Privacy Policy

In this Privacy Policy, unless the context requires otherwise:

• “Company” means DocFollow Technologies Private Limited, a company incorporated under the Companies Act, 2013, having its registered office at 4-1-105, R K Nagar, Nawabpeta, Nellore – 524002, Andhra Pradesh, India.
• “App” means the DocFollow Doctor and DocFollow mobile applications, and the DocFollow staff portal used by Clinic Staff, operated by the Company.
• “User” means any person who registers on or uses the App, and includes a User-Doctor, a User-Patient and a Clinic Staff member.
• “User-Doctor” means a medical practitioner registered with a State Medical Council or the National Medical Commission who uses the App.
• “User-Patient” means a patient, or a parent or lawful guardian acting on behalf of a patient, who uses the App to communicate with a User-Doctor.
• “Clinic Staff” means a receptionist or assistant authorised by a User-Doctor to register patients and upload records on the User-Doctor’s behalf.
• “Treating Doctor” means the User-Doctor with whom a User-Patient has an established connection on the App.

The App is a doctor-patient communication platform that enables a User-Patient to message the User-Patient’s Treating Doctor, and enables the Treating Doctor to view the User-Patient’s medical context alongside those messages.

For the purposes of the DPDP Act, 2023, the Company acts as a Data Fiduciary, and determines the purpose and means of processing personal data on the App.

Every User-Doctor is an independent medical practitioner registered with a State Medical Council or the National Medical Commission. Clinical decisions, diagnoses and prescriptions are the sole responsibility of the Treating Doctor. The Company provides the communication channel and record-keeping tools, and does not itself provide medical advice, diagnosis or treatment.

The App is not a directory or marketplace. It does not list, recommend or refer User-Patients to other doctors.

The Company collects only such personal data as is necessary to provide the App, in accordance with the principle of data minimisation.

3.1 From User-Doctors

3.2 From User-Patients

3.3 Health Data Recorded by User-Doctors

A Treating Doctor, or Clinic Staff authorised by the Treating Doctor, may record the following as part of clinical practice: medical history, current medications, allergies, diagnoses, prescriptions (including photographs of paper prescriptions), laboratory reports and private clinical notes.

Private clinical notes recorded by a User-Doctor are visible only to that User-Doctor and are never shown to the User-Patient.

3.4 Device Data

The App keeps an identifier for the device a User signs in on, so that an account is signed in on one device at a time, and a notification token, so that notifications can be delivered.

The Company processes personal data only for the following purposes:

• operating the messaging service between a User-Patient and the Treating Doctor;
• displaying the User-Patient’s medical context to the Treating Doctor alongside a conversation;
• storing and retrieving prescriptions and health records;
• authenticating Users through one-time passwords;
• sending notifications about new messages;
• verifying the registration of User-Doctors;
• detecting misuse, preventing fraud and maintaining the security of the App; and
• complying with legal obligations under Indian law.

The Company does not use health data for advertising, does not sell it, and does not share it with pharmaceutical companies, insurers, employers or data brokers.

The Company processes personal data on the basis of the explicit, informed consent of the User, obtained separately for each distinct purpose as required by the DPDP Act, 2023 and the DPDP Rules, 2025. Where processing is necessary to comply with a legal obligation, including medical record-keeping obligations, the Company relies on that legal obligation.

A single consent to all terms is not treated as valid consent for health data. The Company therefore obtains separate and granular consent from each User for each distinct purpose.

6.1 Granular Consent at Registration

Consent is obtained as separate, individually selectable items. Each item may be accepted or declined on its own, and declining an optional item does not prevent a User from using the core service. Optional items are off unless the User turns them on, with one exception: anonymous usage statistics, which identify no one, are on unless the User turns them off.

Storing photographs of prescriptions and reading medicine names from them is part of the core service, not a separate consent item (see Section 12).

Each consent is recorded individually for every User, with a timestamp, the version of this Privacy Policy in force at the time, and the exact wording shown to the User. A User may review and change optional consents at any time through Settings → Privacy → Manage Consent.

