Privacy Policy

VieuHealth CareCloud Pvt. Ltd.

Effective Date: July 26, 2026

Version: 1.1

Last Updated: July 26, 2026

Vieu Health CareCloud Pvt. Ltd. is developing and operating a healthcare technology platform for dental clinics and dental professionals in India. The platform enables clinics to digitise, store, access, manage, and update patient dental and medical records, including dental charts, X-rays, radiographs, treatment plans, prescriptions, diagnosis notes, medical history, before-and-after treatment images, appointments, follow-ups, teleconsultations, and related clinical workflows.

This Privacy Policy explains how Vieu Health CareCloud Pvt. Ltd. i.e., the Company collects, receives, stores, uses, shares, retains, deletes, and protects personal data through its website, mobile application, web application, software platform, and related services. It is intended for publication during the beta phase of the product and should be read with the applicable clinic onboarding terms, subscription agreement, consent flows, patient notices, and any specific written arrangements between dental clinic using the platform and the user/patient.

This Policy describes how Vieu Health CareCloud Pvt. Ltd. processes and protects personal information, including patient dental and medical records, in compliance with applicable Indian data protection, technology, and healthcare requirements.

2. Definitions

For the purpose of this Policy:

1. “Vieu Health”, “we”, “us”, or “our” means Vieu Health CareCloud Pvt. Ltd.

2. “Platform” means ‘SmileVieu’, the Vieu Health software, mobile application, web application, website, dashboards, databases, integrations, and related services used by clinics, dentists, clinic staff, specialists, and patients.

3. “Clinic” means a dental clinic, dental practice, hospital, healthcare establishment, or dental professional that subscribes to or uses the Platform.

4. “Clinic Admin” means the person authorised by a Clinic to create, configure, manage, and control clinic-level access to the Platform, including access for dentists, associate dentists, front desk staff, and visiting specialists.

5. “Patient” means an individual who is registered, identified, treated, consulted, or otherwise recognised as a patient by the Clinic that has actively subscribed to our Platform, and whose personal data, dental records, medical records, appointment data, communications, consultation records, treatment information, prescriptions, images, radiographs, or related health information is uploaded to, accessed through, or managed on the Platform by such Clinic, its authorised personnel, or the individual.

6. “Personal Data” means any data about an individual who is identifiable by or in relation to such data.

7. “Health Data” means personal data relating to a Patient’s physical or oral health, medical history, dental history, diagnosis, dental charts, X-rays, radiographs, treatment plans, prescriptions, clinical images, consultation notes, and related healthcare information.

8. “Service Provider” means a third party that helps Vieu provide, host, secure, support, or operate the Platform, including cloud hosting, OTP, payment, communications, support, or related services.

3. Scope of this Policy

This Policy applies to Personal Data processed in connection with:

1. use of the Platform by Clinics, dentists, associate dentists, visiting specialists, front desk staff, Clinic Admins, and Patients;

2. digitisation, upload, storage, viewing, modification, and retrieval of dental and medical records;

3. appointment scheduling, messaging, teleconsultations, digital prescriptions, and patient access to records;

4. clinic onboarding, subscription management, customer support, account administration, security, and billing; and

5. use of third-party service providers such as cloud hosting providers, OTP service providers, and payment gateways.

This Policy does not replace the independent privacy notices, patient consent forms, medical record policies, professional obligations, or statutory duties of Clinics and dentists. Clinics remain responsible for obtaining all legally required consents, authorisations, and notices from Patients for treatment, record management, teleconsultation, and use of the Platform.

4. Beta Phase Notice

The Platform is in beta phase. Certain features, technical controls, vendor arrangements, retention configurations, breach response processes, access controls, and security measures may be under implementation or subject to refinement before full commercial launch. Where implementation details are not final, this Policy identifies them as placeholders or items to be confirmed.

Vieu Health will not represent that a control is fully implemented unless the relevant operational, contractual, and technical position has been confirmed internally. Before full launch, Vieu Health should complete a privacy and security readiness review covering cloud hosting, vendor contracts, breach response, retention, access logging, role-based access controls, multi-factor authentication, session timeout, penetration testing, employee confidentiality, and support access protocols. Clinics and Patients who access or use the Platform during this period do so with the understanding that the Platform is still being tested and improved, and that beta-stage use may involve limitations, interruptions, configuration changes, and residual privacy or security risks.

