Privacy Policy
Effective September 28, 2026 · STRATOSIA DIGITAL PRIVATE LIMITED
STRATOSIA DIGITAL PRIVATE LIMITED (“Zennor”, “we”, “us”) operates Zennor, a software platform used by aesthetic clinics, dermatology clinics, and med spas in India (“Clinics”), and the Zennor patient app used by their patients. This Privacy Policy is our notice under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its Rules, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It explains what we collect, why, who we share it with, how long we keep it, and how you can exercise your rights.
1. Who Is Responsible for Your Data
Two organisations handle your data when you use Zennor, and each is responsible for different parts:
- Zennor is the Data Fiduciary for your app account (phone number, name, email, date of birth, consent records), device and notification data, app diagnostics, support-chat safety and moderation, our website, clinic business accounts, platform billing, and security logs.
- Your Clinic is the Data Fiduciary for the clinical and service records it creates or keeps about you, such as treatment history, appointments, personalised plans, practitioner notes and voice notes, before/after media, memberships, orders, and loyalty records with that Clinic. For these records Zennor acts as the Clinic’s Data Processor and processes them only on the Clinic’s instructions to provide the platform.
Where a request concerns Clinic-held records, we will pass it to the Clinic and help it respond. You can always contact our Grievance Officer (Section 12), and we will tell you who needs to act.
2. Information We Collect
Patients using the Zennor app
| Data | Why we use it |
|---|---|
| Mobile number | Sign-in by one-time password, account security, and linking you to your Clinic. |
| Name and email address | Your profile, receipts, and service messages. |
| Date of birth | Confirming you are 18 or older, and birthday offers from your Clinic if you have enabled promotional notifications. |
| Consent records | Proof of which Terms and Privacy Policy version you accepted, and your marketing choice. |
| Clinic relationship data: memberships, orders, payments status, loyalty points, rewards, wallet credit, referrals, appointments | Providing the services, benefits, and rewards you request from your Clinic. |
| Health-related data: treatment history, personalised plans, practitioner notes, voice notes, before/after media | Shown to you and your Clinic as part of your care administration. This data is entered by your Clinic. |
| Support-chat messages, reports, and blocks | Answering administrative questions and keeping chat safe. |
| Notification preferences and push token | Sending the notifications you allow. Promotional notifications are off unless you turn them on. |
| Device and diagnostic data (device model, OS version, crash reports) | Fixing errors and keeping the app secure. |
We do not collect your precise location, contacts, or photo library through the app. We never receive your full card number, UPI PIN, or bank password; these go directly to the payment gateway.
Clinic administrators and staff
- Clinic name, owner and staff names, email, phone number, business address, GSTIN, and billing details.
- Where a Clinic uses platform-managed payouts: business, KYC, and settlement bank details, shared with Razorpay to set up and operate payouts.
- Login credentials (passwords are hashed by our authentication provider and never stored in plain text) and admin activity logs.
Website visitors
- Contact-form details you submit, and browser error diagnostics (see Section 10).
3. Consent and Legal Basis
Patients give consent in the app before sign-in by ticking a box confirming they are 18 or older, accept the Patient Terms, and consent to this Privacy Policy, including the processing of health information. We record the date and the document versions you accepted. We also process data without consent where the DPDP Act permits it, for example to comply with law, a court order, or to respond to a medical emergency.
Your Clinic is responsible for having a lawful basis for the clinical records it enters about you, including records created before you joined the app.
Withdrawing consent. You can withdraw consent at any time by deleting your account in the app (Profile → Privacy & Data → Delete Account), through our Data Deletion Request page, or by writing to our Grievance Officer. Withdrawal does not affect processing done before it. After withdrawal you will no longer be able to use the app, and records your Clinic must keep by law will stay with your Clinic.
Marketing. Promotional notifications are off by default. You can turn them on or off at any time in Profile. Lock-screen notifications about your account use generic wording and do not show treatment details.
4. Children
The Zennor app is only for people aged 18 or older. We refuse sign-up where the date of birth shows the user is under 18. Clinics may treat minors, but they must handle those records outside the patient app and obtain consent from a parent or lawful guardian. If we learn that a person under 18 has created an account, we will delete the account and tell the Clinic. We do not track, behaviourally monitor, or target advertising at children.
5. Health Information and Medical Disclaimer
We treat treatment history and other health-related information as sensitive. Access is limited by role to the patient, authorised staff of the patient’s Clinic, and a small number of authorised Zennor personnel who need it to operate, secure, or support the platform.
Medical disclaimer: Zennor is a clinic administration platform. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Zennor does not create a doctor-patient relationship. All clinical decisions are the responsibility of your Clinic and its registered practitioners. Always consult a qualified healthcare professional about your health.
6. Sharing and Service Providers
We share data only to provide Zennor, meet legal obligations, protect the platform, or complete a request you make. We do not sell personal data and do not share it with advertisers or data brokers.
- Your Clinic sees the profile, membership, order, loyalty, chat, and care-administration data related to that Clinic. A Clinic cannot see your activity with other Clinics.
- Service providers process data on our instructions, listed below.
- Authorities and advisers where required by Indian law, a court order, or valid legal process, or to protect the rights and safety of users, Clinics, or the public.
