Privacy Policy

This document is a starting point and not legal advice. Before launch, have it reviewed by a qualified Indian data-protection lawyer to ensure it reflects your actual data practices and obligations under the DPDP Act 2023.

From business customers: name, business name, contact number, email, city and billing details.

From end users (e.g. patients) processed on behalf of our business customers: name, contact number, appointment details, and any messages exchanged over WhatsApp. The business customer is the data fiduciary for this data; ChatFlo acts as a data processor on their instructions.

To provide the service: booking, reminders, payments, records and communication over the WhatsApp Cloud API.

To operate, secure, support and improve the platform, and to comply with legal obligations.

We do not sell personal data.

We process personal data on the basis of consent and for legitimate, specified purposes as required by the DPDP Act. End users can withdraw consent through the relevant business or by contacting us.

Messaging is delivered through the official Meta WhatsApp Cloud API and is subject to Meta's terms and privacy practices. Payment processing is handled by PCI-compliant payment partners. We share data with such processors only to the extent needed to provide the service.

Data is encrypted in transit and at rest, with role-based access controls. We retain data only as long as needed for the purposes above or as required by law, after which it is deleted or anonymised.

Subject to the DPDP Act, you may request access to, correction of, or erasure of your personal data, and may raise grievances. To exercise these rights, contact us at support@chatflo.in.

Questions about this policy? Email support@chatflo.in.