Privacy Policy

32 Roots (“we”, “us”, “our”) provides dental clinics in Gurugram, Haryana, together with a website (https://32roots.in) and a patient mobile app that let you book appointments, check in at the clinic, and keep your treatment records, prescriptions and dental membership in one place. This policy explains what information we collect, why, and how you can control it.

If anything here is unclear, email us at gdcgurgaon@gmail.com before you use the app or website — using either means you accept this policy.

1. Information we collect

1.1 Information you provide

• Phone number — used to sign in via one-time password (OTP) and as your primary account identifier.
• Profile details — name, email, date of birth, gender and blood type, if you choose to add them.
• Health information — allergies, medical conditions, treatments, prescriptions and clinical notes, entered by you or by the treating dentist as part of your care.
• Appointment details — clinic, dentist, date/time and any notes you add when booking.
• Referral information — your referral code and, if you use it, who you refer.

1.2 Information collected automatically

• Device push token — so we can send appointment and prescription notifications. Requires your OS-level notification permission.
• Basic technical data — app version, device platform, and request logs kept for security and abuse prevention.

1.3 Information we do not collect

• We do not collect precise device location. The app does not request location permission.
• We do not store your card or UPI details. Membership payments are processed entirely by Razorpay (see §4); we only receive confirmation that a payment succeeded.

2. How we use your information

• To create and secure your account, and verify it’s you via OTP.
• To let you book, reschedule and check in for appointments.
• To let your dentist record and retrieve your treatment history, prescriptions and receipts.
• To activate, track and manage dental membership/care plans linked to your phone number.
• To send appointment reminders, prescription-ready and membership notifications.
• To run the referral programme (matching a referral code to the account that used it).
• To detect fraud, prevent abuse of booking slots or membership offers, and keep the service secure.

We do not sell your personal information, and we do not use your health data for advertising.

3. Roots AI (symptom assistant)

Roots AI answers general dental questions in the app. It gives educational information only, is not a diagnosis, and does not replace an in-person examination by a dentist. Conversations are kept only on your device for that session so you can continue chatting — we do not store Roots AI messages in our database. For each reply, our servers load your own clinical summary (profile, visits, prescriptions) and send that request to our AI processor, OpenRouter; we do not use your messages to train third-party models. Closing the chat or the app clears the thread.

4. Who we share information with

We share the minimum necessary data with the following processors, each bound to use it only to provide their service to us:

• OpenRouter — powers Roots AI replies. Receives the current question, recent in-session chat turns, and a server-built summary of your dental record for that request only; not used to train their models for us beyond providing the reply.
• Firebase (Google) — delivers the OTP used to verify your phone number, and delivers push notifications.
• Razorpay — processes membership payments. They receive your name, phone/email and the amount due; they never receive your health records.
• Supabase — our database and file-storage provider, hosting the records described above.
• Google Maps / Google Places — powers the clinic map and the public reviews shown on our website; no patient account data is sent to Google Places.

We do not share your information with any other third party for marketing purposes.

5. Data retention

We keep appointment, treatment, prescription and billing records for as long as required by applicable medical-records and tax regulations, even after you delete your account — this protects your ability (and your dentist’s legal obligation) to reference past care. Profile fields that are not required for that retention (name, email, date of birth, allergies, etc.) are erased or anonymised when you delete your account, as described in §7.

6. Security

Accounts are authenticated with signed, short-lived tokens. Data in transit between the app/website and our servers is encrypted (HTTPS/TLS). Access to patient records inside our systems is restricted to the clinic staff treating you and to engineering staff who need it to operate the service. No system is 100% secure, and we cannot guarantee absolute security, but we apply industry-standard practices and review them regularly.

7. Your rights & account deletion

You can, at any time:

• View and edit your profile from the app’s Profile screen.
• Delete your account from Profile → Delete account in the patient app, or by emailing gdcgurgaon@gmail.com. This immediately signs you out and erases your profile details (name, email, date of birth, allergies, gender, blood type). As explained in §5, appointment/billing records tied to your visits are kept for legal retention but are no longer linked to an account you can sign back into.
• Request a copy of the personal data we hold about you, or ask us to correct it, by emailing us.
• Withdraw notification permission at any time from your device’s system settings.

8. Children

The app is intended for use by adults managing their own or their family’s dental care. A child’s appointment or record is created and managed by a parent/guardian’s account, not by the child directly.

9. Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with a new “Last updated” date; continued use of the app or website after a change means you accept the updated policy.

10. Contact us

For any privacy question or request, email gdcgurgaon@gmail.com, or reach out at either 32 Roots clinic in Gurugram, Haryana.