Privacy policy

Last updated: 28 October 2026

This policy explains what Dentyaan HMS collects, why, where it is kept, and the choices you have. Dentyaan HMS is run by Dentyaan Private Limited ("we", "us"), CIN U62099AP2026PTC129026, registered at 1-70/1, Andhra Bank Street, Vakatippa, U. Kothapalli, East Godavari, Andhra Pradesh 533447, India.

Who this covers

People who visit hms.dentyaan.com or ask us for a demo.
Hospitals that use Dentyaan HMS, and their doctors and staff.
Patients whose records a hospital keeps in Dentyaan HMS.
Labs, scan centres and pharmacies that receive orders from a hospital through Dentyaan HMS.

Who is responsible for what

Under India's Digital Personal Data Protection Act, 2023 (the DPDP Act):

Patient records: the hospital decides what to record and why, so the hospital is the Data Fiduciary. We keep and process these records only to run Dentyaan HMS for the hospital, as its Data Processor: on the hospital's instructions, with the safeguards below, and we tell the hospital at once if something goes wrong.
Website visitors, demo requests and hospital accounts: we are the Data Fiduciary.
ABHA and ABDM: here too we act for the hospital, and the hospital is the Data Fiduciary for its patients. The National Health Authority (NHA) runs ABDM and the ABHA system under its own policies. See ABHA and ABDM.

What we collect

From the demo form: what you type: your name, mobile number, hospital name, town, number of beds, what the hospital uses today, and, if you add them, your email and message.
Hospital accounts: the names, phone numbers and emails of doctors and staff, their roles, and the hospital's details such as its name, address, letterhead, UPI ID, procedures and prices.
Patient records, entered by the hospital: name, age, sex, phone number, place, medical history and alerts, visits and department case sheets, triage, early warning scores, admissions, doctors' and nurses' notes, medicines given in the ward, tests and reports, discharge summaries, antenatal care, PCPNDT Form F, the medico-legal case register, prescriptions, photos and reports, bills and payments, appointments, reminders sent, and the consents the patient gave.
Voice notes: when a doctor records a visit, with the patient's consent, the recording is turned into a draft note. The recording is deleted once the doctor saves the note, unless the hospital has chosen to keep recordings.
Problem reports: what a user writes when they report a problem or ask for a change, and any screenshot they attach.
ABHA details: if a hospital uses the ABHA features, the patient's ABHA number and address and a small ABHA profile, as described in ABHA and ABDM.
Usage: if a hospital switches on Usage hours, the minutes each person uses Dentyaan HMS and on what kind of device (phone, tablet or computer). Nothing about patients.
Technical records: sign-in records and server logs, such as the time, IP address, browser and errors, kept to keep Dentyaan HMS secure and to fix problems.
Access records: which member of staff opened or changed which patient's record, when (to the hour), which parts (such as visits, photos, prescriptions or bills), and from which IP address. Never what they saw. The changes themselves are also recorded: who made them and when.

How we use it

To run Dentyaan HMS for the hospital: records, follow-ups, reminders, prescriptions, bills, stock and orders.
To reply to your demo request and help you start.
To keep Dentyaan HMS secure, fix problems and answer problem reports.
To improve Dentyaan HMS, using usage counts and problem reports.
To see how each hospital and each doctor uses Dentyaan HMS, so we can help hospitals that need it: counts such as visits, new patients, procedures done, follow-ups kept and notes finished, and the rupee totals billed and collected. These counts never include a patient's name, phone number, notes, photos or anything else about one patient.

We do not sell personal data, and we never use patient records for advertising.

AI in Dentyaan HMS

Voice notes, finding the department from what a patient says, and reading handwriting and old records use Google's Gemini models on Google Cloud Vertex AI, in Google Cloud's Mumbai region. Under Google Cloud's terms, Google does not use this data to train its models.
What the AI writes is a draft. Nothing goes into the record until the doctor reads it, corrects it and saves it.
No research use. Dentyaan HMS does not copy patient records for research or for training AI. If a hospital ever wants to take part in research, it needs its own agreement, an ethics committee's approval and each patient's consent first, and this policy will say so before anything is shared.

ABHA and ABDM

Dentyaan HMS can connect a hospital to the Ayushman Bharat Digital Mission (ABDM), run by the National Health Authority (NHA). These features are off unless the hospital switches them on, and they work only once NHA has approved Dentyaan HMS. This section applies whenever they are in use.

