Privacy Policy

1. Who we are

DexaOS is a multi-tenant cloud dental clinic management system for clinics and dental groups in India. This policy covers the public website at grin.one, the DexaOS application, our operator console, and authorizations used for Growth integrations such as Google Business Profile.

Patient clinical and operational records are created and stored in DexaOS by the clinic, not obtained from Google. Google user data described below is business-profile data used only for Growth features.

2. Information we process

What we process depends on how you use DexaOS. We do not ask the public website for account credentials, and we do not take patient records from Google.

• Website visitors: standard request logs such as IP address, browser type, pages viewed, and referrer, created when you load grin.one. This public site does not set advertising cookies.
• Staff and operator accounts: name, email or mobile number, authentication credentials, invitation and activation records, organization membership, roles, location scope, and security events such as sign-in and permission changes.
• Clinic-hosted operational data: locations, chairs, schedules, treatment catalogs, staff assignments, patient registration and profiles, consent records, appointments, and—when a clinic uses those modules—clinical cases, prescriptions, billing, expenses, and related documents.
• Communications: WhatsApp Business connection metadata, encrypted channel credentials, approved templates, send logs, and conversation messages when a clinic uses DexaOS to message patients.
• Staff notifications: in-app notification records and, if a user enables browser push, a device token used with Firebase Cloud Messaging.
• Public enquiry forms: contact details a prospective patient submits to a clinic’s public enquiry page.

3. Google user data we access

A SaaS Operator connects one platform-managed Google account that clinics add as Manager on their Google Business Profile. Clinic staff and patients do not grant DexaOS access to their personal Gmail, Drive, Photos, or Calendar accounts.

The OAuth scope requested for this integration is only https://www.googleapis.com/auth/business.manage. With that authorization we may read and update Google Business Profile resources that the Manager account can access, including:

• Business listing identity (name, address, phone, website, categories, hours, attributes, and related profile fields)
• Reviews and owner replies
• Local posts and location media
• Performance insights such as search/maps impressions, clicks, and search-keyword impressions when Google provides them
• OAuth tokens needed to keep that connection working

4. How we use Google user data (Limited Use)

DexaOS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google Business Profile data solely to provide or improve user-facing Growth features that the authorized clinic can see in DexaOS: mapping a listing to a clinic location, showing profile completeness and performance, triaging reviews, publishing posts and media, and showing connection health.

• We do not use Google user data to serve advertisements.
• We do not sell Google user data.
• We do not allow humans to read Google user data unless you ask us to (for example support with your consent), it is strictly necessary for security or legal compliance, or the data is aggregated and no longer identifiable.
• We do not use Google user data to train generalized AI/ML models.

5. How we use other information

Independently of Google, we use clinic and staff information to operate DexaOS: authenticate users, enforce tenant isolation and role-based access, schedule appointments, store clinic-authored records, send communications the clinic initiates, show staff notifications, and keep an audit trail of sensitive actions.

We do not join Google Business Profile data with patient clinical records for advertising or for inferring health information. Growth mappings reference clinic location identity only.

When an authorized user requests an AI-assisted review reply draft, DexaOS strips names and phone numbers from review text before that text is sent to an AI provider. If stripping is unsure, no AI call is made and a person writes the reply. AI providers are selected so they must not retain DexaOS data or train on it.

6. How we store and protect information

Clinic data is stored in organization-scoped tenant boundaries. Access is enforced with authentication, organization membership, permission codes, and location scope.

Google OAuth access and refresh tokens, WhatsApp credentials, and similar secrets are stored in a credential vault as encrypted secrets. Application databases keep only opaque vault references and non-secret metadata. Tokens are never shown in the DexaOS user interface, audit payloads, or client applications.

Google Business Profile snapshots used by Growth are stored as tenant-owned records associated with the mapped clinic organization and location.

We use TLS in transit, role-based access control, audit events for sensitive actions, and industry-standard encryption for secrets at rest.

7. Sharing

We share information only as needed to operate the service:

• With Google, when the product calls Google Business Profile APIs on behalf of the authorized Manager account
• With Meta, when a clinic connects WhatsApp Business or Instagram features and DexaOS calls those APIs for that clinic
• With the customer organization that owns the records, for users who are permitted to view that location’s data
• With infrastructure processors (hosting, logging, backup, email, and push-notification delivery) bound to confidentiality and security obligations
• With an AI provider only for a user-requested draft after personal identifiers are stripped as described above
• When required by applicable law, or to protect the security of DexaOS or our users

8. Retention

OAuth and channel credentials are retained while the connection is active and are revoked or rotated when an operator disconnects or replaces them. Clinic operational records and mapped Growth snapshots are retained while the organization remains a customer, and thereafter according to backup and legal-hold requirements. We do not invent a silent purge of audit evidence required for security investigations.

Website server logs are kept only as long as needed for security, debugging, and capacity. Push-notification device tokens are removed when a user disables push or the device is unregistered.

9. Your choices and rights

For patient and clinic operational records entered by a dental organization, that organization decides why the data is processed. DexaOS provides the software and processes those records to deliver the service. For this public website, our operator accounts, and our own support communications, DexaOS uses the information for the purposes in this policy.

Clinic owners can remove the DexaOS Manager role in Google Business Profile at any time. SaaS Operators can revoke the DexaOS OAuth grant from the operator console, which stops new Google API calls. Clinic administrators can disable WhatsApp or other channel connections and revoke staff access.

Depending on applicable law, including India’s Digital Personal Data Protection Act, 2023 (DPDP), you may request access, correction, or erasure of personal data we hold, or raise a grievance. Contact privacy@grin.one. We may need to verify the requester and will not disclose another tenant’s data. Patient-record requests are usually fulfilled through the clinic that holds the record.

10. Children

DexaOS is a business service for dental organizations. It is not directed at children. We do not knowingly collect Google user data from children. A clinic may store a minor patient’s record only as part of dental care it provides, under that clinic’s responsibility.

11. Changes

We will update this page when our data practices or product scope change. The “Last updated” date at the top is the effective date. Material changes that affect Google user data will remain consistent with Limited Use.

12. Contact

Privacy questions, DPDP grievances, and Google user-data requests: privacy@grin.one. Product support: support@grin.one.