Privacy Policy

Zelore (“we”, “us”) operates the Zelore platform at zelore.in: software that lets healthcare clinics take appointment bookings over WhatsApp, send appointment-related messages, and manage their front desk from a web dashboard. We are based in India.

If you are a patient, your relationship is with your clinic. The clinic decides what patient data is collected and why — under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the clinic is the data fiduciary for your records. Zelore processes that data on the clinic’s behalf and on its instructions, as a data processor.

Requests about your records — access, correction, deletion — are best made to your clinic first, since it controls them. We support clinics in responding, and you can also contact us directly (section 13).

For patients:

• Your phone number and the name on your WhatsApp profile or given during booking.
• The content of your WhatsApp conversation with the clinic's number, including anything you choose to share there — which may include health-related details such as symptoms or the reason for your visit.
• Appointment details: the doctor, service, date and time, appointment status, and notes attached to the visit.
• Feedback you send after a visit, if the clinic requests it.

For clinic staff using the dashboard:

• Name, email address, role at the clinic, and sign-in records.

We also keep technical records needed to run the service reliably and securely: message delivery status, security and audit logs.

• From your WhatsApp messages to the clinic's number, including answers you give in the guided booking flow.
• From clinic staff, when they register you, book for you (for example after a phone call or a walk-in visit), or update your records on the dashboard.
• Automatically, as delivery and security metadata when messages are sent and received.

On the clinic’s instructions, we use patient data to:

• Book, confirm, reschedule, and cancel appointments.
• Send appointment-related WhatsApp messages: confirmations, reminders, reschedule notices, follow-ups after a missed visit, and requests for feedback.
• Show the clinic team its own schedule, patient list, and message history.
• Keep the service secure, debug problems, and meet legal obligations.

Messages sent to a clinic’s WhatsApp number are processed by an AI assistant (powered by Google’s Gemini models) so it can understand booking requests and reply on the clinic’s behalf. The assistant only handles appointment-related conversation; it does not make medical decisions and does not provide medical advice.

We do not sell personal data, and we do not use patient data for advertising or for training our own models.

Zelore runs on established infrastructure providers, which process data for us under their own contractual and security commitments:

• Meta Platforms (WhatsApp Business Platform) — carries the WhatsApp messages between you and the clinic, under Meta's own terms and privacy policy.
• Supabase — hosts our database (currently in Singapore).
• Google — provides the Gemini AI models that read and answer booking messages.
• Vercel — hosts the clinic dashboard and this website.

Some of this processing happens outside India (currently in Singapore). Wherever data is processed, it stays protected by the safeguards in this policy and is transferred in accordance with the DPDP Act. Beyond these providers, we disclose personal data only to the clinic it belongs to, or where the law requires it.

• All data is encrypted in transit (TLS).
• Clinic credentials and access tokens are kept in an encrypted vault, never in application code.
• Every clinic's records are isolated at the database layer (row-level security) — one clinic can never read another clinic's data.
• Internal services run with least-privilege access: each component can touch only the data it needs.

No system is perfectly secure, but if a breach affects your personal data we will notify affected clinics and the authorities as the DPDP Act requires.

Patient records are kept for as long as the clinic uses Zelore and needs them — clinics may also be under their own legal duties to retain medical records for minimum periods. When data is no longer needed, or when a valid deletion request is made and no legal duty requires keeping it, it is deleted.

Under the DPDP Act you can:

• Ask what personal data is held about you and how it is used.
• Have inaccurate or incomplete data corrected.
• Ask for your data to be erased, where no legal duty requires keeping it.
• Raise a grievance and have it addressed within the timelines the law sets.
• Nominate another person to exercise these rights for you if you are unable to.

To exercise any of these, contact your clinic, or write to us at the address in section 13. We will respond within the timelines required by law.

The clinic messages you on WhatsApp because you started a conversation with its number, or because you gave the clinic your number and agreed to receive appointment messages. These are service messages about your appointments — not marketing.

You can stop them at any time: tell the clinic in the chat or in person, and it will stop messaging you. Blocking the clinic’s number in WhatsApp also stops all messages immediately.

Appointments for minors should be booked and managed by a parent or guardian, using the parent or guardian’s WhatsApp account. We do not knowingly collect a child’s data outside a booking made by their parent or guardian.

If we change this policy materially, we will update this page and its “last updated” date, and clinics will be informed so they can tell their patients where required.

For privacy questions, requests, or grievances, write to our Grievance Officer at contact@zelorelabs.com. Please mention your clinic’s name and the phone number you use on WhatsApp so we can locate the right records.