Creating an ABHA (Ayushman Bharat Health Account) with Aadhaar: the hospital first reads ABDM's consent text to the patient, and the patient agrees. The patient's Aadhaar number and the OTPs are encrypted and sent only to ABDM. Dentyaan HMS never stores or logs them.
Linking an ABHA the patient already has: the hospital finds it by ABHA number, mobile number, ABHA address or Aadhaar number and checks it with an OTP, or uses the ABHA number with the patient's ABHA password. Dentyaan HMS stores only the ABHA number and address, when it was verified, and a small profile: name, gender, date or year of birth, and the last 4 digits of the mobile number. The photo on the ABHA is shown to staff to check the person, and is not stored. Aadhaar numbers, OTPs and passwords are never stored or logged.
Scan and share: a patient can scan the hospital's QR code in their ABHA app and share their ABHA profile. Dentyaan HMS finds their record, or registers them from the profile (name, gender, birth date, mobile number and address), and gives them a token number for the queue.
Sharing the hospital's records (Dentyaan HMS as a health information provider): the patient's visits are linked to their ABHA, so they can see them in their ABHA app. To link them, Dentyaan HMS sends ABDM the patient's ABHA number and address, name, gender and year of birth, and a label for each visit, such as "Visit, 12 Oct 2026" or "Hospital stay, admitted 12 Oct 2026". Records are sent through ABDM only when the patient grants consent in their ABHA app, and only for the visits, record types and dates in that consent. Each record is encrypted end to end with ABDM's method, so only the receiver named in the consent can read it. When a consent is revoked or expires, nothing more is sent.
Patients linking records from their ABHA app: the hospital sends the patient a code from the hospital's own WhatsApp or SMS, to the patient's own number. Dentyaan HMS does not store the code. It keeps only a one-way check of it, which is removed when the request ends. The hospital can also ask ABDM to text the patient a link to its records, which sends ABDM the patient's mobile number.
Receiving records from other hospitals (Dentyaan HMS as a health information user): a doctor or the hospital owner can ask for a patient's past records from other hospitals. They are shared only if the patient agrees in their ABHA app. Received records are kept encrypted and shown only to the hospital's doctors and owner. They are deleted when the patient revokes consent, when the consent expires, or on the erase date in the consent, whichever comes first. They are never used for research and never included in the hospital's exports.
What we log: for ABDM, Dentyaan HMS logs only which step happened, when, and whether it worked. The logs never hold Aadhaar numbers, OTPs, passwords or the contents of records.

ABDM and NHA run the ABHA system, ABHA apps and consents under their own policies. See abdm.gov.in.

WhatsApp messages

Hospital staff can always send a message from their own WhatsApp with one tap. A hospital can also choose to have Dentyaan HMS send some messages automatically from Dentyaan's WhatsApp number, through Meta's WhatsApp Business Platform (Cloud API).

Only with the patient's yes: automatic messages go only to patients who said yes to "Send me messages on WhatsApp from" their hospital, at registration, on their own phone, or later at the hospital.
What is sent: the hospital's name, the patient's first name, a date and time, a code, the hospital's phone number and a link to their record. Never medicine names, diagnoses, findings or other health details: those stay behind the link, which opens only with the last 4 digits of the patient's phone number.
Meta as a processor: Meta Platforms receives the patient's WhatsApp number and the message to deliver it, and tells us whether it was delivered and read, under the WhatsApp Business terms. Meta may process this data outside India.
STOP: a patient who replies STOP (or रोकें, or ఆపండి) gets no more automatic messages from that hospital. The hospital can also change the answer at any time on the patient's page.
Replies: a reply goes to the hospital as a note in Dentyaan HMS, and the patient gets one short answer with the hospital's phone number. Dentyaan HMS keeps a log of each message (which hospital, which kind, the time and whether it was delivered) for 400 days, without the text of replies.
Dentyaan's number on the phone: the same number is on the WhatsApp Business app, where the Dentyaan team can read and answer chats. When it was connected, WhatsApp shared its contacts and recent chats with Dentyaan's Meta app; Dentyaan HMS counts them and keeps none of them.

To ask Dentyaan HMS to delete data, see how to delete your data.

Records the law treats with extra care

PCPNDT Form F: kept for at least 2 years from the scan, printed and signed for the Appropriate Authority as the PCPNDT Rules ask, and never written with the sex of the foetus. A patient with a Form F from the last 2 years cannot be deleted.
Medico-legal cases: the register stays with the hospital. These visits are never copied to any other store.
HIV test results: shown only to doctors and the owner, as the HIV and AIDS Act, 2017 asks; the front desk sees only that the test was done.
Termination of pregnancy: the written outcome of a pregnancy stays in the record and is never copied to the hospital's reporting copy (the MTP Act).

