Security and data handling for your patient records
Before you move patient records onto EnamDoc, you should know where they are kept, who can see them and how to get them deleted. This page lists all of it, including the things we haven’t built yet.
Where your data lives
Patient records, appointments and bills are stored on Amazon Web Services and Google Firebase infrastructure. Firebase also handles sign-in.
Razorpay handles the payment itself, and card numbers never reach our servers.
If your clinic has a data-residency requirement, tell us before you sign up and we will tell you exactly what we can and can’t commit to today. The full list of companies that process your data is further down this page.
What you can turn on today
- Two-factor authentication
- Time-based one-time passcodes (TOTP), set up from your account settings. Any standard authenticator app works.
- Device management
- See every device signed in to your account, remove any one of them, or sign out everywhere except the phone in your hand.
- Security activity log
- A list of security events on your account that you can see yourself, so a sign-in you didn’t make is something you can find.
- Licence verification
- Dentists are checked against their registration before they can accept bookings on the network. A dentist can’t take bookings until the check is done.
- Self-serve deletion
- You can ask for your account and data to be deleted in the app or on the website. Nobody calls you to talk you out of it.
- No card data on our systems
- Payments go through Razorpay, our payment processor. EnamDoc does not receive or store card numbers.
Who can see what
Each kind of data, who can open it, and what else you should know.
| Data | Who can see it | Good to know |
|---|---|---|
| OPD notes | The dentist who wrote the note | Another dentist’s account can’t open your notes. |
| Appointments | The dentist the booking is with, and the patient who booked it | Our support team can see a booking to sort out a problem with it. |
| X-rays sent for AI marking | The dentist who uploaded it | The image is sent to OpenAI to be processed. AI features are optional. |
| Bills and payment records | The clinic that made the bill, and the patient it is sent to on WhatsApp | EnamDoc takes no commission on treatment bills. |
| Card and UPI details | Razorpay only | They never reach EnamDoc or your clinic. |
| Your account’s security log | You | Sign-ins, devices and other security events on your account. |
The DPDP Act
The Digital Personal Data Protection Act, 2023 is the Indian law that covers your patients’ data. We don’t describe EnamDoc as “DPDP compliant”, because there is no audit behind that claim yet. This is what we do today:
- You can ask for a copy of your data, or for all of it to be deleted, at any time.
- Every outside company that processes the data is named on this page and in our privacy policy.
- We don’t sell data and we don’t use it for advertising.
- You can report a privacy or security concern to support@enamdoc.com.
Deleting your data
Ask for deletion from inside the app, or from the delete-account page on this site. You don’t need an active subscription to do it, and you don’t have to go through a sales call.
You can also ask for an export first, so you keep a copy. Deletion is all-or-nothing today: you can’t yet choose to keep some records and delete others.
What we do not do
We do not sell data. Not to advertisers, not to insurers, not to anyone. Nothing in how EnamDoc makes money depends on it.
We do not run ads on clinical screens. Nothing in a patient’s file or a clinical view carries advertising.
We do not sell patient leads to the highest bidder. A verified dentist’s place on EnamDoc isn’t sold at auction. That is a deliberate difference from the marketplace model, and it is why we can say the patient relationship belongs to the clinic.
We do not hold your records hostage. Export and deletion are available on request, at any time, whether or not you are still paying.
Everyone who touches your data, and why
Most vendors only share this list after a long email chain. It is on a public page because you shouldn’t have to ask.
| Company | What they do for us |
|---|---|
| Amazon Web Services | Application hosting, database and file storage |
| Google Firebase | Authentication and parts of the application datastore |
| Razorpay | Payment processing — card and UPI details are handled here, not by us |
| OpenAI | AI features, including X-ray analysis |
| Brevo | Transactional email |
AI features send the content they work on to OpenAI for processing. If you are worried about what leaves our systems for a particular feature, ask us on a demo call and we will give you a precise answer.
What we have not built yet
A security page that lists only strengths is an advert. These are the gaps, and you should weigh them.
- We do not hold ISO 27001 or SOC 2 certification. Any vendor telling you they are "SOC 2 aligned" without a report is telling you they are not certified.
- We are not HIPAA-covered. HIPAA is US legislation and does not apply to an Indian clinic; we mention it only because the question comes up.
- We do not currently publish a formal penetration-test report.
- We do not yet offer clinic-configurable data-retention periods. Deletion is all-or-nothing today.
- We do not offer on-premise or self-hosted deployment.
Security questions we get asked
Is EnamDoc HIPAA compliant?
HIPAA is United States legislation and does not apply to a dental clinic operating in India. We are not a HIPAA-covered entity and do not claim to be. The framework that matters for Indian clinics is the Digital Personal Data Protection Act.
Do you hold ISO 27001 or SOC 2 certification?
No. We say so plainly instead of describing ourselves as "aligned with" a standard we have not been audited against. If a certification requirement is a condition of your purchase, tell us on a demo call and we will give you a straight answer about timelines rather than a vague one.
Where is my patient data stored?
On Amazon Web Services and Google Firebase infrastructure. If your practice has a specific data-residency requirement, raise it before you sign up rather than after, and we will tell you precisely what we can and cannot commit to today.
Does patient data go to OpenAI?
Content relevant to an AI feature is sent to OpenAI to be processed — for example, a radiograph submitted for X-ray analysis. Our privacy policy lists OpenAI as a sub-processor for exactly this reason. If you would prefer not to use AI features, they are not required in order to use the rest of EnamDoc.
Can I get my data out?
Yes. You can request an export or a full deletion at any time from the app or from the delete-account page on this site, whether or not you have an active subscription.
How do I report a security issue?
Email support@enamdoc.com with the details. If you believe you have found a vulnerability, please include enough detail to reproduce it and give us a reasonable window to fix it before disclosing it publicly.
Ask us the hard version
If your clinic has a specific security or data requirement, put it to us directly. You will get a precise answer, even if it isn’t the one you hoped for.