Privacy Policy

1. Scope and who we are

KKS Dental and Medical Care provides dental and related healthcare services and operates websites, patient registration and appointment services, communication channels and internal practice-management systems. In this policy, “KKS”, “we”, “us” and “our” refer only to KKS Dental and Medical Care and its approved brand names, KKS Dental and KKS.

This policy applies to patients, parents or guardians, website visitors, job applicants, employees, doctors, consultants, vendors and other people who interact with us. It should be read together with any consent form, treatment consent, employment notice or service-specific notice provided to you.

2. Information we collect

Depending on your relationship with us, we may collect:

• Identity and contact information: name, age, date of birth, gender, address, mobile number, email address and emergency contact.
• Patient and clinical information: patient number, medical and dental history, allergies, symptoms, diagnoses, prescriptions, treatment plans, clinical notes, consent records, photographs, X-rays, OPG images, laboratory records and follow-up information.
• Appointment and visit information: clinic, doctor or consultant, check-in details, attendance, appointment dates, treatment status and recall or follow-up schedules.
• Payment information: bills, receipts, amounts paid or outstanding, discounts, refunds, payment method and transaction references. Payment credentials may be processed directly by banks or payment providers and may not be stored by us.
• Account and security information: username, securely protected password data, login activity, roles, permissions, one-time-password events and account status.
• Communications and preferences: calls, emails, SMS, WhatsApp messages, feedback, complaints, notification choices and communication consent.
• Workforce and professional information: applications, qualifications, registration details, experience, employment records, attendance, leave, compensation and consultant service information.
• Technical information: IP address, browser and device information, cookies, page activity, referral source and security logs.

We ask you to provide information that is accurate and relevant to the service requested.

3. How we collect information

We may collect information:

• directly from you through registration, check-in, forms, consultations, calls or messages;
• from a parent, guardian, caregiver or authorized representative;
• from our doctors, consultants, employees, laboratories and clinics while providing care;
• from payment providers, banks and other service providers involved in a transaction;
• automatically when you use our website or systems; and
• from lawful public or professional sources where verification is required.

4. How we use information

We process information only for lawful and relevant purposes, including to:

• identify and register patients and maintain accurate records;
• provide consultations, diagnosis, treatment, prescriptions, referrals and follow-up care;
• schedule appointments and communicate confirmations, reminders and care information;
• prepare bills, receive and reconcile payments, issue receipts and manage refunds;
• respond to enquiries, feedback, complaints and support requests;
• manage staff, consultants, recruitment, attendance and professional compliance;
• operate, secure, troubleshoot and improve our website and internal systems;
• prevent fraud, misuse, unauthorized access and threats to patient or system safety;
• measure clinic operations and service quality using appropriately limited or aggregated information; and
• meet legal, regulatory, professional, accounting and record-keeping obligations.

Where consent is the appropriate basis, you may withdraw it for future processing. Withdrawal does not affect processing already carried out and may limit services that depend on the information.

5. Health and clinical information

Health information is handled as confidential information. Access is limited according to role, clinic, professional responsibility and the need to provide or administer care. We may share relevant records with a treating doctor, consulting doctor, authorized consultant, laboratory or referral provider when necessary for treatment, continuity of care or patient safety.

Patients may authorize us to provide records to another person or healthcare provider. We may ask for identity verification and written authority before releasing records. Clinical records cannot always be deleted immediately because healthcare and other applicable laws may require retention.

6. WhatsApp, SMS, email and phone communications

With your consent or where otherwise permitted, we may use WhatsApp, SMS, email or telephone for appointments, reminders, follow-ups, payment information, prescriptions, patient summaries, bills, receipts, X-rays, service messages and support. Messages may pass through the relevant communication provider and are also subject to that provider’s privacy terms.

You may ask us to stop optional WhatsApp or promotional communications. We may still send essential service, safety, legal or transaction communications where permitted. Please avoid sending unnecessary sensitive information through an unsecured or shared device.

7. Google services and advertising data

Authorized Global Administrators may connect KKS-owned Google accounts to manage clinic advertising. The system may access Google Ads customer identifiers, campaigns, budgets, advertisements, keywords, search terms, clicks, costs, conversions and performance information. This information is used only to create, review, publish, monitor and improve KKS Dental or KKS advertising campaigns.

Google authorization tokens are access-restricted and securely protected. Google account information is not sold, used for unrelated advertising or disclosed to third parties except service providers needed to operate the integration or where required by law. An authorized administrator may disconnect Google access. Patient clinical records are not uploaded to Google Ads for campaign management.

8. When we share information

We may share the minimum information reasonably necessary with:

• authorized doctors, consultants, employees, clinics and laboratories involved in care or operations;
• cloud hosting, storage, communications, document, analytics and technical-support providers;
• banks, payment gateways and financial service providers processing transactions;
• professional advisers, auditors and insurers subject to confidentiality duties;
• government, regulatory, judicial or law-enforcement authorities where legally required; and
• another person or organization when you have authorized the disclosure.

Service providers are expected to use information only for the agreed service and to apply appropriate safeguards. We do not sell patient personal information or clinical records.

Some service providers may process information outside India. Where this occurs, we use appropriate contractual, technical and organizational safeguards and follow applicable transfer restrictions.

9. Security

We use administrative, physical and technical safeguards appropriate to the nature of the information. These may include role-based access, tenant and clinic restrictions, authentication controls, protected credentials, secure transmission, monitoring, backups and audit records. Access is removed or changed when a user’s role or status changes.

No system is completely secure. If we identify a personal-data incident, we will investigate, contain and notify affected people or authorities when required. You should keep login credentials confidential and notify us promptly about suspected unauthorized access.

10. Retention and deletion

We retain information only for as long as needed for care, the purposes described in this policy, dispute resolution, security, accounting and applicable legal or professional record-keeping requirements. Retention periods differ by record type. When information is no longer required, we delete, anonymize or securely archive it as appropriate. Backup copies may remain for a limited period before deletion.

11. Your choices and privacy rights

Subject to applicable law and necessary identity verification, you may request to:

• know what personal information we process and why;
• access or obtain a copy of eligible personal information;
• correct inaccurate or incomplete information;
• withdraw consent or change optional communication preferences;
• request deletion where retention is not legally or clinically required;
• nominate another person to exercise applicable rights where permitted; and
• raise a complaint about how information has been handled.

We may retain or restrict access to information where necessary to protect another person, preserve clinical integrity, prevent fraud, establish legal claims or comply with applicable requirements.

12. Children and dependent patients

Information about a child or a person who cannot independently provide valid consent should be supplied by a parent, lawful guardian or authorized representative. We may take reasonable steps to verify that authority. We use such information to provide care, maintain records and communicate with the responsible adult. A child should not create an account or submit personal information without appropriate supervision.

13. Changes to this policy

We may update this policy when our services, technology or legal obligations change. The current version will be published on this page with its effective date. Where a change materially affects how we use information, we will provide additional notice or obtain consent when required.