Privacy policy

Last updated 1 October 2026 · Applies to Physio Clinic Software by AvanceZone

What this policy covers

This policy explains what AvanceZone ("we") collects when physiotherapy clinics use Physio Clinic Software (the "Service"), why, how long it is kept and who processes it. It applies to the public website, to the clinic application ("workspaces") and to the pages patients and referring doctors open from WhatsApp links (daily exercise plans and progress letters).

Who is responsible. For patient data, the clinic is the data fiduciary (controller) and decides what is collected and why; we process it on the clinic's instructions as data processor. For clinic staff accounts, website enquiries and billing, we are the data fiduciary.

Data we process, and why

Category	Examples	Purpose	Retention
Clinic and staff accounts	Clinic name, GSTIN, staff names, email, phone, role, password hash	Sign-in, billing, support, security	While the workspace is active, then 30 days after closure
Patient identity and contact	Name, phone and WhatsApp number, age, gender, address or area (home visits), preferred language, referring doctor, consent time, WhatsApp opt-in	Scheduling, reminders, home visits, sending exercise plans	Until the clinic deletes the patient or closes the workspace, then 30 days
Clinical records	Assessments (pain map, ROM, MMT, special tests, goals, precautions), SOAP notes, outcome scores (NPRS, ODI, NDI, LEFS, DASH), ROM readings entered from the phone-camera tool, documents such as prescriptions and scan reports	The clinic's treatment records	As the clinic decides (clinics should follow their own medical-record retention rules); deleted 30 days after workspace closure
Home-exercise and adherence data	Exercise plans, daily Done marks, 0–10 pain scores, reply text, plan link visits	Showing adherence and pain trends to the clinic; progress letters the physio chooses to send	With the patient record
Session packs and payments	Packs, balances, invoices, payments, UPI AutoPay mandate references (UPI ID, maximum amount, status, debit references)	Billing, GST invoices, pack renewal	With the patient record; invoices as the clinic's tax law requires
Messages	WhatsApp and SMS content, delivery status, inbound replies	Delivering plans, reminders and nudges; showing history; billing usage	While the workspace is active, then 30 days after closure
Security and audit logs	User, action, time, IP address, browser for creates and edits	Security, accountability, investigating misuse	While the workspace is active, then 30 days after closure
Website enquiries	Name, phone, email, clinic name and message from the demo or contact form	Replying, demos, and product updates with consent	24 months

The phone-camera ROM tool works in the browser: the camera frame or photo stays on the device and is not uploaded or stored. Only the angle the clinician confirms is saved. We do not use patient data to train AI models, for advertising, or for any purpose other than providing the Service to the clinic.

Sharing with referring doctors

Pain scores, adherence, outcome scores and ROM readings leave the clinic only when a physiotherapist reviews a progress letter and sends it to the referring doctor, as a private WhatsApp link or on paper. The clinic records the patient's consent at registration and is responsible for confirming that the patient agrees to reports going to the referring doctor. Nothing is sent to a doctor automatically.

Sub-processors

Function	Provider	Location
Hosting, database and backups	Amazon Web Services (ap-south-1)	Mumbai, India
WhatsApp, SMS and voice messages	AvanceZone messaging gateway, via the Meta WhatsApp Business Platform and Indian telecom operators	India; Meta processes WhatsApp messages in transit
Email delivery (sign-in, invoices, notices)	Our transactional email provider	Named on request
Payments and UPI AutoPay	The UPI / payment gateway the clinic chooses and connects	India
Tele-rehab video calls	Jitsi Meet (meet.jit.si by default, or the clinic's own video server if set)	Depends on the server chosen

A current list with contact details is available at info@radiatus.com. We never sell personal data.

Patients' rights

Patients should contact their clinic first to access, correct or erase their data, withdraw consent or stop WhatsApp messages (the clinic switches WhatsApp off on the patient's record). We help the clinic respond. Clinic staff and website visitors can write to us directly at info@radiatus.com. Under the Digital Personal Data Protection Act 2023 you may also complain to the Data Protection Board of India. For US customers, HIPAA obligations are covered by a signed Business Associate Agreement.

Cookies

We use a strictly necessary session cookie for signed-in users and for the patient plan page, and, if enabled, privacy-friendly analytics with IP anonymisation on the public website. No advertising cookies.

Security

TLS 1.2+ in transit, encrypted storage, Argon2id password hashing, a login per staff member, rate limiting, audit logs of creates and edits, and daily backups kept for 30 days. See the security page.

Changes and contact

We will post changes here and notify workspace owners of material changes by email. Questions: info@radiatus.com, AvanceZone, Coimbatore, Tamil Nadu, or use the contact page. How refunds work is set out in the refund policy.