Privacy Policy

01The short version

Your clinical information is visible to the treating doctor and to nobody else. It is never sold, never used for advertising, and never shared with a third party except where the law requires it or you ask us to.

You can download everything we hold about you, or ask for it to be deleted, at any time.

02What we collect

• Account details: name, email address, phone number, and a Firebase authentication identifier.
• Health information you provide: intake answers, symptoms, history, current medication and any reports you upload.
• Booking and payment records: appointment times, amounts, and the payment reference returned by Razorpay.
• Technical data: IP address, browser type and pages visited, used for security and to keep the site working.

03What we never collect

• Card numbers, UPI PINs or bank credentials. Payments are handled entirely by Razorpay; we only receive a reference and a status.
• Your consultation is not recorded. No audio or video is stored.

04Who can see your information

Clinical notes, intake responses and care plans are visible only to the treating doctor. Administrative access, where it exists, is limited to booking and payment records and excludes clinical content.

We use a small number of processors to run the service: Firebase for authentication, MongoDB Atlas for storage, Razorpay for payments, Google Calendar and Meet for scheduling, and an email provider for transactional messages. Each receives only what it needs to perform its function.

05How long we keep it

Medical records are retained for three years from your last consultation, in line with professional record-keeping expectations. Financial records are retained for eight years as required by tax law.

Marketing preferences and analytics data are retained for a shorter period and deleted on request immediately.

06Your rights

To exercise any of these, email the clinic. We respond within thirty days and there is no charge.

• Access — request a copy of everything we hold about you.
• Correction — have inaccurate information amended.
• Deletion — have your account and clinical records erased, subject to the retention periods above.
• Withdrawal of consent — stop treatment and data processing at any point.
• Portability — receive your records in a machine-readable format.

07Security

Data is transmitted over TLS and stored encrypted at rest. Access to production systems requires multi-factor authentication and is logged. In the event of a breach affecting your information, we will notify you and the relevant authority within seventy-two hours of becoming aware of it.

08Cookies

We use a session cookie to keep you signed in and a small number of functional cookies to remember preferences. We do not use advertising or cross-site tracking cookies.