6.2 Withdrawal of Consent

A User may withdraw any consent at any time through Settings → Privacy → Manage Consent, or by writing to accounts@docfollow.in.

• Withdrawal of an optional consent disables only the corresponding feature; the rest of the App continues to function.
• Withdrawal of a required consent is treated as a request to close the account.
• On withdrawal, the Company stops the relevant processing and deletes the associated data, subject to the retention obligations set out in Section 11.

6.3 Connection Consent

A User-Patient is connected to a User-Doctor only by entering a code that the User-Doctor gives the User-Patient in person. The User-Doctor and the clinic are shown only after the correct code is entered, and the User-Patient can then report that the record is not theirs instead of connecting. Accounts are never connected automatically.

6.4 Secondary Use of Data

Data provided for communication between a User-Patient and the Treating Doctor is used solely for that purpose. The Company does not, directly or indirectly, use the identifiable data of User-Doctors or User-Patients for research, analytics, commercial insights or any other secondary purpose.

If the Company proposes to use anonymised or aggregated data for research or product development, it shall first obtain fresh, separate and explicit consent from the Users concerned. Declining such consent shall not affect a User’s use of the App. No such processing takes place until consent is given.

7.1 Location of Data

• All personal and health data is stored on servers located in India.
• The App’s servers and database run on Botnix Cloud in India. Photographs, documents and backups are stored with Amazon Web Services in Mumbai.
• No health data of User-Patients is stored outside India.
• Some service providers process data outside India without storing it there: prescription photographs are read by Google Cloud (Section 12), notification alerts pass through Google and Apple, and emails to doctors who register on the website are sent through Resend.

7.2 Security Safeguards

• All data is encrypted in transit using TLS 1.2 or higher, and at rest using AES-256.
• Authentication is by one-time password; no passwords are stored.
• Role-based access ensures that a User-Doctor can access only the User-Doctor’s own patients, and a User-Patient can access only the User-Patient’s own records.
• Clinic Staff have restricted access and cannot read conversations between a User-Doctor and a User-Patient.
• A sender may correct or withdraw a message for a short time after sending it (15 minutes for a User-Doctor, 10 minutes for a User-Patient). The original is kept in an audit log, and the other person is shown that it was changed, so the record of each consultation remains accurate.
• Access to backend systems is limited to authorised personnel of the Company, and every such access is logged.
• No health data is cached on a User’s device in plain text.
• An account is signed in on one device at a time. A session lasts up to 30 days for a User-Doctor and 90 days for a User-Patient, and the doctor app can lock behind the device’s fingerprint or face check.
• Encrypted backups are kept in India for up to 35 days, and cannot be altered or deleted before they expire.
• The Company conducts periodic security reviews of its infrastructure.

7.3 Data Protection Impact Assessment

Health data is treated as high-risk processing. The Company shall conduct a Data Protection Impact Assessment before introducing any feature that materially changes how health data is processed, and before the App reaches a scale at which the Company may be notified as a Significant Data Fiduciary.

7.4 Personal Data Breach

In the event of a personal data breach, the Company shall inform the Data Protection Board of India and every affected User without undue delay, and shall submit a detailed report to the Data Protection Board within 72 hours, in accordance with the DPDP Rules, 2025. The Company shall take immediate steps to contain and remediate the breach and shall document the incident.

The Company, its employees and any person engaged by the Company shall keep all medical records, personal information, diagnoses and communications relating to a User-Patient strictly confidential. Such information shall not be disclosed, published or released to any third party except:

• with the express consent of the User-Patient;
• as strictly required or permitted by applicable law, such as public health reporting obligations or an order of a court or competent authority; or
• to the User-Patient’s Treating Doctor on the App, for the purpose of the User-Patient’s care.

All details provided by User-Doctors shall likewise be kept confidential.

This obligation of confidentiality between the Users and the Company shall survive the closure of any account and the termination of any agreement between a User and the Company.

