Privacy Policy

Datun Health Private Limited("Datun," "we," "us," or "our") operates an AI-powered dental health platform accessible at datunai.com and associated applications. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

We are committed to complete transparency about how we handle your personal data. If you have questions after reading this policy, contact our Data Protection Officer at support@datunai.com.

We collect only what you voluntarily provide during the course of using our services:

• Health Information — symptoms, age, gender, medical history, current medications, known allergies, and pregnancy status as shared during your AI-guided dental consultation.
• Dental Photographs — images you optionally upload for visual evaluation by our AI system.
• Conversation Content — messages exchanged during your consultation, used solely to generate your personalised assessment.
• Account Information — name, email address, phone number, and authentication credentials when you create an account.
• Usage Analytics — anonymised interaction data (page views, session duration, device type) through privacy-respecting analytics. No personally identifiable information is collected through analytics.

We do not collect financial information, government identification numbers, or biometric data beyond dental photographs you voluntarily upload.

Your data is processed exclusively for the following purposes:

• Service Delivery — generating AI-powered dental health guidance tailored to your symptoms and medical context.
• Consultation Records — maintaining your consultation history for continuity of care when you return.
• AI Improvement — improving our AI models using anonymised and aggregated data only. Individual health records are never used in model training without explicit separate consent.
• Safety & Compliance — fulfilling legal obligations, preventing misuse, and ensuring platform security.
• Communication — sending appointment reminders, follow-up messages, and service updates through WhatsApp or email, only with your consent.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), we process your data on the following lawful bases:

• Consent — you provide explicit consent when you begin a consultation, create an account, or upload dental photographs.
• Legitimate Use — processing necessary to provide the service you have requested.
• Legal Obligation — compliance with applicable Indian law, including data protection and healthcare regulations.

You may withdraw consent at any time by contacting us at support@datunai.com. Withdrawal of consent does not affect the lawfulness of processing performed prior to withdrawal.

• Our AI models are developed and maintained by licensed dental professionals working in collaboration with AI engineers.
• AI responses are based on the information you provide. Incomplete or inaccurate input may lead to less relevant guidance.
• We employ a multi-provider AI architecture with built-in safety checks to ensure clinical accuracy and minimise errors.
• AI-generated guidance undergoes continuous clinical review and improvement cycles.
• We do not use your identifiable health data for AI model training. Only anonymised, aggregated patterns may be used, and only with appropriate safeguards.

We share your data only in the following limited circumstances:

• AI Service Providers — your consultation messages are processed by our AI providers (Anthropic, OpenAI, Google) under strict data processing agreements. These providers do not retain or train on your data.
• Infrastructure Providers — hosting (Railway, Vercel), database (PostgreSQL), monitoring (Sentry), and communication (WhatsApp Business API, Resend) providers process data as necessary to operate the platform.
• Legal Requirements — if required by law, regulation, or valid legal process such as a court order.
• Safety — if we believe in good faith that disclosure is necessary to prevent imminent harm to health or safety.

We do not share your personal health data with advertisers, data brokers, marketing companies, or any entity seeking to use your data for commercial purposes beyond providing our service.

• Encryption in Transit — all data transmitted between your device and our servers is encrypted using TLS 1.3 with HSTS enforcement.
• Encryption at Rest — database-level encryption protects stored data.
• Access Controls — role-based access control (RBAC) limits data access to authorised personnel only.
• Password Security — passwords are hashed using bcrypt with per-user salts. We never store plaintext passwords.
• Infrastructure — DDoS protection, bot detection, web application firewall (WAF), and rate limiting are active across all endpoints.
• Monitoring — automated error tracking, security scanning, and dependency auditing are performed continuously.

While we implement industry-standard security measures, no system is completely immune to breaches. In the event of a data breach affecting your personal data, we will notify you and the relevant authorities within 72 hours as required by law.

• Consultation Data — retained for 24 months from the date of consultation to support continuity of care. You may request earlier deletion at any time.
• Account Data — retained for as long as your account is active. Upon account deletion, personal data is erased within 30 days.
• Anonymised Data — aggregated, de-identified data may be retained indefinitely for service improvement and public health research.
• Legal Holds — data subject to legal obligations or disputes may be retained beyond standard retention periods as required by law.

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access — request a copy of all personal data we hold about you.
• Right to Correction — request correction of inaccurate or incomplete personal data.
• Right to Erasure — request complete deletion of your personal data, subject to legal retention requirements.
• Right to Withdraw Consent — withdraw previously given consent at any time.
• Right to Grievance Redressal — file a complaint with us or with the Data Protection Board of India.
• Right to Nominate — nominate another individual to exercise your data rights in the event of your death or incapacity.

To exercise any of these rights, email support@datunai.com. We will respond within 30 days of receiving your request.

For full details of your rights and our obligations, see our DPDP Act Notice.

Datun is not intended for use by individuals under the age of 18 without parental or guardian supervision. We do not knowingly collect personal data from children without verifiable parental consent. If you believe a child has provided us personal data without appropriate consent, contact us immediately at support@datunai.com and we will delete such data promptly.

Your data is primarily stored on servers located in India. However, certain service providers (AI model providers, cloud infrastructure) may process data in jurisdictions outside India. In such cases, we ensure adequate data protection through contractual safeguards, including standard data processing agreements that meet the requirements of the DPDP Act 2023.

We use essential cookies for authentication and session management. For full details, see our Cookie Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on this page with a revised "Last updated" date and, where appropriate, through email or in-app notification.

Your continued use of Datun after changes are posted constitutes acceptance of the revised policy.

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India as established under the DPDP Act 2023.