SmartLead Care SmartLead Care

Data Handling Statement

Effective date: October 2026

This Data Handling Statement explains how SmartLead Care handles information submitted through its website and information processed while providing CRM, website and enquiry-management services.

It should be read together with our Privacy Policy and Terms and Conditions.

1. Our data-handling principles

SmartLead Care follows these practical principles:

  • Collect only information required for the agreed purpose
  • Use information only for enquiry follow-up and service delivery
  • Limit access to authorized persons
  • Avoid collecting unnecessary medical information
  • Use established technology providers
  • Retain information only for as long as reasonably necessary
  • Support appropriate correction, export or deletion requests
  • Never sell patient or client contact information

2. SmartLead Care business enquiries

When a doctor, clinic manager or business representative submits a SmartLead Care audit form, the information may be processed through the following workflow:

  1. The representative submits the website form.
  2. The website validates the required fields.
  3. The information is securely sent from the website server to HubSpot CRM.
  4. A contact and business deal may be created or updated.
  5. Authorized SmartLead Care personnel may receive an email notification.
  6. SmartLead Care follows up regarding the audit or requested service.

The information may include contact details, clinic details, service interest, enquiry source, business challenges, consent status, page URL and UTM campaign values.

3. Clinic implementation workflow

For a client healthcare and wellness clinics, a typical Phase 1 workflow may operate as follows:

  1. A prospective patient submits an appointment enquiry form.
  2. Required contact and enquiry details are transferred to the clinic’s CRM.
  3. A contact and lead or deal record is created.
  4. Authorized clinic staff receive a notification.
  5. The clinic assistant contacts the prospective patient manually.
  6. Staff update the lead stage, notes and next follow-up date.
  7. The clinic reviews booking, visit and lost-enquiry outcomes.

Website-form enquiries may be captured automatically.

Phone-call and WhatsApp enquiries are not automatically entered into HubSpot during the basic Phase 1 setup unless this is specifically included in the agreed service. Clinic staff may need to add those enquiries manually.

4. Information that may be handled

Depending on the agreed form and service, information may include:

  • Patient or enquirer name
  • Phone or WhatsApp number
  • Email address
  • Preferred appointment time
  • General treatment or service interest
  • Enquiry source
  • Assigned staff member
  • Lead status
  • Next follow-up date
  • Appointment or visit outcome
  • Communication notes
  • Form consent status
  • Page URL and campaign attribution values

Only information reasonably required for appointment enquiry and follow-up should be collected.

5. Medical information restriction

A general appointment enquiry form should not be used to collect:

  • Detailed medical histories
  • Prescriptions
  • Diagnostic reports
  • Medical identification numbers
  • Insurance documents
  • Treatment photographs
  • Laboratory results
  • Detailed information about a medical condition
  • Other sensitive medical records

Where a clinic needs to collect medical information, it should use an appropriate clinical or patient-record system with suitable access, consent and security controls.

6. Responsibility and control

For enquiries submitted directly to SmartLead Care, SmartLead Care determines how that business-enquiry information is used for audit, sales and service communication.

For patient enquiry systems implemented for a clinic:

  • The clinic normally controls its CRM account and patient-enquiry information.
  • The clinic decides why the information is collected and how staff use it.
  • SmartLead Care handles information only as necessary to configure, maintain or support the agreed system.
  • Access arrangements should be documented in the relevant proposal or service agreement.
  • The clinic remains responsible for its patient communication, treatment records and legal obligations.

The exact responsibilities may vary according to the service agreement and technical setup.

7. Access controls

Access should be limited to people who need it for their role, such as:

  • Authorized clinic reception or follow-up staff
  • The clinic owner or manager
  • Authorized SmartLead Care technical personnel where support is required
  • Approved technology providers supporting the service

Clinic owners should remove access when a staff member leaves or no longer requires the information.

8. Credential and API security

Where HubSpot or another CRM is connected:

  • API or service credentials should remain on the website server.
  • Private credentials should not be placed in public HTML or browser-side JavaScript.
  • Credentials should not be shared through public messages or documents.
  • Access scopes should be limited to what the integration requires.
  • Credentials should be rotated if exposure is suspected.
  • Account access should use strong passwords and multi-factor authentication where available.

9. Third-party systems

Information may be processed using providers such as:

  • WordPress
  • HubSpot CRM
  • Website hosting providers
  • Business email or SMTP providers
  • Form-security or spam-prevention services
  • Analytics providers, if enabled
  • Backup and technical-support providers

Each provider operates under its own terms, infrastructure and privacy practices. The selected systems and applicable charges should be disclosed in the client proposal where relevant.

10. Email notifications

Staff email notifications may contain limited enquiry details required for timely follow-up.

Clinics should avoid forwarding such emails unnecessarily and should protect access to staff email accounts.

Where possible, detailed records should remain in the controlled CRM rather than being repeatedly copied into email, spreadsheets or personal devices.

11. WhatsApp and SMS

WhatsApp or SMS automation is not included in the basic Phase 1 setup unless specifically agreed.

If messaging automation is added later:

  • The clinic must use an approved provider or lawful integration.
  • Required patient consent must be obtained.
  • Message templates and opt-out processes must be reviewed.
  • Provider and message charges may apply.
  • Sensitive medical details should not be included in general automated messages.
  • Access and message logs should be restricted to authorized personnel.

12. Retention and deletion

Business and patient-enquiry information should be kept only while required for:

  • Active follow-up
  • Service delivery
  • Reporting
  • Contract administration
  • Legal or accounting obligations
  • Security and dispute resolution

At the end of a service relationship, the clinic may request assistance with reasonable export, transfer or deletion activities, subject to:

  • The agreed service scope
  • Technical limitations
  • Provider functionality
  • Required legal retention
  • Outstanding contractual obligations

The clinic should establish its own patient-enquiry retention policy.

13. Security incidents

If SmartLead Care becomes aware of a suspected security incident involving information under its control, it will take reasonable steps to:

  • Investigate the issue
  • Restrict unauthorized access
  • Preserve relevant technical information
  • Coordinate with affected service providers
  • Inform the appropriate client where required
  • Support legally required notifications

No internet-based system can be guaranteed to be completely secure.

14. Client responsibilities

The clinic is responsible for:

  • Collecting information lawfully
  • Publishing an appropriate privacy notice
  • Obtaining required consent
  • Restricting staff access
  • Keeping login details secure
  • Reviewing CRM users regularly
  • Training staff on appropriate data handling
  • Avoiding unnecessary sensitive information
  • Correcting or deleting records when appropriate
  • Responding to patient privacy requests
  • Informing SmartLead Care promptly about suspected unauthorized access

15. Data requests and questions

For questions about how SmartLead Care handles information, contact:

Data handling contact
Name: Ganesh Vishwakarma
Email: support@smartleadcare.com
Phone: +91-9583708587
Address: Ranchi, Jharkhand, India, 834004

Where a request concerns information controlled by a client clinic, the individual may be directed to contact that clinic.