Data processing terms
Last updated 8 Oct 2026
This clause forms part of the terms of service. It covers the personal data of your patients and their family contacts that you record in PhysioBook ("patient data"). Under the DPDP Act, you are the data fiduciary for patient data and PhysioBook is your data processor.
1. Instructions
We process patient data only to provide the service you use: storing and syncing records, calculating balances, and sending the reminders and receipts you set up. We do not use patient data for our own purposes, advertising or model training.
2. Confidentiality and access
Only staff who need it to support you or run the service can access patient data. Any support view of your practice is read-only, needs a recorded reason, expires after 15 minutes and is logged.
3. Security
- Encryption in transit; encrypted backups.
- Database-level isolation between practices (row-level security).
- Least-privilege access for staff and systems, with audit logs.
4. Sub-processors
We use hosting, messaging (SMS and WhatsApp Business), payment and error-reporting providers. We bind them to equivalent obligations and tell you before adding new ones that receive patient data.
5. Breaches
We tell you without undue delay, and within 72 hours, after we become aware of a personal data breach affecting patient data, with what we know and what we are doing, so you can meet your own duties to the Data Protection Board and your patients.
6. Data principal requests
If a patient asks us to access, correct or erase their data, we will pass the request to you and help you respond.
7. Deletion
When your account is deleted, we delete patient data within 30 days, and from backups within a further 30 days, unless the law requires us to keep it.