5. Roles and Responsibilities

5.1 Clinics as primary custodians of Patient records

For Patient dental and medical records created, uploaded, entered, or managed in the ordinary course of dental care, the Clinic ordinarily determines why the data is collected, what clinical information is required, who within the Clinic may access it, how the Patient’s treatment is delivered, and how statutory or professional record obligations are discharged. The Clinic is primarily responsible for how Patient Health Data is collected, used, and managed for treatment and clinical care. Vieu Health does not determine these matters in any way and acts only as the technology platform provider for the Clinic’s use of such information.

5.2 Vieu Health as platform provider

Vieu Health provides the technology infrastructure that enables Clinics to digitise and manage records. 

For Patient Health Data, Vieu Health only supports the Clinic’s use of the Platform and does not decide how that information is collected, used, accessed, corrected, retained, deleted, or managed for treatment or clinical care.

For its own business and Platform operations, Vieu Health handles only limited Clinic-related information, including Clinic subscription details, Clinic account administration information, Clinic support requests, security logs, billing-related information, Platform usage information needed to operate and maintain the service, and records required for legal or regulatory compliance. Vieu Health does not use Patient Health Data for its own independent business, analytics, marketing, commercial, or platform-improvement purposes.

5.3 Patient-facing transparency

Patients may access and view their records through the Platform. However, the Clinic remains the primary point of contact for treatment-related questions, correction of clinical records, deletion requests, and consent management, unless Vieu Health expressly provides a separate patient support channel for platform-related issues.

6. Categories of Personal Data We Process

Depending on how a Clinic uses the Platform, the following categories of Personal Data may be uploaded to, stored on, accessed through, or managed on the Platform at the sole discretion of the Clinic.

6.1 Patient identity and contact data

1. name;

2. age;

3. phone number;

4. email address, where provided;

5. profile photograph, where optionally uploaded;

6. emergency contact details;

7. address, if collected by a Clinic or enabled in the relevant workflow.

 

6.2 Patient Health Data and dental records

1. dental charts;

2. X-rays and radiographs;

3. treatment plans;

4. patient medical history;

5. diagnosis records;

6. medical and dental prescriptions;

7. before-and-after treatment images;

8. documents uploaded by Patients or Clinics;

9. photographs of paper records uploaded for digitisation;

10. teleconsultation records;

11. chat or messaging records;

12. follow-up notes and appointment records.

6.3 Images and biometric-like data

The Platform may store facial or oral images, including before-and-after images and diagnostic images, when uploaded for dental diagnosis, treatment planning, or clinical documentation. Vieu Health does not use biometric or facial data for login. Login is based on OTP using email or phone number.

6.4 Clinic and user account data

1. Clinic name and Clinic profile details;

2. Clinic Admin name, email address, and phone number;

3. dentist, associate dentist, specialist, and staff account details;

4. role, permission, and access configuration data;

5. login credentials and authentication metadata;

6. database logs and access logs;

7. subscription, billing, invoice, and payment metadata.

6.5 Payment-related data

Vieu Health may use Razorpay or another payment gateway for subscription payments or other paid services. Vieu Health does not intend to collect or store credit card numbers, debit card numbers, UPI IDs, or full payment instrument details directly on the Platform. Payment information may be processed by the payment gateway Service Providers in accordance with its own terms, privacy policy, and applicable financial sector requirements.

6.6 Data not currently collected or used

Based on the current beta-phase position, the Platform does not currently collect or use the following for Patient records unless separately enabled by a Clinic or required by law:

1. insurance information;

2. credit card numbers;

3. debit card numbers;

4. UPI IDs;

5. Patient data for marketing;

6. Patient data for commercial sale;

7. cross-clinic benchmarking or industry reports.

 

7. Sources of Personal Data

Personal Data may be collected from:

1. Patients directly, when they enter information, upload documents, access records, schedule appointments, or participate in consultations;  

2. Clinics, dentists, Clinic Admins, front desk staff, associate dentists, or visiting specialists who enter, upload, update, or manage Patient records;

3. paper records, X-rays, radiographs, prescriptions, images, and legacy documents uploaded by Clinics or Patients;

4. account creation and onboarding forms completed by Clinics and Clinic Admins;

5. Platform logs, security systems, and technical monitoring systems;

6. Service Providers involved in hosting, OTP delivery, payments, or other Platform functions.

Vieu Health does not currently migrate data from legacy systems or permit bulk upload as a standard feature. If legacy migration or bulk upload is enabled in future, Vieu Health will implement appropriate contractual, consent, validation, and security controls.

