Appointment or enquiry details
Name and contact details, appointment preferences and the information a person chooses to include in a message. Collect only fields required to respond or arrange care; mark optional fields clearly.
Read this before relying on the notice
This is a privacy-readiness notice and a plain-language summary, not a claim of legal compliance or legal advice. Provider and contact details below are based on information supplied by the clinic; the exact services, configurations, processing locations, retention settings and internal request workflows still need verification. Items marked for confirmation must be completed against actual operations and reviewed by qualified counsel before this notice is treated as final.
The short version
Share only what is needed
Use the clinic's published phone or booking channels to make an enquiry. Please do not send Aadhaar/PAN details, payment-card credentials, or detailed medical records through a general website enquiry or messaging channel unless the clinic has specifically requested them through an appropriate process. A request for an appointment is not a confirmed appointment until the clinic confirms it.
01 / Accountability
Who is responsible for your data?
The public-facing clinic name and contact details below are taken from the website. The legal identity of the Data Fiduciary and the person formally responsible for privacy still need confirmation. “Data Fiduciary” is the DPDP Act term for the person or organisation that decides why and how personal data is processed.
- Public-facing name
- DentCraft Dental Clinic
- Data Fiduciary / business name
- Dentcraft (registered legal entity details to be confirmed)
- Clinic address
- Shop No. 1, Sri Venkateshwara Residency, 10th Cross Road, Brindavan Layout, Ashirvad Colony, Horamavu, Bengaluru 560043, Karnataka
- Privacy contact person
- Amalrosa
- Privacy email
- Dentcraft.dent@gmail.com
02 / Data and purpose
What information may be involved
The categories below describe information that may be involved when a person chooses to browse or contact a dental clinic. They are not a claim that every category is currently collected or stored by this website. The clinic must match this list to each live form, system and offline process.
Care-related information
Dental or health information may be shared during care. Do not request detailed medical histories, images or records in a general enquiry channel unless a verified, appropriate process requires it.
Website and device information
Technical information such as IP address, browser details, timestamps and security events may be present in hosting or security logs. The actual logs, provider and retention period have not yet been verified.
Calls and messaging
If you contact the clinic by phone or a third-party messaging service, that service may process your number, message and device information under its own terms. Avoid sending more health information than necessary.
Why information may be used
- To respond to a question, arrange or manage an appointment, and provide requested dental services.
- To communicate about a request or care, and maintain records where a legal or professional obligation applies.
- To protect the website and clinic systems, investigate misuse, and meet applicable legal requirements.
- For optional analytics or promotional communication only if those tools are actually used and the applicable notice, choice and legal requirements have been addressed.
The clinic must document the purpose and applicable legal basis for each data field. Consent is not a blanket permission for unrelated future use; where consent is the basis, it should be specific, informed, unambiguous and withdrawable.
Provisional data inventory
This is a review checklist, not confirmation that every item is collected. The collection path, legal basis, provider, storage, retention and responsible owner must be verified for each live system.
| Data group | Purpose / source | Basis and choice | Storage, recipient, retention and owner |
|---|---|---|---|
| Enquiry and appointment details | Contact details and request supplied by the person to answer an enquiry or arrange a visit. | Map the exact purpose and applicable ground; separate any optional marketing choice. | Handled by Dentcraft; booking enquiries use WhatsApp and Google Sheets as supplied. [Exact fields, retention, deletion and access controls — verify] |
| Care-related information | Information shared for dental care or a clinical consultation. | Document the applicable legal and professional basis; do not collect extra details through a general enquiry. | [CLINICAL SYSTEM, AUTHORISED ACCESS, RECORD PERIOD AND OWNER — VERIFY] |
| Technical and security data | May be generated by hosting, browser requests or security tools while the site is used. | Inventory actual logs and tools; no optional tracking should run before a required choice. | Hostinger is the stated hosting provider. [Log fields, processing location, retention and owner — verify] |
| Promotional preferences | Only if the clinic actually sends promotional messages and records a preference. | Use a separate, optional choice; provide an effective withdrawal route. | [MARKETING TOOL, CONSENT RECORD, WITHDRAWAL AND DELETION — VERIFY] |
04 / Safeguards
Retention and security
Information should be kept only for as long as needed for its stated purpose or a verified legal requirement. Actual retention periods, deletion triggers and provider deletion arrangements have not been supplied and must be documented before publication.
- Enquiries / appointment requests
- Handled by Dentcraft using WhatsApp and Google Sheets; [ACTUAL RETENTION PERIOD AND DELETION TRIGGER — REQUIRED]
- Clinical and payment records
- [APPLICABLE RECORD-KEEPING PERIOD — LEGAL REVIEW REQUIRED]
- Security and access logs
- [ACTUAL LOGGING AND RETENTION CONFIGURATION — VERIFY]
- Backups and provider copies
- Hostinger is the stated backup provider; [BACKUP EXPIRY AND PROVIDER DELETION — VERIFY]
Reasonable safeguards should be selected for the data and risks involved, including access limited by role, secure communications, protected backups, appropriate authentication, careful handling of health details, and incident monitoring. This page does not certify that these controls are deployed; the implementation needs a technical review.
