree to the chat's rules. You can report any message from the clinic by holding it down: the report comes to us, not to the clinic. The chat is not for emergencies; in an emergency, call your clinic or your local emergency number.
Permissions the app asks for
- Camera and Microphone: for video consultations only.
- Notifications: for medicine reminders. Android asks you first.
- Alarms & reminders (optional, you allow it in Android's settings): so a medicine reminder comes at the exact time rather than up to an hour late.
- Run at start-up: only to put the medicine reminders back after your phone restarts.
- Internet: to reach your clinic's records.
It does not ask for your location, contacts, photos, files, call log or SMS, and it runs no background service.
What we do not do
- No advertising, and no advertising or analytics SDKs.
- No selling or renting of personal data, and no sharing with anyone for their own purposes.
- No tracking across other apps or websites.
Who else handles your data
Only service providers who do a job for us: WhatsApp (Meta) or the clinic's SMS gateway, to deliver your code and the clinic's messages; our hosting provider, on servers in India; and the video connection server described above. Each receives only what that job needs. We disclose data to authorities only where Indian law requires it.
Security
Everything between the app and our servers is encrypted in transit (HTTPS). The app will not talk to an unencrypted address. Each patient sees only their own file, and every request is checked against the signed-in account on our servers. A breach affecting personal data is reported to the Data Protection Board and to the clinics affected, as the Act requires.
How long it is kept
Your records are kept for as long as your clinic keeps your file. Medical and billing records that the law requires a clinic to keep are kept for that period. Messages are kept with your file until the clinic erases it. If a clinic closes its account, its data is kept for 90 days and then deleted.
Deleting your account
You can delete your account in either of two ways:
- In the app: tap the account icon on the home screen, then Delete my account, and confirm with a code sent to your phone.
- On the web, without the app: at https://toothlink.dscyberspace.in/portal/account/delete. Enter your mobile number, type the code we send you and confirm. You can use your portal password instead if you have one.
Straight away, your login is deleted and every phone signed in to it is signed out. Your clinic is then asked to erase your file: your name, contact details, history, photograph and messages. A clinic may have to keep its treatment and billing records for the period the law requires; those are kept under a file number with your details removed. If you cannot get a code, write to mydstechnology@gmail.com with your name, your clinic and your mobile number. More on this is on the data deletion page.
Your rights
Under the DPDP Act you can ask for a copy of your data, ask for it to be corrected or erased, nominate someone to act for you, and complain. Ask your clinic first, because it holds your file and can act on it directly. If it does not respond, write to mydstechnology@gmail.com and we will take it up with the clinic.
Children
The app is meant for adults. A child's file is opened by the clinic with a parent's or guardian's consent, and a child's record is reached through the parent's number on that file. Nothing in the app is directed at children.
Changes to this policy
When what the app collects changes, this page changes with it and the date at the top moves. The rest of what DS Technology does with clinic data is in the general privacy policy.
Contact and grievance officer
- Company:
- DS Technology (DS Cyberspace)
- Email:
- mydstechnology@gmail.com