The hospital's own reporting copy, and its other software

Reporting copy (the hospital's data warehouse): switched on only once the hospital has signed a data processing agreement with us. Each night its records (without phone numbers, addresses, ABHA numbers or doctors' written notes) are copied to its own private store in Google Cloud in Mumbai, for its own reports. Only the Google accounts the hospital names can read it.
Connected software: if the hospital connects its billing, hospital or pharmacy software, Dentyaan HMS reads patients, bills and medicines dispensed from it, to link them to the right visit. Nothing is written back into that software.

Google Cloud, which hosts Dentyaan HMS and runs its AI, in India.
Labs, scan centres and pharmacies a hospital sends an order to. They see only what they need for that order.
The patient, through the link to their own record.
ABDM, and the hospitals and doctors a patient chooses, if the hospital uses the ABHA features. Records go only with the patient's consent in their ABHA app. See ABHA and ABDM.
Meta (WhatsApp), for the automatic messages a hospital chooses: the patient's WhatsApp number and the message, with no health details. See WhatsApp messages.
Messaging services the hospital chooses. Messages a hospital sends from its own WhatsApp go through WhatsApp. If a hospital sets up automatic reminders with its own provider, the WhatsApp Business, SMS or calling provider it chooses receives the patient's number and the message.
Authorities, only when the law requires it.

Our staff who run the service see hospital names and contact numbers, and the counts and totals above for each hospital and doctor. They do not see patient records unless they also work in that hospital. We remove patient details from problem reports before we work on them. To look into a report of misuse or a security incident, a Dentyaan admin can see a hospital's access records and the list of patients whose records were opened or changed in a given time, to give to the hospital. The hospital's owner sees each time we look.

Where it is kept, and for how long

All data is stored in India, in Google Cloud in Mumbai.
The database is backed up every night, and backups are kept for 14 days, in Delhi. Deleted photos and files can be recovered for 30 days, then they are gone.
Access records and the record of changes are kept for 3 years, or for the time the hospital chooses, never less than 400 days, so misuse can be found and looked into. Then they are deleted each night.
Server logs are kept in Mumbai for 400 days, as India's cyber security rules (CERT-In) and data protection rules ask.
Patient records are kept for as long as the hospital keeps them. When a hospital stops using Dentyaan HMS, it can download its records, and we delete the hospital's data when it asks.
Demo requests are kept while we are in touch with you, and deleted when you ask.

How we protect it

Everything travels over HTTPS, and Google Cloud encrypts stored data.
Each person has their own login and sees only what their role needs. Passwords are stored only as secure hashes.
Photos, X-rays and reports are kept private and are never on an open link.
Every important change records who made it and when, and every opening of a patient's record records who opened it.
The hospital owner can see who opened each patient's record, and the whole hospital's access log. Each morning Dentyaan HMS tells the owner if someone opened far more records than usual, or opened records outside hospital hours.

If something goes wrong

If personal data may have been seen, changed or lost by someone who should not have it (a personal data breach):

Hospitals: we tell each affected hospital at once, by phone and in Dentyaan HMS, with what happened, what we have done, and the list of patients whose records were opened or changed in that time, so the hospital can contact them.
The authorities: we report cyber incidents to CERT-In within 6 hours, as Indian law requires. Under the DPDP rules the hospital, as the Data Fiduciary for its patients, tells the Data Protection Board and the affected patients without delay, with a detailed report to the Board within 72 hours; we give the hospital everything it needs for that.
Hospital staff and website visitors: we tell you and the Data Protection Board ourselves.

Your rights

Patients: your hospital holds your record, so you make requests through your hospital: a copy of everything it keeps about you (it can give you one PDF and your photos and X-rays), a correction, deletion, naming a nominee to act for you if you cannot, or a complaint. The hospital notes each request and Dentyaan HMS reminds it until it is answered. From the link to your record you can also download a copy, ask for a copy of everything, a correction or deletion, and stop reminders yourself. If you have an ABHA, you can grant, see and revoke consents for sharing your records in your ABHA app. For patients under 18, the hospital should record the consent of a parent or guardian.

Hospitals, staff and visitors: write to us to see the data we hold about you, correct it, or delete it, or to name a nominee. You can also withdraw a consent you gave, such as for voice notes or research. See how to delete your data.

Complaints: contact our grievance officer, Anil Kumar, at info@dentyaan.com or +91 79765 46258. We reply within 30 days. If you are not satisfied with our reply, you can complain to the Data Protection Board of India.

Cookies

We use cookies only to keep you signed in to the app, and to let a patient open their own record. There are no advertising or tracking cookies, and the website does not use analytics.

Changes and contact

If we change this policy, we will update the date at the top, and tell hospitals before an important change. Questions: info@dentyaan.com or +91 79765 46258.

Dentyaan Private Limited, CIN U62099AP2026PTC129026, 1-70/1, Andhra Bank Street, Vakatippa, U. Kothapalli, East Godavari, Andhra Pradesh 533447, India.