Privacy Policy

Last updated 6 September 2026

Sounds Klear holds the records of children receiving hearing and therapy care. This page explains exactly what we hold, on whose authority, where it lives, and what you can ask us to do with it.

1. Two different relationships

This is the part most software privacy policies blur, and it matters for who is accountable to whom.

• Patient records. Your clinic decides which patients to record, why, and for how long. Under the Digital Personal Data Protection Act, 2023, the clinic is the Data Fiduciary and Sounds Klear is a Data Processor acting on the clinic’s instructions. We do not decide what happens to patient data, and we do not use it for our own purposes.
• Clinic account data. For the staff who sign in — their names, work emails, roles and registration numbers — we are the Data Fiduciary, because we decide what is needed to operate the service.

If you are a parent or patient asking about your own records, the clinic treating you is the right first contact — they hold the relationship and can act on your request directly. We will always help a clinic respond.

2. What we hold as the clinic’s processor

Whatever the clinic enters. In practice that includes a child’s name and date of birth, guardian name and contact number, diagnosis, audiometric thresholds, hearing-device details and serial numbers, therapy goals and session notes, wear-time, government scheme references such as UDID and ADIP application numbers, ABHA address, invoices and payment status.

Much of this is health data, and some of it belongs to children. We treat all of it as sensitive.

3. What we hold about clinic staff

• Name, work email address and password (stored only as a hash — we never see it).
• Role, branch, job title, and professional registration number and expiry.
• An access log: who signed in, when, and which records were opened.
• Billing contact and subscription status.

We use it to run the service, to bill you, to keep the audit trail your practice may need to demonstrate, and to email you about your account. We do not use it for advertising.

4. Children’s data

Because the clinic is the Data Fiduciary, obtaining and recording that parental consent is the clinic’s responsibility, not ours. You should not enter a child’s record into Sounds Klear before you hold that consent.

For our part:

• We do no behavioural tracking, profiling or advertising of any kind — for children or adults. There are no advertising or analytics trackers in the application.
• We never use patient data to train machine-learning models, ours or anybody else’s.
• Access to a child’s record is restricted by role inside the database itself, so a staff member who is not entitled to a field never receives it.

5. Where your data lives

In Mumbai, India (the ap-south-1 region of our hosting provider). Patient data is not transferred outside India in the ordinary course of providing the service.

6. How it is protected

• Restriction is enforced in the database, not just on screen. Patient tables sit in a private schema the public API cannot reach. Clinicians read through views that blank the columns their role is not entitled to, so a value a therapist may not see never leaves the server.
• Every practice is walled off from every other. Each query is filtered by clinic, and that separation is tested.
• The access log cannot be edited. Entries can be added and read, never altered or removed.
• Emergency access is deliberate and visible. Break-glass access needs a written reason, expires on its own, and is logged.
• Encrypted in transit (HTTPS with HSTS) and at rest.
• Passwords are stored only as salted hashes.

No system is perfectly secure. If a personal data breach occurs we will notify the Data Protection Board of India and affected clinics as the DPDP Act requires, and report to CERT-In within the timeframe its directions specify.

7. Who else touches it

We use a small number of sub-processors, each under contract and each limited to what the service needs:

• Supabase (database, authentication and file storage) — hosted in Mumbai.
• Vercel (application hosting and content delivery).
• GoDaddy (email delivery for account messages such as sign-up confirmation and password reset).
• Razorpay (subscription payments). Card details are entered with the payment provider and never reach our servers.
• Sentry (error reporting), where it is enabled. It receives the technical detail of a failure — the message and the line of code — and nothing that identifies a person. Patient and record identifiers, email addresses, phone numbers and patient codes are replaced before anything is sent, request contents and cookies are discarded, and no screen recording of any kind is used.

We do not sell personal data, and we do not share it with anyone else except where the law compels us to.

8. How long we keep it

Patient data is kept for as long as the clinic keeps it — retention is the clinic’s decision, and clinical record-keeping obligations may require several years, longer where the patient is a minor. We delete on the clinic’s instruction.

If a subscription ends, we retain the practice’s data for 30 days so it can be exported, then delete it. Access logs and records we are required by law to retain are kept for the required period and no longer.

9. Your rights

Under the DPDP Act you may ask to:

• Know what personal data is held about you and who it has been shared with.
• Have inaccurate or incomplete data corrected or completed.
• Have data erased, where no legal obligation requires it to be kept.
• Nominate someone to exercise these rights if you die or become incapacitated.
• Have a grievance heard and answered.

Patients and parents: contact your clinic first. They hold the records and can act immediately; we support them in doing so.
Clinic staff: write to us directly using the details below.

We will respond within 30 days. We may need to verify your identity before acting, which protects you as much as us.

10. Cookies

Sounds Klear sets only the cookies it needs to work: a session cookie that keeps you signed in, and a small preference stored in your browser remembering your chosen accent colour. There are no advertising cookies, no third-party trackers, and no cross-site profiling. Nothing here requires a consent banner because nothing here is optional to the service.

11. Grievance Officer

The DPDP Act requires us to name someone you can bring a complaint to. If you are not satisfied with our answer you may escalate to the Data Protection Board of India.

Email

support@soundsklear.com