How Tejoya protects your clinic’s data and your patients’ privacy. Written in plain words, and only about what we actually do.
1. Your data belongs to your clinic
Under India’s Digital Personal Data Protection Act, your clinic is the data fiduciary and Tejoya is your data processor. We use patient data only to do Teja’s work for you, under a written data-processing agreement. You can export everything at any time, and ask us to delete it.
2. What Teja never stores
- No medical records, diagnoses, prescriptions, clinical notes or treatment photos. Teja keeps only what a front desk needs: name, WhatsApp number, language, the service a patient is interested in, appointments, deposits, packages and the chat itself.
- Photos, videos, documents and voice notes sent by patients are not downloaded or stored.
- No card numbers or bank details of patients: they pay your clinic’s UPI directly; Tejoya never holds money.
3. Where data lives
Tejoya runs on servers located in India. Backups are stored encrypted in India as well. Message delivery itself goes through Meta’s WhatsApp Cloud API, as it does for every WhatsApp Business account.
4. Encryption
- All traffic between your phone or laptop and Tejoya is encrypted (TLS 1.2 or higher, HSTS).
- WhatsApp access keys for your number are stored encrypted (AES-256-GCM) with keys kept outside the database.
- Backups are encrypted before they leave the server.
5. Who can see what
- Every clinic’s data is kept separate at the database level (row-level security): a user of one clinic can never read another clinic’s records, and we test this on every release.
- Roles: owner, staff and doctor see only what their role needs. Owners approve money and bulk actions; staff confirm deposits and attendance.
- Two-factor authentication (authenticator app) for clinic owners and for Tejoya’s own administrators. Sessions expire; you can log out of all devices.
- When Tejoya support helps you with a data load, it works in a time-limited, logged ‘assist’ session that shows a banner in your account and is recorded in your audit log.
6. Everything is logged
Every message Teja sends, every booking, every deposit confirmation, every login and every change of settings is written to an append-only audit log with who, what and when. You can read it in your account.
7. Backups and recovery
- Continuous backup of the database (changes copied off the server within minutes) plus nightly full copies, kept for 30 days, in two separate storage locations.
- A restore is tested automatically every week and alerts us if it fails.
- If a server fails, we restore to a new one with a target of 30 minutes and at most a few minutes of data loss.
8. WhatsApp, done the official way
Tejoya uses Meta’s official WhatsApp Cloud API and Meta’s own sign-in to connect your number. No unofficial WhatsApp tools, no phones running automation scripts. Messages are sent only to patients who opted in; STOP is honoured immediately; business-initiated messages use Meta-approved templates.
9. How the AI is used
- The AI (Anthropic’s Claude) reads a patient’s message to understand what they want and to draft a reply in their language. It receives the minimum needed: the message and the clinic’s rate card and FAQ.
- Prices, slots, dates, balances and amounts are decided by fixed rules, never by the AI.
- Under Anthropic’s commercial terms, data sent through its API is not used to train its models.
- Medical questions, complaints and refund requests are never answered by the AI; they go to your staff.
10. Keeping it safe
- Webhooks from Meta are verified by signature; replays are ignored.
- Servers are hardened (key-only access, firewall, automatic security updates), fronted by a web application firewall with rate limiting.
- Dependencies are pinned and scanned; secrets are never stored in code; every change passes automated tests before release.
11. Retention and deletion
When a clinic leaves, it has 30 days to export its data; we delete everything within 90 days of the end of the subscription. An explicit deletion request is completed within 30 days. Invoices are kept only as tax law requires. See our privacy policy and data deletion page.
12. Who else touches the data (subprocessors)
- Meta Platforms (WhatsApp Business Platform): message delivery.
- Anthropic (Claude API): understanding messages and drafting replies.
- Hostinger (servers in India): hosting and backups.
- Brevo: service emails such as login links and invoices.
- Razorpay: your clinic’s subscription payments to Tejoya (not patient payments).
13. If something goes wrong
If we ever find a security incident affecting your data, we tell the affected clinics without delay, notify the Data Protection Board of India as the law requires, and tell affected patients through the clinic. Security researchers can report issues to privacy@tejoya.com; we respond within 2 working days.
14. What we do not claim
Tejoya is not yet ISO 27001 or SOC 2 certified; those audits are planned once we have been serving clinics for a year. Everything on this page describes what the product does today, and it is reviewed on every release.