Privacy policy

Who we are

Cuspel is run by Imanto, Bengaluru. Under India's Digital Personal Data Protection Act, 2023 (the DPDP Act), we are the Data Fiduciary for the personal data you give us. You can write to us at imantobb@gmail.com.

What we keep

• Everyone: your email address (to sign you in), name, mobile number, and whether you are a clinic, a specialist or a patient. If you sign in with Google or Apple, they give us your name and email address. Apple can give us a private address that forwards to yours instead.
• Clinics: the clinic's name, area, street address and UPI ID, and the records it keeps on Cuspel to run its day: each patient's card (file number, name, mobile, age, sex, medical history and a note), appointments and follow-ups, bills and payments, supplies to order, consultants' visits, and the names, phone numbers and UPI IDs of its dealers and consultants.
• Patients: the clinics you joined, the visits you ask for, and the payments you tell a clinic you made. Your clinic's records about you (above) belong to your clinic.
• Specialists: the specialties you take, your qualification, your dental council and registration number, the areas you visit, and if you add them, a line about yourself and your UPI ID. We also note whether we have verified your registration.
• Cases: the specialty, procedure, notes, the dates the clinic needs, the fee offered and the final fee, the visit time, when it was booked, done, paid or cancelled, and the X-rays, photos and PDFs either side adds.
• Ratings you give and receive after a visit.
• A specialist's own visits: visits to clinics that aren't on Cuspel, which you add to your calendar and money pages yourself.
• Technical: a sign-in session kept on your device (a cookie on the website). Our hosting providers keep short-lived logs of requests, such as IP address, browser or app version and time, to keep the service secure.

We don't read your contacts or location. The apps open your photos only when you pick one to add to a case.

Patients' information

A clinic keeps its patients' cards on Cuspel the way it keeps them on paper: a file number, name, mobile, age, sex, medical history and a note. This is health information, and Cuspel holds it for that clinic alone: no other clinic, specialist or patient sees it, and Cuspel uses it for nothing but showing it back to the clinic. A case shared with specialists describes the clinical need (for example “Implant-supported crown, 36”), not the person.

• Clinics: keep patient names, numbers and medical details on the patient's card, and out of case notes, files and the notes on appointments, which is what a specialist may see.
• A clinic can send a patient a link to join. A patient who joins types their own name and mobile number, and says they are 18 or older. Only the clinics they joined see these. A parent can join for a child.
• A patient on Cuspel sees their own appointments, the follow-up their clinic set, and what they owe. They never see the clinic's own notes or card, other patients, or anything about specialists' cases.
• The cards, appointments, bills and follow-ups a clinic keeps are its records. Cuspel stores them for the clinic and doesn't use them for anything else.
• Don't write a patient's name, phone number or ID numbers in a case.
• OPGs, and some IOPA and CBCT software, print the patient's name and date on the image. Crop it out before you add the image.
• Clinics stay responsible for their patients' records, and for the patient's consent to share their case with a specialist and to be treated by one. Cuspel handles the case details and images on the clinic's behalf, only to run that case.

Why we use it

• To run Cuspel: show open cases to verified specialists in that specialty, book visits, show each side the other's contact details, keep the calendar and money pages, and send sign-in codes.
• To keep each clinic's own patient cards, diary, follow-ups, bills and supplies, and show its patients on Cuspel their own visits and bills.
• To check a specialist's council registration before they can see or accept open cases.
• To keep Cuspel safe: stop fake accounts, misuse and fraud, and fix problems.
• To see how the pilot is going, from counts such as cases posted, cases filled within a day and cases paid.
• To meet our legal obligations.

We use your data only for these purposes. We don't sell or rent it, use it for advertising, or send you marketing without asking. You give us this data by signing up and using Cuspel, which is your consent under the DPDP Act. You can withdraw it at any time by deleting your account.

Who sees what

Cuspel admins, who run the pilot, can see everything above so they can verify specialists and fix problems.