8. Purposes of Processing

Depending on how the Clinic uses the Platform, Personal Data may be uploaded to, stored on, accessed through, or managed on the Platform for the purposes listed below. For Patient Health Data, Vieu Health handles such information only to provide, operate, secure, and support the Platform for the relevant Clinic and in accordance with the Clinic’s instructions. Vieu Health does not independently decide how Patient Health Data is collected, used, accessed, corrected, retained, deleted, or managed for treatment or clinical care. Separately, Vieu Health may handle limited Patient Health Data and Clinic-related information for the following purposes:-

1. creating and administering Clinic accounts;

2. enabling Clinics to create, digitise, upload, store, access, and update Patient records;

3. enabling Patients, dentists, Clinic Admins, associate dentists, front desk staff, and authorised specialists to view relevant records in real time;

4. supporting dental diagnosis, treatment planning, prescriptions, and follow-up care; 

5. enabling appointment scheduling, reminders, follow-up tracking, teleconsultation, and messaging;

6. generating and maintaining digital prescriptions where enabled by the Clinic;

7. supporting Patient access to dental records and reports;

8. providing OTP-based login and account security;

9. providing customer support, troubleshooting, service administration, and account management;

10. billing Clinics, processing subscription payments, and maintaining tax, accounting, and transaction records;

11. maintaining security, preventing unauthorised access, investigating incidents, and protecting the Platform;

12. complying with applicable law, court orders, regulatory requirements, professional obligations, and lawful requests from public authorities;

13. enforcing contracts, terms of use, and clinic agreements;

14. improving the Platform using non-production, dummy, aggregated, anonymised, or de-identified data where legally and technically appropriate.

Vieu Health does not currently use Patient Health Data for advertising, commercial sale, AI training, automated treatment recommendation, X-ray analysis, auto-generation of prescriptions, or predictive dental analytics. 

9. Legal Basis and Consent

Vieu Health and the Clinics handle Personal Data only for lawful purposes under applicable Indian law. Where consent is required, it must be clearly given, informed, voluntary, specific to the purpose, and capable of being withdrawn in accordance with law.

For Patient Health Data processed for clinical care, the Clinic is responsible for obtaining appropriate consent, authorisation, and patient notices for collection, digitisation, storage, use, sharing, teleconsultation, and access through the Platform. This includes consent for uploading historical records, diagnostic images, prescriptions, radiographs, consultation records, and other Health Data.

Vieu Health may obtain consent directly where it collects Personal Data directly from Clinics for account creation, OTP authentication, platform support, subscriptions, payment processing, or other purposes independently determined by Vieu Health. 

Withdrawal of consent may affect the ability to provide access to some or all Platform features. Withdrawal does not affect processing already completed before withdrawal, nor processing required for legal, medical record, professional, contractual, audit, tax, dispute, or regulatory purposes. 

10. Children and Minors

The Platform may contain dental and medical records of children where a Clinic provides treatment to minors. Where Personal Data of a child is processed, the Clinic is responsible for obtaining verifiable consent from the parent or lawful guardian as required under applicable law and for ensuring that the child’s data is processed only for lawful healthcare purposes.

Vieu Health does not knowingly use children’s Personal Data for behavioural monitoring, targeted advertising, profiling, commercial analytics, or any processing that is detrimental to the well-being of a child.

11. Access Controls and User Permissions

Access to Patient records is intended to be controlled at the Clinic level. Authorised users may include:

1. the Patient;

2. Clinic Admin;

3. treating dentist;

4. associate dentist;

5. front desk or administrative staff where permitted by the Clinic;

6. external or visiting specialists, only where permitted by the Clinic Admin.

Clinics may restrict access by department or location where this feature is enabled. 

 

12. Patient Rights

Patients may have rights under applicable law in relation to their Personal Data, including the right to:

1. access their dental and medical records available on the Platform;

2. download reports where enabled;

3. request correction or updating of inaccurate or incomplete Personal Data;

4. request deletion or erasure where legally permissible;

5. withdraw consent where processing is based on consent;

6. receive information about processing activities;

7. nominate another individual to exercise rights in the event of death or incapacity, where applicable under Indian data protection law;

8. raise a grievance concerning processing of Personal Data.

