Privacy policy

Effective Date: 21 August 2026 Last Updated: 21 August 2026

Donna ("Donna", "we", "us", or "our") is a clinic management and AI-powered administrative platform operated by COSMIC ENTERPRISES.

Donna provides software and services designed to help clinics manage their administrative operations, including patient management, appointments, communications, visits, treatments, OPD records, billing, and clinic information.

This Privacy Policy explains how we collect, use, process, store, protect, and disclose personal information when you use our website, software, applications, AI services, or related services (collectively, the "Services").

Donna is operated by:

COSMIC ENTERPRISES

Registered Address: Near Mattrix Hospital, House No. 1, Saraswati Vihar, Lal Danth Road, Bithoriya No. 1, Haldwani, Nainital, Uttarakhand — 263139, India

Website: www.donnaforclinic.com

Privacy Contact: support@donnaforclinic.com

Donna is primarily a technology platform provided to clinics. Clinics use Donna to manage their own patient and operational information.

The information we collect depends on how you use Donna and which features a clinic enables.

We may collect information about a clinic including:

• Clinic name
• Clinic address
• Telephone numbers
• Email addresses
• Operating hours
• Services offered
• Service pricing
• Appointment availability
• Clinic configuration
• Google Maps or location information
• Business information
• Information about the clinic's team members

Clinics may enter or collect patient information through Donna, including:

• Name
• Phone number
• Email address
• Address
• Profile photograph, where provided
• Appointment information
• Visit history
• Treatment information
• OPD information
• Notes entered by authorized clinic personnel
• Billing and payment information
• Information provided during communications with the clinic
• Other information that the clinic chooses to maintain as part of its patient records

Some of this information may relate to a person's health or treatment.

Donna processes this information to provide the Services to the clinic and does not sell patient information.

When Donna handles a patient communication, we may process information necessary to provide the relevant service, including:

• Caller phone number
• Date and time of the communication
• Duration
• Transcribed speech
• Information provided by the caller
• Donna's responses
• Appointment information
• Call summaries
• Related technical metadata

Donna uses this information to understand patient requests and perform administrative actions such as appointment scheduling and updating patient records where enabled by the clinic.

For clinic owners, administrators, doctors, and other authorized team members, we may collect:

• Name
• Email address
• Phone number
• Role
• Permissions
• Profile photograph, where provided
• Login and authentication information

We may automatically collect limited technical information such as:

• IP address
• Device information
• Browser type
• Operating system
• Authentication events
• Service usage information
• Error logs
• Security logs
• Other information required to maintain and secure the Services

We process information only for purposes reasonably connected with providing and operating Donna.

These purposes include:

We use information to:

• Create and manage clinic accounts
• Manage patients
• Create and manage appointments
• Check appointment availability
• Handle patient enquiries
• Maintain patient histories
• Record visits
• Manage treatments
• Maintain OPD records
• Manage billing and payments
• Provide clinic dashboards
• Generate operational reports
• Provide customer support

Donna may process information to:

• Understand patient requests
• Respond to routine patient enquiries
• Collect information needed for appointments
• Check appointment availability
• Create or update appointments
• Generate call summaries
• Organize information provided by patients
• Perform other administrative tasks enabled by the clinic

We may process information to:

• Authenticate users
• Detect unauthorized activity
• Prevent fraud and abuse
• Protect our systems
• Investigate security incidents
• Diagnose technical problems
• Maintain service reliability

We may process information where reasonably necessary to:

• Comply with applicable law
• Respond to lawful requests
• Establish or defend legal claims
• Prevent fraud or abuse
• Protect the rights, safety, and security of our users and Services

Donna does not use customer, clinic, or patient data to train or fine-tune its artificial intelligence models.

Information processed through Donna is used to provide the Services requested by the clinic and for the other purposes described in this Privacy Policy.

We do not sell patient information or use patient information for unrelated advertising.

Donna is primarily a technology service provider for clinics.

The clinic determines what patient information is collected and how that information is used for its healthcare and administrative operations.

Clinics are responsible for:

• Providing appropriate privacy notices to their patients
• Obtaining legally required consent or permissions
• Ensuring that information entered into Donna is accurate
• Determining appropriate retention periods
• Managing access by their employees and team members
• Responding to patient requests concerning information controlled by the clinic

Donna processes patient information on behalf of the relevant clinic to provide the Services.

If you are a patient of a clinic using Donna and have a question about how that clinic uses your information, you should generally contact the clinic directly.

Patient information entered into Donna by a clinic remains under the clinic's control.

Clinic administrators can:

• Export patient data
• Delete patient data
• Manage authorized team members
• Control access permissions
• Manage clinic information

Requests relating to clinic-controlled patient information may also be submitted to:

support@donnaforclinic.com

We may require appropriate verification before fulfilling a request.

Donna uses artificial intelligence to provide administrative functionality.

For example, Donna may process a conversation to understand that a patient wants an appointment and then use the clinic's configured availability to help schedule that appointment.

AI-generated responses or information may occasionally be inaccurate.

Donna is an administrative technology platform and is not a substitute for professional medical judgement.

Donna does not:

• Diagnose medical conditions
• Prescribe medication
• Provide medical treatment
• Replace a doctor or qualified healthcare professional

Clinics and healthcare professionals remain responsible for clinical decisions and patient care.

