Privacy Policy

We process personal data in accordance with the following Indian laws and frameworks:

• Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it — India’s primary data-protection law, which sets out our obligations as a Data Fiduciary and your rights as a Data Principal.
• Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) — which classify medical records, health condition and financial information as Sensitive Personal Data or Information (SPDI) and require consent, a privacy policy and reasonable security safeguards.
• IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — under which we publish a Grievance Officer contact.
• Telemedicine Practice Guidelines, 2020 (under the Indian Medical Council / NMC framework) — for any video consultation conducted through the platform.
• Electronic Health Record (EHR) Standards for India, 2016 and the Ayushman Bharat Digital Mission (ABDM) Health Data Management Policy — whose consent-led, purpose-limited principles for digital health data we follow as good practice.

The table below is a complete, plain-language inventory of the personal data our platform stores, drawn directly from our database. “Legal basis” refers to the lawful ground under the DPDP Act on which we process the data — in almost all cases this is your consent, or the performance of the service you have requested.

• Directly from you — when you sign up, complete your profile, log health data, upload records, or book an appointment.
• From your hospital or doctor — a hospital may create a patient record (and a UHID/MRN) for you, which you can later claim by signing in with the same email or phone.
• Automatically — technical and analytics data as you use the app, and precise location only when you explicitly grant it.

We rely primarily on your consent, which under the DPDP Act must be free, specific, informed, unambiguous and given by a clear affirmative action. By creating an account and entering data you consent to the processing described in this policy for the purposes stated.

• You can withdraw consent at any time (see Your Rights). Withdrawing consent may mean we can no longer provide some features.
• You choose what optional data to add (e.g. insurance, allergies) and which records to share, and with whom.
• You can manage push notifications and decline browser location at any time from your device/browser settings.

The platform lets you manage family members under a single account. Where a profile belongs to a person under 18, the DPDP Act requires verifiable consent of a parent or lawful guardian. By creating a dependent profile you confirm you are the parent/guardian or are otherwise authorised to provide their data and consent on their behalf.

• We do not knowingly use children’s data for tracking, behavioural monitoring or targeted advertising.
• If we learn that a child’s data was provided without proper consent, we will delete it.

We do not sell your personal data. We share it only as follows:

The platform includes optional AI-assisted features. They are designed around two firm principles: doctors get drafts they must confirm, and patients get explanations, never a diagnosis.

Our primary database and your uploaded records are hosted in India (the Mumbai / ap-south-1 region), and your identifiable clinical/health records stay within that India-hosted database. Some service providers process limited data on servers outside India: analytics and push delivery handle non-clinical data, and our AI provider (section 7) processes de-identified clinical content only — never your name, UHID, date of birth, gender, phone or any identifier — with retention and model-training disabled. Where data is transferred outside India, we do so only to countries not restricted by the Central Government under the DPDP Act.

We apply reasonable security safeguards appropriate to health data, including:

• Encryption in transit (HTTPS/TLS) for all traffic, with HSTS enforced.
• Row Level Security in the database so each user and hospital can access only their own data.
• OTP-based sign-in, and role-based access separating patient and hospital areas.
• A strict Content Security Policy and security headers (e.g. X-Frame-Options, restrictive Permissions-Policy).
• Access to production data limited to authorised personnel and processors bound by confidentiality.

No system is perfectly secure. If a personal-data breach occurs, we will act to contain it and notify the Data Protection Board of India and affected users as required by the DPDP Act.

• Account & profile data — for as long as your account is active.
• Medical records and consultation data — retained to provide continuity of care and to meet medical record-keeping norms (Indian Medical Council regulations generally require clinicians to keep patient records for at least 3 years from the last entry). Hospitals/doctors are independently responsible for their own retention obligations.
• Analytics data — kept in pseudonymous form for a limited period.
• After deletion, we may retain limited data where the law requires it, then erase or anonymise the rest.

Under the DPDP Act and the SPDI Rules you have the right to:

• Access — a summary of the personal data we process about you and how.
• Correction & updating — most data is editable in-app (profile, conditions, medications, records); you can also ask us.
• Erasure — request deletion of your data and account, subject to legal retention duties.
• Withdraw consent — as easily as you gave it.
• Nominate — appoint someone to exercise your rights if you die or become incapacitated.
• Grievance redressal — raise a complaint with us first (below), and escalate to the Data Protection Board of India if unresolved.

To exercise any right, email support@docslotbooking.com. We may need to verify your identity before acting.

We use only the cookies/local storage needed to keep you signed in and to run the offline cache, plus privacy-respecting product analytics (PostHog) routed through our own domain. We do not use third-party advertising cookies or sell data to advertisers.

We may update this policy as the platform or the law evolves. We will change the “Last updated” date above and, for significant changes, notify you in the app or by email.

For any privacy question, request or complaint, contact our Grievance Officer (designated under the DPDP Act and the IT Rules, 2021):

Please also see our Terms & Conditions.