Data Protection & Security Architecture

Data Protection Policy

Last Updated: July 31, 2026 · Digital Personal Data Protection (DPDP) Act & HIPAA Compliant

1. Architecture & Regulatory Alignment

DentoSol ("Platform", "we", "us") delivers high-availability dental practice management infrastructure across India and globally. We strictly enforce the Digital Personal Data Protection Act, 2023 (DPDP Act), HIPAA Security and Privacy Rules, and NABH Digital Health Standards.

All electronic health data, FDI 32-tooth odontograms, 3D STL digital impression models, and intraoral radiographs are classified as Protected Health Information (PHI) and isolated with strict logical tenancy boundaries.

2. Encryption at Rest & in Transit

Data in Transit: All communications between web browsers, clinic operatories, mobile applications, and API microservices are secured using TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS).
Data at Rest: Core relational databases, document caches, and file vaults utilize AES-256 bit hardware-accelerated encryption with automated KMS key rotation every 90 days.
Digital Dental Models (STL/OBJ/PLY): Laboratory 3D files are stored in cryptographically signed private S3 buckets accessible only via time-bounded presigned URLs.

3. Multi-Tenant Isolation & Role-Based Access (RBAC)

Every clinic operates within an isolated tenant partition. Access permissions follow the Principle of Least Privilege (PoLP):

Front Desk: Appointment scheduling, check-in queue, and point-of-sale receipting. No access to private clinical diagnostic notes.
Dentists & Specialists: Full clinical charting, electronic health records, treatment plans, and digital prescriptions.
Dental Technicians: Dental appliance prescriptions, fabrication workflows, and shade/STL attachments.
Patients: Secure access to their personal invoices, appointments, and published prescription summaries.

4. Self-Service Account Deletion & Data Erasure Lifecycle

Under Section 12 of the DPDP Act 2023, data principals have the right to revoke consent and request the erasure of personal telemetry and login credentials. Any authenticated user (patients, clinic staff, or administrators) can execute self-service account deletion via their Settings portal.

What happens upon confirming account deletion:

Immediate Session Revocation: All active JWT access tokens, refresh tokens, and mobile sessions are invalidated on all devices.
Communication Opt-Out: Transactional SMS alerts and WhatsApp notifications are terminated immediately.
PII Scrubbing: Personal identifiers (name, mobile number, photo, password hash, and email) are expunged or replaced with randomized hashes within 30 statutory days.

5. Statutory Healthcare & Tax Retention Overrides

In accordance with Indian statutory requirements, certain categories of records cannot be purged immediately upon account deletion:

Dental Council of India (DCI) / Medical Council Mandate: Licensed clinics are legally obligated to maintain dental treatment charts, surgical procedure records, and patient case files for a statutory period of 5 years. These records are transferred into immutable, encrypted cold storage.
Goods and Services Tax (GST) Act: B2B and B2C tax invoices and payment ledger entries are retained for 7 years in compliance with the Central Board of Indirect Taxes and Customs (CBIC).

6. Data Protection Officer (DPO) & Grievances

For data subject access requests (DSAR), regulatory audits, or data portability exports, contact our dedicated Data Protection Officer:

Data Protection Officer — DentoSol

DentAssure Health Plans Pvt. Ltd.

Email: privacy@dentosol.in

Statutory inquiries receive an acknowledgment within 24 hours and formal resolution within 30 days.