Donna may use third-party technology providers to operate parts of the Services.

These providers may include infrastructure, hosting, authentication, communications, artificial intelligence, database, analytics, and other technology providers.

Depending on the feature being used, these providers may process information such as:

• Text
• Audio or speech data where required by the service
• Transcriptions
• AI requests and responses
• Authentication information
• Technical logs
• Other information necessary to provide the relevant functionality

We use third-party providers only where reasonably necessary to provide, maintain, secure, or improve Donna.

Where appropriate, we require service providers to maintain appropriate safeguards and process information according to our instructions and applicable agreements.

Donna may integrate with third-party communication services, including the WhatsApp Business Platform, to enable clinics to communicate with patients.

When such an integration is enabled:

• Patient phone numbers may be processed to deliver communications.
• Messages may be transmitted through the relevant third-party platform.
• The third party may process information according to its own privacy policy and terms.
• Donna does not control the privacy practices of third-party communication platforms.

Users should review the applicable privacy policies of third-party communication platforms they use.

Donna does not sell patient information to communication providers.

We may disclose information in the following circumstances.

Information entered or generated through Donna may be accessible to the clinic and its authorized team members according to the clinic's configuration and permissions.

We may share information with third-party providers that help us operate Donna.

We may disclose information where required by:

• Applicable law
• Court orders
• Legal processes
• Valid governmental requests

If COSMIC ENTERPRISES or Donna is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable law.

We do not sell personal information.

We take reasonable technical and organizational measures designed to protect personal information against:

• Unauthorized access
• Unauthorized disclosure
• Loss
• Misuse
• Alteration
• Destruction

Our security measures may include:

• Authentication and access controls
• Role-based permissions
• Encryption in transit
• Restricted access to systems
• Security logging
• Infrastructure security controls
• Monitoring and incident-response measures

However, no internet-based system can guarantee absolute security.

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention may depend on:

• The type of information
• The purpose for which it was collected
• The clinic's configuration
• Contractual requirements
• Applicable legal requirements
• Security and operational requirements

When information is no longer required, it may be deleted or anonymized.

Some information may temporarily remain in backups or security logs until it is removed through our normal retention processes.

Clinic administrators can delete patient information through Donna where the applicable functionality is available.

A clinic administrator may also request deletion by contacting:

support@donnaforclinic.com

We will take reasonable steps to delete or anonymize the applicable information, subject to:

• Legal retention requirements
• Legitimate security requirements
• Contractual obligations
• Other lawful reasons requiring continued retention

Deletion from active systems may not immediately remove information from encrypted backups, which may be retained temporarily according to our backup-retention procedures.

Clinic administrators can export patient data from Donna where the applicable functionality is available.

If you require assistance with a data export, contact:

support@donnaforclinic.com

We may verify the identity and authorization of the requester before providing an export.

Depending on applicable law, individuals may have rights relating to their personal information, including rights to:

• Obtain information about the processing of their personal data
• Request access to personal information
• Request correction of inaccurate information
• Request deletion of personal information
• Withdraw consent where consent is the applicable basis for processing
• Raise a privacy grievance
• Exercise other rights available under applicable law

India's Digital Personal Data Protection framework establishes rights and obligations relating to the processing of digital personal data. The DPDP Rules, 2025 also prescribe requirements concerning notices and mechanisms for exercising rights.

Where information is controlled by a clinic, individuals may need to exercise their rights directly with that clinic.

You may also contact Donna at:

support@donnaforclinic.com

We may need to verify your identity before processing certain requests.

Donna is intended primarily as a service for clinics.

Clinics may provide healthcare services to children and may therefore enter information relating to children into Donna.

The relevant clinic is responsible for obtaining any consent and complying with applicable requirements relating to children's personal data.

Donna does not independently target children as consumers.

Donna and its service providers may process information using infrastructure located outside India.

Where personal information is transferred outside India, Donna will take reasonable steps to comply with applicable legal requirements and relevant contractual obligations.

Our website may use cookies and similar technologies for purposes including:

• Website functionality
• Authentication
• Security
• Remembering preferences
• Understanding website usage
• Improving our Services

You may control cookies through your browser settings.

We may send communications necessary to:

• Operate your account
• Provide the Services
• Notify you about important service changes
• Respond to support requests

Where required by applicable law, promotional communications will be sent with appropriate consent or another lawful basis.

You may opt out of promotional communications through the mechanism provided in the communication.

We may update this Privacy Policy when necessary to reflect:

• Changes to Donna
• New features
• Changes in our data practices
• Changes in third-party service providers
• Changes in applicable law

When we make material changes, we may update the "Last Updated" date and provide additional notice where required.

If you have questions, concerns, requests, or complaints regarding privacy or personal data processed through Donna, contact:

Donna Privacy Team

Email: support@donnaforclinic.com

Registered Address: Near Mattrix Hospital, House No. 1, Saraswati Vihar, Lal Danth Road, Bithoriya No. 1, Haldwani, Nainital, Uttarakhand — 263139, India

Website: www.donnaforclinic.com

We will take reasonable steps to investigate and respond to privacy requests and grievances within the timeframe required by applicable law.