Effective Date: March 23, 2026 Last Updated: March 23, 2026

1. About This Policy

Clinovate Technologies Private Limited (“Clinovate,” “we,” “us,” or “our”) is committed to protecting the privacy and security of personal data. This Privacy Policy describes how we collect, use, store, share, and protect information when you use our website, and products — Smiloop (patient engagement platform) and Orisync (AI-powered clinical operating system).

By using our services, you agree to the practices described in this policy.

2. Who We Are

Clinovate Technologies is building the AI infrastructure layer for dentistry — connecting patients, clinics, and clinical data to power the future of dental care.

Registered Office: #48, 1st Floor, 2nd Main Road, Nanganallur, Chennai – 600061, Tamil Nadu, India

Data Controller: Clinovate Technologies Private Limited Contact: Info@clinovatetechnologies.com

3. Information We Collect

3.1 Information You Provide Directly

• Contact & Inquiry Forms: Name, email address, phone number, organization, and message content
• Investor Inquiries: Name, organization, investment interest, and contact details
• Account Registration (Smiloop / Orisync): Name, email, clinic details, role/designation
• Clinical Data (via clinic partners): Patient dental history, treatment records, diagnostic data — collected only through registered clinic accounts

3.2 Information Collected Automatically

• IP address and approximate location
• Browser type, device, and operating system
• Pages visited, time on site, referral source
• Interaction logs within our platforms

3.3 Information from Third Parties

• Partner dental clinics that integrate our platforms
• Marketing and analytics platforms (Google, LinkedIn)
• Payment processors (if applicable)

4. How We Use Your Information

We use the information we collect for the following purposes:

We do not sell your personal data to third parties.

5. Clinical and Patient Data

Clinovate operates as a data processor for dental clinics using Smiloop and Orisync. Clinical and patient data is:

• Processed only under instruction from the registered clinic (data controller)
• Stored in encrypted, access-controlled environments
• Never used for advertising or shared with third parties without explicit consent
• Anonymized and aggregated for AI model improvement, where applicable and permitted

Clinics are responsible for obtaining appropriate patient consent before using our platforms to collect clinical data.

6. Data Sharing

We may share your information with:

• Technology service providers (cloud hosting, analytics, email delivery)
• Legal and regulatory authorities when required by law
• Business partners or acquirers in the event of a merger, acquisition, or restructuring — subject to equivalent data protection obligations

All third-party service providers are contractually bound to process data in accordance with applicable data protection laws.

7. Data Retention

We retain personal data only for as long as necessary:

• Contact form data: Up to 2 years from last interaction
• Investor inquiry data: Up to 5 years or as required by regulation
• Clinical/patient data: As specified in clinic data processing agreements
• Analytics data: Up to 26 months (anonymized)

After the retention period, data is securely deleted or anonymized.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• TLS/SSL encryption for data in transit
• AES-256 encryption for data at rest
• Role-based access control
• Regular security audits and penetration testing
• Incident response procedures

No method of transmission over the internet is 100% secure. In the event of a data breach, we will notify affected individuals and relevant authorities as required by applicable law.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right to Access – Request a copy of the data we hold about you
• Right to Rectification – Request correction of inaccurate data
• Right to Erasure – Request deletion of your data (“right to be forgotten”)
• Right to Restriction – Request that we limit how we use your data
• Right to Data Portability – Receive your data in a machine-readable format
• Right to Object – Object to processing based on legitimate interest
• Right to Withdraw Consent – Withdraw consent at any time where processing is consent-based

To exercise any of these rights, contact us at Info@clinovatetechnologies.com. We will respond within 30 days.

10. Children’s Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. Dental patient data for minors is processed only through clinics in compliance with applicable laws and with guardian consent.

11. International Data Transfers

Clinovate is headquartered in India. If you access our services from outside India, your data may be transferred to and processed in India. We ensure appropriate safeguards are in place for international transfers in accordance with applicable data protection laws.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email (where applicable) or a prominent notice on our website. Continued use of our services after the updated policy takes effect constitutes your acceptance.

13. Contact Us

For privacy-related questions or to exercise your rights:

Clinovate Technologies Private Limited 📧 Info@clinovatetechnologies.com 📞 +91 8124500999 📍 #48, 1st Floor, 2nd Main Road, Nanganallur, Chennai – 600061, Tamil Nadu, India