- A successor business if Zennor is merged or acquired, subject to this Policy.
| Provider | Purpose and data involved | Provider privacy information |
|---|---|---|
| Google Firebase / Google Cloud | Authentication, database, file storage, server functions, push notifications (through Apple and Google push services), and crash diagnostics (Crashlytics). This can include account, clinic, patient, device, and application data. | Firebase privacy and security |
| Razorpay | Payment processing, refunds, subscriptions, and, where enabled, Clinic payouts and KYC. This can include transaction, contact, business, KYC, and settlement information. | Razorpay Privacy Policy |
| Meta WhatsApp Business Platform | Clinic messages where the Clinic enables WhatsApp. This can include phone numbers and message content. | Meta Privacy Policy |
| Formspree | Website contact-form delivery: the name, clinic name, email, phone number, and message you submit. | Formspree Privacy Policy |
| Sentry | Error monitoring for the website and administration tools. Reports exclude cookies and IP-derived user context. | Sentry Privacy Policy |
| Google Gemini API | Optional admin-only brand extraction from a public website URL and a limited excerpt of its public content. No patient data is sent. | Google Privacy Policy |
Zennor does not use patient data to train AI models.
7. Where Data Is Stored
Our primary database is hosted by Google Cloud in Mumbai, India. Some providers, including push-notification, crash-diagnostic, and payment services, may process data outside India. We transfer data abroad only as the DPDP Act permits and not to any country the Government of India has restricted.
8. Security and Breach Notification
- Encryption in transit (HTTPS/TLS) and encryption at rest by our cloud providers.
- Role-based access controls enforced on our servers, not only in the app.
- Access logging, monitoring, and a documented incident-response process.
No system is perfectly secure. If a personal data breach occurs, we will inform affected people and the Data Protection Board of India as the DPDP Act and its Rules require, report cyber incidents to CERT-In within the required time, and tell affected Clinics so they can meet their own obligations.
9. How Long We Keep Data
| Data | Retention |
|---|---|
| Patient app account and profile | Until you delete your account or withdraw consent. Deletion in the app starts immediately. |
| Orders, payments, refunds, and invoices | Up to 8 years as required by tax and company law. On account deletion we remove your name and contact details from these records. An internal account reference may remain so the records stay accurate for audit, tax, and fraud prevention. |
| Clinic-held clinical and service records | As long as the Clinic keeps its Zennor account, subject to the Clinic’s own legal retention duties. After a Clinic leaves Zennor, it has 30 days to export its data. We then delete or de-identify that Clinic’s data within 90 days, except records we must keep by law. |
| Support chat | Closed conversations are deleted 12 months after closure, unless needed for a pending report, legal claim, or legal obligation. |
| Personal data export files | Deleted when you delete your account. Download links expire shortly after they are issued. |
| Security and access logs | For the periods required by law, currently at least 180 days under CERT-In directions, then deleted. |
| Deletion and grievance requests | As long as needed to complete the request and show that we handled it lawfully. |
| Backups | Removed on the provider’s normal backup cycle. |
10. Cookies and Browser Storage
Zennor’s website uses browser storage for authentication and security, and to remember an administrator email when selected. The website also sends error diagnostics to help us keep it reliable. We do not use advertising cookies or cross-site tracking.
| Storage | Purpose | Duration and control |
|---|---|---|
admin_remembered_email browser storage | Prefills the administrator email on the login page when “Remember my email” is selected. It does not store a password or keep the administrator signed in. | Retained until you uncheck “Remember my email” on the login page or clear browser storage. |
| Firebase Authentication session storage | Keeps an authenticated administrator signed in during an active browser session. | Session-only; sign out or close the browser session to remove it. |
11. Your Rights
Under the DPDP Act you have the right to:
- Access a summary of your personal data and how it is processed. Use Profile → Privacy & Data → Export My Data, or write to us.
- Correct, complete, or update your data. You can edit most profile details in the app. Your date of birth is locked after setup; write to us to correct it.
- Erase your data. Use Profile → Privacy & Data → Delete Account, or our Data Deletion Request page. We verify ownership of the phone number before acting on web requests.
- Withdraw consent as described in Section 3.
- Nominate another person to exercise your rights if you die or become incapacitated, by writing to our Grievance Officer.
- Grievance redressal from our Grievance Officer (Section 12).
- Complain to the Data Protection Board of India if you are not satisfied with our response.
For Clinic-held records, the Clinic decides what it must keep by law. We will forward your request to the Clinic and help it respond.
12. Grievance Officer
- Name: Siddhesh Zagade
- Role: Grievance Officer / Director
- Email: support@zennor.app (subject: “Grievance” or “Privacy Request”)
- Address: STRATOSIA DIGITAL PRIVATE LIMITED, 202 MSCB Emps Yogesh CHS, Kasturpark, Borivali West, Mumbai – 400092, Maharashtra, India
We acknowledge grievances within 24 hours and resolve them within 15 days. Privacy rights requests are completed within 30 days of verification, or sooner where the law requires.
13. Changes to This Policy
We will post updates on this page with a new effective date and notify Clinics by email or in-platform notice and patients in the app. If a change requires fresh consent, for example a new purpose for your data, we will ask for it before applying the change to you.