05 / Privacy Centre
Your rights and how to make a request
Subject to the Act, applicable rules, commencement and any lawful limits, a Data Principal may be able to request access to information about processing, correction, completion or updating, erasure, withdrawal of consent, grievance redressal, and nomination. A request may need proportionate identity verification. Do not send Aadhaar or other sensitive identity documents unless they are genuinely necessary and the clinic explains a secure method.
- Email Dentcraft.dent@gmail.com and state that you are making a privacy request. A dedicated secure request form and ticketing workflow have not been supplied.
- Say what kind of request you are making and how the clinic can safely contact you. Do not include another patient's information.
- The clinic should verify only what is reasonably needed, record the request, assess legal retention requirements, and explain any delay, partial fulfilment or refusal where applicable.
This static page does not create a secure request ticket, verify identity, export records, change consent settings or delete data. Those operational workflows must be implemented and tested before the clinic represents them as available.
06 / Children
Children's personal data
Children may use dental services. The Act generally treats a person under 18 as a child, subject to the Act, applicable rules, commencement and any relevant exemption. Where verifiable parental or lawful-guardian consent is required, a child's own checkbox is not a substitute. Do not collect a child's information that is not needed to respond or provide care, and do not use children's information for behavioural monitoring or targeted advertising.
Any healthcare-related exception must be assessed against its actual statutory conditions. The clinic's age-check and guardian-consent process has not been verified and requires legal and operational review.
07 / Indian data protection framework
What the DPDP Act and Rules cover
The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 establish a framework for processing digital personal data in India, with duties for Data Fiduciaries, rights and duties for Data Principals, and an enforcement framework. The rules and Act have commencement provisions that may take effect in phases. The precise provisions in force on a given date must be checked against the official commencement notifications and any amendments; this summary does not replace that check.
Clear notice and choice
Explain what personal data is processed and why in clear, accessible language. Where consent is the basis, obtain it through a clear affirmative action and make withdrawal available.
Purpose and minimisation
Use data for a specified lawful purpose and collect no more than is necessary. Do not turn an appointment enquiry into consent for unrelated marketing.
Permitted processing grounds
Processing may be based on valid consent or a specific “certain legitimate use” provided by the Act. The ground must be identified for each purpose; broad business convenience is not a substitute.
Fiduciary responsibilities
Use appropriate safeguards, engage processors under appropriate arrangements, handle retention and deletion responsibly, and remain accountable for processing done on the clinic's behalf.
Breach response
The Rules describe notice to affected people without delay and notice to the Board without delay, followed by more detailed information within 72 hours unless more time is permitted. Confirm the precise rule, scope and commencement before treating that period as applicable.
Children's data
Apply the Act's requirements for children, including verifiable parental or guardian consent where required, while checking applicable exemptions and conditions.
Data Principal rights and duties
Support applicable access-related information, correction, completion, updating, erasure, grievance, consent withdrawal and nomination rights. The Act also places duties on Data Principals, including providing authentic information and not impersonating another person.
Transfers and processors
Map every processor and processing location. Cross-border transfers may be subject to restrictions or directions; do not promise a location without evidence.
Additional designations
A Significant Data Fiduciary may have additional duties, such as a Data Protection Officer, impact assessment and audit. This clinic is not represented as having that designation; check any government notification.
Logs and retention
Some Rules address retention of specified logs or data for at least one year. That is not a blanket retention period for every record; verify which provision and commencement apply and maintain a purpose-based schedule.
Enforcement and penalties
The Act provides for enforcement by the Data Protection Board and financial penalties for specified contraventions. No website can promise immunity, penalty-proof status or freedom from investigation.
What this page is not
This is a clinic-facing summary, not the verbatim Act or Rules and not a determination that every provision is currently in force. Legal counsel should verify commencement, exemptions, applicable healthcare obligations, retention, notices and grievance timelines before deployment. No government approval or certification is claimed.
09 / Questions and grievances
Contact the clinic about privacy
Email the privacy contact or use WhatsApp to raise a concern. A response period is not stated because the clinic has not supplied its approved grievance SLA. The clinic must publish its actual process and applicable response timelines.
- Privacy email
- Dentcraft.dent@gmail.com
- Message Dentcraft on WhatsApp
- Privacy contact
- Amalrosa
- Address
- Shop No. 1, Sri Venkateshwara Residency, 10th Cross Road, Brindavan Layout, Ashirvad Colony, Horamavu, Bengaluru 560043, Karnataka
- Grievance response period
- [APPROVED INTERNAL SLA AND LEGAL TIMELINE — REQUIRED]
10 / Readiness checklist
Details to confirm before this notice is final
- Confirm the registered legal entity details for “Dentcraft”.
- Every live form, the fields it collects, purposes, required/optional status, consent wording and submission destination.
- Confirm the precise Hostinger, Google Sheets, WhatsApp, email and Google Console services/accounts; check whether Google Analytics or advertising pixels are also installed; document locations, contracts, subprocessors and deletion capabilities.
- Actual cookie and browser-storage inventory, retention schedule, deletion triggers, backup expiry and clinical-record obligations.
- Working processes for consent withdrawal, access/correction/erasure requests, grievance tracking, child/guardian consent and breach escalation.
- Technical safeguards, security headers, access restrictions, backups, incident response and legal review of the current commencement position.
Until these items are verified, treat this page as a draft privacy-readiness notice and not as a complete description of clinic operations.
Version 1.0 · Reviewed 29 September 2026 · Please also read the Terms & Conditions. This notice may be updated when verified practices or applicable law change.