Privacy Policy

1. Who is responsible

The website and the Vizion Flow service are operated by Siddharth, trading as Velvet Vizion ("we", "us"), based in India at Chandigarh, India. For questions about your data, contact us at legal@velvetvizion.com.

2. Website visitors — what we collect

When you submit a demo or contact form, we collect the details you give us — typically your name, clinic, city, phone and email — to respond to your enquiry and, if you become a customer, to set up your account. We do not sell this information or use it for unrelated purposes. This site sets no marketing or analytics cookies today; the current position is in our Cookie Policy.

3. Website visitors — legal basis and retention

We handle enquiry data on the basis of your request to be contacted and our legitimate interest in responding and running our business. We keep enquiry records only as long as needed to deal with your enquiry and any resulting relationship, then delete or anonymise them.

4. The Vizion Flow service — patient data

Vizion Flow is a dental practice management system, so the data a clinic entrusts to us is clinical as well as commercial. It includes patient identity and contact details, medical and dental history, allergies, charting and periodontal findings, treatment plans and their outcomes, clinical notes, prescriptions, radiographs and clinical photographs, consent records, appointments, invoices and payments, and WhatsApp and enquiry message history.

We process all of it solely to run the service on that clinic's behalf. In data-protection terms, the clinic is the Data Fiduciary that decides why the data is used, and we act as its Data Processor, acting on its instructions. We do not use patient data for our own marketing, we do not sell it, we do not use it to train anything, and we never share one clinic's data with another.

Where a clinic uses the ABDM/ABHA features, a patient's record can be linked to their ABHA number and shared under the consent your clinic records; that sharing happens on your instruction and on the patient's consent, never on ours.

5. How long service data is kept

Nothing is deleted because of a plan. What varies by plan is how far back the dashboard displays: last 90 days of dashboard history on Base, lifetime history + full export on Growth. That is a reporting window, not a retention policy — the full record continues to exist and can be exported in full on either plan, at any time, at no charge. When a clinic leaves, its data is handled as set out in our Data Protection Terms and the Terms & Conditions.

6. Who else touches the data (sub-processors)

Running the service means a small number of trusted providers process data on our instructions:

• Meta Platforms — the WhatsApp Business Platform that delivers and receives your clinic's messages. Clinical records are not sent to Meta; what passes through it is message content and the phone numbers it is addressed to.
• Google Cloud Platform (operated by Google) — our cloud hosting, which runs the application and stores its data, including clinical records and imaging. Our deployment is containerised, so it can be moved to another provider if we ever need to.
• Cashfree Payments — our payment gateway, which processes plan billing and the UPI Autopay mandate. It handles your clinic's payment details, not your patients' records. We do not store your full card or bank credentials ourselves.

7. Where your data is hosted, and cross-border processing

Your clinic's application data — including clinical records and imaging — is hosted on Google Cloud Platform in a Google Cloud region within India, so patient data is resident in India. Message delivery additionally runs on Meta's WhatsApp Business Platform, so some message data may be processed on Meta's infrastructure outside India under Meta's terms. Payments are processed by Cashfree within India. We keep transfers to what the service needs, rely on the protections our providers commit to, and apply any transfer mechanism the law requires.

8. How we protect data

We use access controls, encryption in transit, per-clinic separation so no clinic can see another's data, role-based access inside a clinic so a receptionist and a dentist see different things, an immutable audit trail of who saw and changed what, and limits on who on our side can access what. The specific technical and organisational measures for clinic patient data are set out in our Data Protection Terms.

9. Your rights and how to exercise them

Under the Digital Personal Data Protection Act, 2023, you have rights over your personal data — including access, correction, and erasure — and the right to complain. If you are a patient of a clinic that uses Vizion Flow, the clinic is your first point of contact as the Data Fiduciary; we will support the clinic in meeting your request. Note that some clinical records must be retained by a clinic for a period the law or professional rules require, and an erasure request may be limited by that. For website enquiry data, contact us directly.

10. Grievance Officer

As required by the DPDP Act, 2023, our Grievance Officer is Siddharth, reachable at legal@velvetvizion.com. We aim to acknowledge grievances promptly and to resolve them within the timelines the law prescribes.

11. Changes to this policy

We will update this page as the service and the law evolve — for example when we confirm our analytics stack or add a sub-processor — and will change the "last updated" date above. Material changes affecting clinics will also be notified to them directly.

12. Contact

Questions about this policy or your data: legal@velvetvizion.com. This policy applies to the Vizion Flow website and service operated by Velvet Vizion.