Security, Privacy & DPDPA
Patient health records are among the most sensitive data a clinic holds. This page summarises how AmritSmile protects it — the full detail lives on the dedicated Security, Privacy Policy and DPDPA Compliance pages.
Access control, enforced server-side
Every role and permission check — Admin, Doctor, Receptionist, and the granular permissions layered on top of them — is checked on AmritSmile's own servers on every request, not just hidden behind a menu in the browser. One clinic can never reach another clinic's data through the app, and a staff member can't reach data outside their role by going around the interface.
Session security
A login session is never written to browser storage, so it can't be lifted from a stolen laptop, a rogue browser extension, or old devtools data left behind on a shared computer. The short-lived access token lives in memory for that browser tab only; the session that keeps a user signed in across reloads is a secure, HttpOnly cookie no webpage script — including AmritSmile's own — can ever read.
Encryption, backups & documents
All traffic is encrypted in transit with TLS 1.2/1.3. Patient scans, reports and clinical videos sit in a private, access-controlled store behind a CDN — never a public or permanent link, with every view served through a signed link that expires quickly. A full backup runs automatically on a regular schedule, stored offsite and separate from the production server. A deleted file is archived, not destroyed instantly, so an accidental delete is recoverable.
DPDPA — who's responsible for patient data
Under India's Digital Personal Data Protection Act, 2023, the dental practice (the clinic) is the Data Fiduciary for its patients' data; AmritSmile acts as a Data Processor, processing it only as the clinic instructs and never for any other purpose — no advertising, no profiling, no selling or sharing with data brokers. Patient data stays stored and processed in India.
AmritSmile provides the consent-capture, data-access, correction and erasure workflows a clinic needs to meet its own DPDPA obligations to patients, and a signed Data Processing Agreement is available to Professional and Enterprise customers.