Requests relating to clinical content, correction of medical records, deletion of treatment records, and treatment-related data should ordinarily be directed to the relevant Clinic. If Vieu Health receives a Patient request directly, Vieu Health may route the request to the relevant Clinic, verify the requester’s identity, and provide reasonable platform-level assistance, subject to applicable law and contractual obligations.

Deletion requests may be refused or deferred where retention is required for medical record, professional, legal, regulatory, audit, dispute, tax, fraud prevention, or contractual purposes. 

13. Clinic Rights and Responsibilities

Clinics using the Platform are responsible for:

1. providing accurate notices to Patients regarding digitisation and use of their records on the Platform;

2. obtaining consent for collection, upload, storage, teleconsultation, and sharing of Patient Health Data;

3. ensuring that Patient data uploaded to the Platform is accurate, lawful, clinically appropriate, and relevant;

4. designating authorised Clinic Admins and ensuring that user access is limited to appropriate personnel;

5. removing or disabling access when staff leave or no longer require access;

6. handling Patient requests for access, correction, deletion, and clinical clarification;

7. complying with applicable medical, dental, clinical establishment, telemedicine, prescription, and professional conduct obligations;

8. maintaining appropriate patient consent, treatment, and medical record documentation outside the Platform where required;

9. not uploading unlawful, irrelevant, excessive, or unauthorised data;

10. not using the Platform to share data with unauthorised persons.

14. Sharing and Disclosure of Personal Data

Personal Data may be shared with the following categories of recipients:

1. Clinics and authorised clinic users: Patient records are visible to Patients, treating dentists, Clinic Admins, associate dentists, visiting specialists, and authorised staff as configured by the Clinic.

2. Patients: Patients may access their own records, reports, appointments, prescriptions, and follow-up information where enabled.

3. Service providers: Cloud hosting providers, OTP service providers, payment gateways, support vendors, security providers, and other vendors may process limited Personal Data to provide Platform services.

4. Professional advisers: Lawyers, auditors, accountants, insurers, and consultants may receive limited data where necessary for advisory, compliance, insurance, accounting, or dispute purposes.

5. Authorities: Personal Data may be disclosed to courts, regulators, law enforcement agencies, public authorities, or government bodies where required or permitted by law.

6. Business transfers: Personal Data may be transferred in connection with a merger, acquisition, restructuring, investment, financing, sale of assets, insolvency, or similar transaction, subject to appropriate safeguards.

 

15. Vendors and Third-Party Service Providers

Vieu Health may use third-party service providers to operate the Platform, including:

1. Microsoft Azure: proposed cloud hosting provider;

2. Vonage: OTP delivery provider;

3. MSG91: OTP delivery provider;

4. Razorpay: payment gateway;

5. Other vendors: security, support, analytics, logging, communications, or infrastructure vendors as may be adopted in future.

 

16. International Access and Cross-Border Transfers

Vieu Health is incorporated in India and provides services primarily for Indian Clinics and Patients. Some access or support activity may occur from outside India where authorised personnel, founders, employees, consultants, or vendors are located outside India. 

Personal Data may be transferred to or accessed from locations outside India only in accordance with applicable Indian law, contractual safeguards, internal access controls, and applicable government restrictions on transfer of Personal Data to any notified restricted jurisdiction.

17. Security Safeguards

Vieu Health implements or intends to implement reasonable security safeguards to protect Personal Data against unauthorised access, disclosure, alteration, loss, misuse, or destruction. Current and proposed safeguards include:

1. OTP-based login using email or phone number;

2. encryption in transit;

3. encryption at rest;

4. multi-tenant separation using access controls and credentials;

5. database logs;

6. role-based access controls;

7. restriction of production access by internal personnel;

8. use of dummy data for quality assurance and testing;

9. separation of images and radiographs where applicable;

10. vendor security controls for hosting, OTP, and payments.

 

19. Teleconsultation, Messaging, and Digital Prescriptions

The Platform may support teleconsultation, messaging, follow-up tracking, appointment reminders, and digitally generated prescriptions. Chat records and consultation records may be stored as part of the Patient record. Clinics and dentists remain responsible for complying with applicable medical, dental, telemedicine, prescription, and professional conduct rules when using these features.

Where teleconsultations are recorded, the Clinic must ensure that appropriate notice and consent are obtained before recording and that access to recordings is limited to authorised persons.