The Company does not sell, rent or trade personal data. Personal data is shared only as follows:

The Company does not share health data with insurance companies, pharmaceutical companies, advertisers, data brokers, employers or any party not listed above.

Messages, prescriptions and health records exchanged between a User-Patient and the Treating Doctor constitute medical records of the Treating Doctor. Such records are retained for the period required under applicable medical record-keeping laws and regulations, including the Telemedicine Practice Guidelines, 2020 and the professional conduct regulations applicable to registered medical practitioners, even where a User-Patient closes the account. On expiry of that period, the records are deleted.

A User-Doctor who closes an account may export the User-Doctor’s records before closure. A User-Patient who closes an account ceases to have access to the App; consultation records held on behalf of the Treating Doctor are retained only as set out above.

The Company shall address every erasure request within the period prescribed under the DPDP Rules, 2025, and shall inform the User where any data must be retained under law, and for how long.

Reading prescriptions is part of the core service. The following process applies:

• the User-Doctor or authorised Clinic Staff photographs a paper prescription;
• the image is uploaded over an encrypted connection to the Company’s servers in India;
• an artificial intelligence model (Google’s Gemini, through Google Cloud Vertex AI) reads the image and proposes medicine names and dosages;
• the extracted text is shown to the User-Doctor for review and correction, and nothing is saved until the User-Doctor confirms it; and
• the original photograph is always retained as the authoritative record.

Google Cloud acts as a Data Processor on the Company’s instructions under its data processing terms, and does not use the images to train its models or for its own purposes. The images may be processed outside India; they are stored only in India.

The App may hold health records of patients below 18 years of age, recorded by the Treating Doctor as part of clinical care.

• A person below 18 years of age cannot hold an account. A child’s record is created by the Treating Doctor under the mobile number of the parent or lawful guardian present at the consultation, who is given the connection code in person and uses the App on the child’s behalf.
• The parent or lawful guardian gives consent for the child’s data when connecting to the Treating Doctor.
• The Company does not track, monitor or profile children, and does not direct any targeted advertising at children.
• The Company does not process the data of a child in any manner likely to have a detrimental effect on the well-being of the child.

The Company relies on the following service providers. Each processes data on the Company’s instructions and not for its own purposes.

The mobile apps do not use cookies. The staff portal uses one cookie, only to keep Clinic Staff signed in. The App does not track a User’s activity outside the App. Unless a User turns it off, the Company collects anonymous usage statistics (which screens are used, never by whom) that cannot identify any individual User.

Any grievance, complaint or issue relating to personal data shall, in the first instance, be addressed to the Grievance Officer:

• Name: Dr. J. Sreeharsha
• Designation: Founder and Director, DocFollow Technologies Private Limited
• Address: 4-1-105, R K Nagar, Nawabpeta, Nellore – 524002, Andhra Pradesh, India
• Email: accounts@docfollow.in
• Response time: Within 15 days of receipt of a complaint

A User who is not satisfied with the response of the Grievance Officer may approach the Data Protection Board of India in accordance with the DPDP Act, 2023.

• Users shall be notified within the App of any material change to this Privacy Policy.
• The “Last updated” date above shall be revised on every change.
• Where a change affects how health data is processed, the Company shall seek fresh consent rather than rely on continued use of the App.

• Company: DocFollow Technologies Private Limited
• CIN: U62011AP2026PTC127506
• Registered office: 4-1-105, R K Nagar, Nawabpeta, Nellore – 524002, Andhra Pradesh, India
• Email: accounts@docfollow.in
• Website: www.docfollow.in

Doctors can register on this website. The form asks for name, mobile number, email address, specialty, qualification, medical council and registration number, clinic name and address, a copy of the medical council registration certificate, and a copy of the doctor’s Aadhaar card as ID proof. Only our review team can open the certificate and the Aadhaar card.

This website is hosted by Cloudflare, which also checks that registration forms are sent by a person rather than a bot. Emails to doctors who register are sent through Resend.

This website does not use advertising or analytics cookies. It remembers whether you chose light or dark mode, in your own browser.