Privacy policy

Who we are

YojakOS is made and run by Tamkis Private Limited ("we"), 2nd Floor, A-290, Laburnum Victory Floors, 63A, Badshahpur, Gurgaon 122101, Haryana. We are a Meta Tech Provider: clinics connect their own WhatsApp Business Account to YojakOS through Meta's sign-up flow, and YojakOS sends and receives WhatsApp messages for them. Contact: contact@tamkis.com.

Who is responsible

Each clinic decides what patient information it collects and how it uses it. The clinic is responsible for that information (the "data fiduciary" under India's Digital Personal Data Protection Act, 2023). YojakOS stores and processes it on the clinic's behalf (the "data processor"), only to provide our service and only as the clinic instructs. For clinic staff accounts and our own website, we are responsible.

What we collect

• Clinic staff: name, email, phone number, role, and what they do in the app (for security records).
• Patients: name, phone number, and details the clinic enters, such as date of birth, gender, address, visits, queue numbers, bills and notes.
• Payments: amounts, dates and payment method. We do not store card numbers.
• Consent: whether the patient agreed to WhatsApp messages (and, separately, to offers), when, and any withdrawal.
• Technical data: device, browser, IP address and logs needed to keep the service running and safe. We use only the cookies needed to keep you signed in.

Data we get through WhatsApp and Meta

When a clinic connects WhatsApp to YojakOS, we receive and store, for that clinic only:

• The phone numbers of patients who message the clinic or whom the clinic messages, and the WhatsApp profile name they show.
• The content of messages between the patient and the clinic: text, buttons and list choices tapped, and the time sent.
• Delivery statuses from Meta: sent, delivered, read or failed, with the reason for a failure.
• The clinic's WhatsApp Business Account details: account ID, phone number ID, display phone number, business name, and the access key Meta gives us when the clinic connects (stored encrypted, never shown).
• Message templates: their wording, language, category, and Meta's approval status and reasons.

We use this data only to provide the messaging service to that clinic, as described below. We do not use it for advertising and do not sell it.

How we use WhatsApp

• Service messages the clinic sends: queue number confirmations, booking confirmations, reminders, receipts with a link to the bill, and notices when a visit is moved or cancelled. They go only to patients whose WhatsApp consent is recorded at the clinic.
• Replies to patients: when a patient writes to the clinic, a WhatsApp assistant answers with menus (timings, address, prices, the patient's own visits). A patient who wants a person can choose to call the clinic or talk to reception at any time.
• Templates: we create and submit the clinic's message templates to its WhatsApp Business Account for Meta's approval, and track their status.

Patients can reply STOP to stop all WhatsApp messages from that clinic, and START to turn them back on. To stop only offers and keep visit messages, reply STOP OFFERS. Patients can also ask the clinic to stop messages at any time. Messages pass through Meta's WhatsApp Business Platform; Meta processes them under its own terms and the WhatsApp privacy policy.

AI assistant. When YojakOS has it switched on, a typed question the menus cannot answer may be answered by an AI service from Anthropic. It only helps with clinic tasks such as bookings, timings, services, fees and directions. It is not a general chat assistant and does not give medical advice. It gets only the question and the last few messages of that chat, and the clinic's public details (timings, address, doctors, services and fees); never bills or medical records. We remove names and phone numbers from the text before it is sent, as far as we can detect them. Anthropic processes this outside India. Under its commercial terms, Anthropic does not train on this data.

How we use information

• To run the clinic's patients, queue, bookings, bills and messages.
• To keep accounts secure, prevent misuse and investigate problems.
• To support clinics when they ask for help.
• To meet legal duties, such as tax records.
• To improve the service using totals and counts, not individual patient records.

We do not sell personal information and we do not use patient information for advertising or profiling.

Who we share it with

• The clinic the information belongs to, and its staff, as their role allows. One clinic never sees another clinic's data.
• Meta (WhatsApp Business Platform), to deliver WhatsApp messages and templates.
• Service providers that help us run YojakOS (below).
• Authorities, when Indian law requires it.

Our service providers:

• Supabase: database and sign-in. Mumbai, India.
• Vercel: hosting of the website and app. Mumbai, India.
• Meta Platforms: WhatsApp Business Platform, to carry WhatsApp messages and templates.
• Anthropic: the AI assistant above. Outside India.
• Google Workspace (Gmail): sending emails, such as team invites. May be outside India.

Each is bound by a written agreement to process the data only for us and only to provide its service. Data is stored in India, except where listed above.

How long we keep it

• Patient records and WhatsApp messages: for as long as the clinic uses YojakOS, or until the patient or clinic asks for deletion.
• Bills, payments and refunds: for as long as tax law requires (generally 8 years).
• Security and audit records: kept for at least 1 year.
• When a clinic closes its account we delete its data within 30 days, except what the law makes us keep (see closing a clinic).

Security

Information is encrypted when it travels over the internet, and stored in India except as listed above. WhatsApp access keys are stored encrypted. Each clinic can only see its own data, staff see only what their role allows, sensitive actions need extra confirmation, and staff can turn on two-step sign-in. Important changes are recorded in an audit log. Every message from Meta is checked for Meta's signature before we accept it.

If a breach affects your data, we will tell the affected clinics and, where required, the Data Protection Board of India and Meta, without undue delay.

Report a security issue

If you find a security problem in YojakOS, email contact@tamkis.com with the subject "Security". Tell us what you found and how to see it. Please do not access other people's data or disrupt the service while testing. We will reply to tell you we got it.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

• ask for a summary of the personal data held about you and who it was shared with;
• ask for it to be corrected, completed or updated;
• ask for it to be deleted (erased);
• withdraw consent, for example to WhatsApp messages, at any time; this does not affect messages already sent;
• nominate someone to act for you if you die or cannot act;
• complain to our Grievance Officer, and then to the Data Protection Board of India.

Patients can ask their clinic, or us. Clinic staff can ask us about their own account. How to ask for deletion, what is deleted and what the law makes us keep: How to delete your data.

Children

YojakOS is used by clinics, not by children. When a clinic records a patient under 18, the clinic is responsible for getting a parent's or guardian's consent, and messages go to the parent's or guardian's number.

Grievance Officer

Subham Singh, Tamkis Private Limited, 2nd Floor, A-290, Laburnum Victory Floors, 63A, Badshahpur, Gurgaon 122101, Haryana. Email: contact@tamkis.com. We reply within 7 days and resolve complaints within 30 days.

Changes

If we change this policy, we will update the date above and tell clinics about important changes before they apply.