20. Analytics, Artificial Intelligence, and Product Improvement

Vieu Health does not currently use Patient data for analytics, benchmarking, commercial insights, AI training, predictive dental analytics, X-ray analysis, treatment recommendation, auto-generated prescriptions, industry reports, commercial sale, or marketing.

Vieu Health may use dummy data for QA and testing. Vieu Health do not use real Patient data in testing.

21. Retention of Personal Data

Personal Data is retained only for as long as necessary for the purposes set out in this Policy, unless a longer retention period is required for clinical, medical record, legal, regulatory, tax, accounting, audit, dispute, fraud prevention, backup, security, or contractual purposes.

Patient Health Data may need to be retained in accordance with applicable medical record, dental practice, professional conduct, limitation, patient safety, and clinical continuity requirements. Clinics are responsible for determining the applicable retention obligations for their Patient records. 

Deleted records may be subject to soft deletion, backup retention, audit logging, or legal hold where required. Permanent deletion may not be immediate if data exists in encrypted backups or is required for compliance purposes.

22. Clinic Termination, Export, and Deletion

If a Clinic terminates its agreement with Vieu Health, the treatment of Clinic and Patient data will be governed by the applicable clinic agreement, this Policy, and applicable law. 

Upon termination, Vieu Health will provide the Clinic with a reasonable opportunity to retrieve or export Clinic-controlled records in a structured format to be finalised. After the retrieval period, Vieu Health may delete or archive the data in accordance with applicable law, the clinic agreement, backup retention rules, and legal retention obligations.

23. Data Accuracy

Clinics and Patients are responsible for ensuring that information submitted to the Platform is accurate, complete, and up to date. Clinical information should be corrected only by authorised clinical personnel or through processes approved by the relevant Clinic. Vieu Health does not independently verify clinical accuracy and is not responsible for clinical diagnosis, treatment decisions, prescriptions, or professional dental advice.

24. Grievance Redressal

Vieu Health will designate a grievance officer or privacy contact to address grievances relating to this Policy. Complaints should be addressed to the relevant Clinic in the first instance.

Vieu Health will endeavour to acknowledge and resolve grievances within the timelines prescribed under applicable law(s) and regulations(s). Where a request concerns Clinic-controlled Patient records, Vieu Health may coordinate with the relevant Clinic to respond appropriately.

25. Data Breach and Incident Response

If Vieu Health becomes aware of a personal data breach affecting Personal Data hosted on the Platform, it will take reasonable steps to assess, contain, investigate, remediate, and document the incident. Where required by applicable law, Vieu Health will notify relevant Clinics and competent authorities within prescribed timelines and in the prescribed manner. Clinics shall undertake to notify Patients affected by such Data Breach(s).

Clinics must promptly notify Vieu Health if they become aware of unauthorised access, credential compromise, wrongful disclosure, or misuse of Patient records through the Platform.

26. Confidentiality and Medical Record Handling

Vieu Health is cognizant that Patient Health Data is confidential and must be handled in accordance with applicable patient confidentiality, professional conduct, medical record, and healthcare standards. Vieu Health personnel, vendors, and authorised users treat Patient Health Data as confidential and access it only for authorised purposes.

Clinics and dentists remain responsible for the clinical content of records, prescription practices, patient communication, teleconsultation compliance, and medical record retention. Vieu Health provides a technology platform and does not independently provide dental diagnosis, dental treatment, clinical advice, or emergency healthcare services.

27. Cookies, Device Data, and Technical Information

When users access the Platform, Vieu Health may collect technical information such as device identifiers, IP address, browser type, operating system, login time, access logs, pages visited, and diagnostic data. This information is used for authentication, security, troubleshooting, usage monitoring, fraud prevention, and improving Platform reliability.

28. Marketing Communications

Vieu Health does not currently use Patient data for marketing. Vieu Health may send service-related communications to Clinics and authorised clinic users in connection with account administration, security, billing, product updates, or operational notices.

Marketing communications, if introduced, will be sent only in accordance with applicable law and applicable consent or opt-out requirements. Patient Health Data will not be used for marketing without a separate lawful basis and appropriate consent.

29. Changes to this Policy

Vieu Health will update this Policy from time to time to reflect changes in law, Platform features, security practices, vendor arrangements, data flows, or business operations. The updated Policy will be made available through the Platform or website with the updated effective date.

For treatment-related requests, correction of clinical records, deletion of dental records, or access to medical records maintained by a Clinic, Patients should contact the relevant Clinic directly.