Data processing summary for clinics

Version 1, 18 October 2026

This summary sets out what Javita Consultancy Private Limited (“we”, “us”) does as the data processor of your clinic’s patient data when you use Tejoya. It forms part of our Terms of Service. Where this summary and the Terms differ on data protection, this summary applies.

1. Roles

• Your clinic is the data fiduciary for its patients’ data. You decide why it is collected and how it is used. You are responsible for having patients’ consent where it is needed and for giving them your notice (the annex at the end of this page has a short notice you can use).
• We are your data processor. We process your patients’ data only to provide Tejoya to you.
• For your own account (your team’s logins, billing and invoices) we are the data fiduciary, under our Privacy Policy.

2. What we process

• Whose data: your patients, family members who share a patient’s WhatsApp number, and your team.
• What data: contact details, language, family links, WhatsApp chats (including the text of voice notes and messages your team sends from the WhatsApp Business app on your phone), appointments, treatment interests, quotations, packages, deposits, waiting lists, review requests, after-visit messages and consent records. No medical records, diagnoses, prescriptions, clinical notes or photos.
• What for: replying to patients, booking, reminders, deposit requests, follow-ups, review requests, after-visit messages, reports to you, and the support you ask for.
• How long: while you use Tejoya, within the limits in section 8 of our Privacy Policy.
• If your number stays on the WhatsApp Business app on your phone, we do not store the phone’s contacts or its earlier chat history.

3. Your instructions

• Your settings in the app, the approvals you give (YES or NO on WhatsApp) and written requests from the owner’s registered e-mail address are your instructions.
• We do not use your patients’ data for any other purpose. If a law requires us to process it in another way, we will tell you first, unless the law forbids that.

4. People with access

• Only people we authorise can reach the systems that hold your data, and only to run or support the service. Each of them signs a written confidentiality undertaking before getting access.
• Support access to your account needs a written reason, is limited in time, needs 2-step login and is labelled in your audit log. Support cannot connect, change or see your Razorpay keys.

5. Security measures

We apply the measures on our Security and trust page, including: encrypted connections; encrypted storage of WhatsApp and Razorpay keys; encrypted backups in India; row-level security between clinics; role-based access inside your clinic; owner 2-step login; an append-only audit log; login records kept for 400 days and server logs kept for up to 400 days.

6. Our providers (sub-processors)

• We use the providers listed in our Privacy Policy (section 7). Each provider works under its own terms of service.
• Meta (WhatsApp Business Platform) and, if you connect it, Razorpay are services your clinic signs up to directly. We use them through your accounts, on your instructions.
• Before a new or replacement provider receives your patients’ data, we will e-mail the owner at least 15 days in advance. If you object for a reasonable data-protection reason and we cannot solve it, you may cancel, and we will refund the unused part of any fee you have paid in advance.
• We remain responsible to you for the work our providers do on your data, within the limits in our Terms.

7. If there is a breach

• If we become aware of a personal data breach that affects your patients’ data, we will tell the owner by e-mail and phone without delay, and in any case within 24 hours.
• We will tell you what we know: what happened, when and where; which data and about how many patients; the likely consequences; what we have done and will do; what patients can do to protect themselves; and a contact person. We will send updates as we learn more.
• The DPDP Rules ask you, as data fiduciary, to inform the Data Protection Board of India without delay, to send it a detailed report within 72 hours, and to tell each affected patient without delay. We will prepare drafts of these notices and help you send them.
• We report cyber incidents to CERT-In within 6 hours of noticing them, as its directions require.

8. Patients’ requests

• If a patient asks us directly to see, correct or delete their data, we pass the request to you within 2 working days.
• In the app, the owner can export one patient’s data, correct their details and delete their data. We help when you ask.
• You answer the patient as the data fiduciary. We give you what you need to do that.

9. Deletion and return of data

• You can export all your data at any time until it is deleted: Settings > Data, privacy & audit log.
• If you cancel your plan, your account closes 30 days after your last paid day, and we remind the owner twice to export the data before that. 90 days after the account closes, we delete all your patients’ data, your team’s names and contact details and your clinic’s settings.
• You can ask for deletion sooner: after you confirm a deletion request, it waits 7 days, and you can cancel it within that time. A patient’s request is completed within 30 days of the patient asking.
• What stays after deletion: appointment, deposit, quotation and package records without names or numbers (your accounts need them), our invoices to you (tax law) and the audit log (3 years).
• The WhatsApp access key for your number is erased when your clinic’s patient data is deleted.
• Backup copies expire within about 90 days, so deleted data is gone from them by then.
• On request, we confirm the deletion in writing.

10. Information and checks

• This summary, our Privacy Policy and our Security and trust page describe what we do. We answer the owner’s written security and data-protection questions within 15 working days.
• We do not hold ISO 27001 or SOC 2 certification.

11. Law

This summary is governed by the laws of India. Courts in Hyderabad, Telangana have jurisdiction, as in our Terms.

12. A signed copy

E-mail info@ajenvo.com from the owner’s registered e-mail address with your clinic’s legal name, address and GSTIN (if you have one). We will send this summary as a PDF signed for Javita Consultancy Private Limited within 5 working days.

Annex: a short notice you can show your patients

Your clinic is the data fiduciary, so this is your clinic’s notice. Fill in the parts in square brackets. You can use it as the first WhatsApp message, on a printed card at the front desk, on your website or on a form.

Notes for your clinic (not part of the notice)

• Show the notice before asking for consent. Keep the two boxes separate and unticked.
• Record the consent in the app when you add the patient; the app keeps the source (front desk, form, import) and the date and time.
• For a child, ask the parent or guardian. Do not tick the offers box for a child.