Data protection programme & sub-processor list
Last updated 19 May 2026. How we secure and process data on behalf of our hospital, clinic and doctor clients.
Our controls
Encryption
TLS 1.3 in transit; AES-256 at rest. Secrets stored in managed vault; rotated every 90 days.
Access control
SSO + MFA mandatory. Role-based access, principle of least privilege, quarterly access reviews, immediate revocation on staff change.
Infrastructure
Tier-IV India + EU data centres. SOC 2 Type II and ISO 27001 certified hosting partners (Google Cloud, Cloudflare, Supabase).
Backups
Daily encrypted backups, 30-day retention, quarterly restore drill, geographically separated.
International transfers
SCCs in place with every sub-processor; transfer impact assessments on file for all non-India processors.
Breach response
72-hour notification SLA; documented incident response runbook; annual tabletop exercise.
Sub-processor list
Updated 19 May 2026. Notice of any new sub-processor is given to clients 30 days in advance.
- Google LLC — Workspace email, Google Ads, Google Analytics 4 (consented)
- Meta Platforms Inc. — Facebook & Instagram Ads, WhatsApp Business API (consented)
- Cloudflare Inc. — CDN, WAF, DDoS protection
- Supabase Inc. — managed Postgres for CRM exports (EU + India)
- HubSpot Inc. / Zoho Corp — CRM (selected by client; DPA in place with both)
- Microsoft Corporation — Clarity heatmaps (consented only)
- LinkedIn Corporation — Lead Gen Forms & Insight Tag (consented only)
Breach response runbook
- 0–1h
Detection
Alerted via SIEM, sub-processor notification or human report. Incident commander assigned.
- 1–24h
Contain & assess
Isolate affected systems, rotate credentials, scope impacted data subjects and data categories.
- 24–72h
Notify
Notify affected client(s) and the Data Protection Board of India where notifiable under DPDP Act s.8(6).
- 72h+
Remediate & report
Root-cause analysis, remediation plan, post-incident review shared with client within 14 days.
Data protection FAQs
No inflated promises. Documented scope, agreed KPIs and reporting you can audit.
Healthcare regulators rightly distrust guaranteed-outcome marketing — and so do we. Before we start, we put deliverables, KPIs and review cadence in writing; every month, we report against them in accounts you own. That's the kind of accountability healthcare deserves.
Written Scope & KPIs
Deliverables, KPIs, timelines and review cadence signed before kickoff. No vague retainers, no hidden scope, no empty promises.
Transparent Reporting
Monthly reporting you can audit — spend, enquiries, bookings and content shipped, in your own accounts and dashboards.
Healthcare-Only Specialists
20+ years building digital presence for hospitals, clinics & specialist doctors. Every campaign is compliance-reviewed by design.
Your Data, Your IP
Full ownership of website, ads accounts, CRM, creatives and patient data — always. Zero lock-in, full transparency.
What healthcare teams say about working with us
Client statements about our CRM, systems and compliance-first process.
"ClinicBOOST brought every enquiry, follow-up and appointment into one CRM. Our front desk finally works from a single queue, and no patient enquiry slips through the cracks."
"The most healthcare-literate systems team we've worked with. Every creative is compliance-reviewed before it ships, and the CRM reporting shows exactly where every rupee went."
"From website to WhatsApp to CRM — one connected system. Scheduling, reminders and follow-ups run themselves now, and we stopped juggling five separate vendors."
Get a healthcare growth plan built for your speciality.
Share a few details about your hospital, clinic or practice. Our team will audit your current digital presence and send a tailored growth roadmap within 24 hours.
- Speciality-specific patient demand analysis
- Conversion gap audit across web, ads, CRM & WhatsApp
- Compliance-safe creative & campaign blueprint
100% confidential. No spam. Healthcare team replies within 24 hrs.