DPDP Act Notice

This notice is issued pursuant to the Digital Personal Data Protection Act, 2023 (DPDP Act) enacted by the Parliament of India. It explains how Datun Health Private Limited processes your personal data, your rights as a Data Principal, and how to exercise those rights.

This notice should be read in conjunction with our Privacy Policy and Terms of Service, which provide additional detail on data handling practices.

Under the DPDP Act, Datun Health Private Limited is the Data Fiduciary — the entity that determines the purpose and means of processing your personal data. As a platform handling health-related information, we implement enhanced safeguards appropriate to the sensitivity of the data we process.

We process the following categories of personal data:

• Identity Data — name, email address, phone number, age, gender.
• Health Data (Sensitive) — dental symptoms, medical history, current medications, known allergies, pregnancy status, dental photographs. This data receives enhanced protection as sensitive personal data.
• Authentication Data — hashed passwords, OAuth tokens, session identifiers.
• Communication Data — consultation messages, support correspondence, WhatsApp interactions.
• Technical Data — device type, browser information, IP address (anonymised), and access logs for security monitoring.

Your personal data is processed for the following specific, stated purposes:

Under Chapter III of the DPDP Act, 2023, you have the following enforceable rights:

To exercise any of these rights, email support@datunai.com with the subject line "DPDP Rights Request". Include your registered email address and the specific right(s) you wish to exercise. We will acknowledge receipt within 48 hours and fulfil valid requests within 30 days.

• Consent is obtained at the point of data collection — when you create an account, begin a consultation, or upload dental photographs.
• Consent is specific, informed, and unambiguous. We describe what data we collect and why before you provide consent.
• Consent records are timestamped and stored as part of your account for audit purposes.
• You can withdraw consent at any time by contacting support@datunai.com or through your account settings.

In the event of a personal data breach that is likely to cause harm to you:

• We will notify the Data Protection Board of India as mandated by the DPDP Act.
• We will notify affected Data Principals (you) without unreasonable delay, and in any case within 72 hours of becoming aware of the breach.
• Notification will include: nature of the breach, data categories affected, likely consequences, and remedial measures taken or proposed.

Under Section 15 of the DPDP Act, Data Principals also have certain duties:

• Provide accurate and complete information when sharing personal data with us.
• Do not impersonate another person or provide false identity information.
• Do not file frivolous or false complaints with the Data Protection Board.
• Do not suppress material information when exercising data rights.

This notice may be updated to reflect changes in our data processing activities, applicable law, or regulatory guidance. Material changes will be communicated through the platform and, where appropriate, via email to registered users. The current version will always be available at datunai.com/dpdp-notice.