We also use a few service providers, who handle data only to provide their service to us:

• Supabase runs our database, file storage and sign-in, on servers in Mumbai.
• Vercel hosts the website. Its servers for Cuspel are in Mumbai, though pages may reach you through its worldwide network.
• Our email provider delivers your sign-in codes, and may handle your email address outside India.
• Apple and Google distribute the apps, and sign you in if you choose them. They know you signed in to Cuspel, but don't receive your Cuspel data from us.

We share data with others only when the law requires it, for example a valid order from a court or the police.

Payments

Cuspel doesn't handle money. A clinic pays a specialist in its own UPI app, or however they usually pay. We keep the UPI ID a specialist adds, the fees, and when each side marked a case paid or received. We never see your bank details.

The same goes for a clinic's own bills: a clinic marks what it paid its labs, dealers and consultants, and a patient pays their clinic in their own UPI app. We keep the amounts, when a patient said they paid, and when the clinic confirmed it.

A specialist can send a clinic a payment reminder on WhatsApp. It links to a page for that one visit, which anyone with the link can open without signing in. It shows the specialist's name, UPI ID and whether their registration is verified, and the visit's clinic, treatment, date, fee and whether it has been paid. Search engines are asked not to list it. The link stops working if the visit is deleted or the specialist deletes their account.

Where it's kept, and for how long

Your data is stored in Mumbai, India. Some of the providers above may handle it outside India, which the DPDP Act allows except for countries the Government of India restricts.

We keep your data while your account is open. When you delete your account, we delete it as described below. Our database backups roll over, so deleted data is gone from them within 30 days. If the law makes us keep something longer, we keep only that, only for as long as required.

Deleting your account

In the app, go to Me and tap Delete account. On the web, go to Delete your account. If you can't sign in, write to imantobb@gmail.com from the email address on your account.

We delete your name, mobile number, email address, clinic address, specialist details, your own visits, ratings you gave and received, and the X-rays and photos you added. Some case records stay, because they are also the other dentist's:

• Clinics: cases nobody booked are deleted. Booked visits that haven't happened are cancelled. Visits a specialist already made stay in their records, with your clinic's name and area, the procedure, dates and fee, because they are part of that specialist's work and payment history. Your notes and address are removed from them.
• Clinics also lose every record they kept on Cuspel: patients, appointments, bills, supplies, consultants' visits, dealers and consultants. Patients who had joined no longer see the clinic, and its link for patients stops working.
• Specialists: booked visits that haven't happened go back to the clinic as open cases. Visits you already made stay in the clinic's records without your name or details.
• Patients: your name, mobile number and email go, with requests the clinic hasn't answered and payments it hasn't confirmed. Your clinic keeps its own card for you and its records of your visits and bills, as it would on paper.
• Once both sides of a case have left Cuspel, the case is deleted.

Your rights

Under the DPDP Act, you can:

• ask for a summary of the personal data we hold about you, and who we have shared it with;
• correct or update it. Most of it you can change yourself, under Me, Edit your details;
• have it erased, by deleting your account;
• withdraw your consent, which on Cuspel means deleting your account. It doesn't undo what was done before;
• nominate someone to use these rights for you if you die or can't act yourself;
• complain to us, and if you aren't satisfied with our answer, to the Data Protection Board of India.

Write to imantobb@gmail.com from the email address on your account. We reply within 30 days.

Keeping it safe

• The database itself checks who may see each record, so the apps can't show you someone else's.
• X-rays and photos are stored privately, and shown through links that expire within an hour.
• Everything travels encrypted (HTTPS).
• There are no passwords to leak: you sign in with a one-time code sent to your email.
• A person checks each specialist's registration before they can accept cases.

No system is perfectly secure. If a breach affects your data, we will tell you and the Data Protection Board of India, as the law requires.

Age

Cuspel is for dental professionals and their patients. You must be 18 or older to use it. A parent or guardian can join their clinic for a child, with their own name and number.

Changes to this policy

If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect. The date at the top shows when it last changed.

Grievance Officer

For complaints about your data or anything on Cuspel, write to our Grievance Officer, Imanto, at imantobb@gmail.com. We acknowledge complaints within 24 hours and resolve them within 15 days.