Privacy & Security Policy

1 Our Commitment to Healthcare Privacy

Clinsyst, operated and maintained by Buraq Dev ("we", "us", or "our"), delivers enterprise-grade dental practice management software designed for private practitioners, group dental clinics, and specialized dental surgery hospitals worldwide.

We recognize that Protected Health Information (PHI), dental charts, radiographs, patient medical histories, and billing records require the highest echelon of security and confidential stewardship. We never monetize, sell, lease, or distribute patient health data or clinic records to advertisers, pharmaceutical aggregators, or third parties.

2 Information We Collect & Process

In delivering the Clinsyst Software-as-a-Service (SaaS) suite, we process the following categories of information on behalf of the subscriber clinic:

• Clinic Administrator & Staff Credentials: Clinic legal name, registered tax identification / TRN, practice physical address, authorized staff names, email addresses, contact numbers, professional license designations, and cryptographic password hashes.
• Patient Electronic Dental Records (EDR): Patient full name, national ID / passport number (where applicable), date of birth, biological gender, contact telephone, email, emergency contact details, medical history, systemic drug allergies, and active clinical alerts.
• Dental Charting & Clinical Data: Interactive adult and pediatric odontogram status (FDI or Universal notations), restorative treatment plans, periodontal pockets, clinical examinations, surgical notes, digital prescription orders, and doctor notes.
• Financial & Invoice Records: Itemized procedure line items, custom fee schedules, discounts, VAT/sales tax rates, payment receipts, balance dues, and payment methods (Cash, Card, Online).
• Device & Session Telemetry: IP address, device fingerprints, browser client agent, and heartbeat timestamps used exclusively for concurrency security and active login quota enforcement.

3 Multi-Tenant Architecture & Data Segregation

Clinsyst operates on a secure multi-tenant infrastructure. Separation of concerns between independent dental clinics is absolute:

4 Cryptographic Standards & Technical Safeguards

• Data In Transit: All communications between clinic web browsers, tablets, and Clinsyst cloud servers are encrypted using Transport Layer Security (TLS 1.3) with HSTS enforcement.
• Data At Rest: Relational databases and media file assets are encrypted at rest with AES-256 bit military-grade cryptographic standards.
• Automated Disaster Recovery: Automated point-in-time database backups are executed continuously and stored in geographically redundant, fault-tolerant infrastructure with 99.9% availability SLA.
• Role-Based Access Control (RBAC): Administrative, dental practitioner, and receptionist roles enforce least-privilege access to clinical records, financial reports, and settings.

5 Third-Party Processors & Integrations

To deliver specific features, Clinsyst interfaces with select tier-1 technology partners under strict confidentiality agreements:

• Meta WhatsApp Business Cloud API: Enables clinics to dispatch automated appointment confirmations, reminders, and prescription PDFs directly to patient WhatsApp numbers. Messages are sent securely via Meta's encrypted cloud API.
• Payment Gateways (Lemon Squeezy & Merchant Processors): For software subscriptions and international checkouts. All card transactions are processed in accordance with PCI-DSS Level 1 compliance; Clinsyst never stores raw credit card numbers.

6 Data Ownership, Retention & Deletion

The subscriber clinic remains the sole proprietor of all patient and clinical data entered into Clinsyst.

You may export your patients, appointment rosters, inventory logs, and invoice reports in standard CSV and JSON formats at any time. Upon subscription termination or upon written request by the clinic owner, all clinic-associated records can be permanently expunged from primary databases within thirty (30) days in compliance with statutory medical record retention obligations.