Privacy Policy

DocFollow is run by [company legal name], [registered address]. This policy explains how we handle personal information in the DocFollow Doctor app, the DocFollow patient app, the clinic staff portal, and this website.

We handle personal data under India’s Digital Personal Data Protection Act, 2023 and the rules made under it. [lawyer to confirm our role for clinical records, the doctor’s role, and the wording that follows]

For clinical records, such as notes, prescriptions and messages between a doctor and a patient, the doctor decides what to record. We store and process those records to provide the Service.

From doctors: name, mobile number, specialty, clinic name and address, profile photo if added, and an email address if you register on this website.

About patients: name, age or date of birth, mobile number, and the health information a doctor or patient adds. That can include medical history, allergies, medicines, prescriptions, reports, photos, and messages.

From clinic staff: name and mobile number, and which doctor they work for.

From everyone: when and to which policy version you gave consent, sign-in records, a device identifier, and a notification token so we can send you alerts.

On this website: the details you type into the registration form. We do not use advertising or analytics cookies.

We use personal information only to run DocFollow:

• to create and secure your account, and sign you in with a one-time password;
• to link patients to the doctors who added them;
• to deliver messages, prescriptions and records between a doctor and their patients;
• to read medicines from prescription photos, when a doctor or their staff asks us to;
• to send notifications, and an email when a doctor registers on this website;
• to review doctor profiles before they go live;
• to keep the Service secure, investigate misuse, and meet legal duties.

We do not sell personal information. We do not use it for advertising. We do not use your health information to train artificial intelligence models.

We ask for your consent when you create an account, and record when you gave it and which version of this policy you agreed to. You can withdraw consent at any time by contacting us. Withdrawing consent means we can no longer provide the Service to you, and it does not undo anything done before.

[lawyer to confirm the basis for a doctor adding a patient before that patient joins DocFollow]

• Your doctor sees only their own patients. If two doctors treat the same patient, each sees only their own records.
• A patient sees the records their doctors share, and the doctors they are connected to see what that patient uploads.
• Clinic staff a doctor authorises can add patients and upload records for that doctor. They cannot read messages.
• Our teamcan see account details, such as a doctor’s name and clinic, to review profiles and give support. Our internal tools do not show messages or medical records, and access is logged.
• A doctor’s mobile number is never shown to patients.

We only share information outside DocFollow with the service providers below, or when the law requires it.

We use trusted companies to run parts of the Service. They may only use data to provide their service to us.

• Hosting and storage for our database and for photos and documents. [provider names]
• Automated prescription reading, which receives prescription photos only. [provider name, and its no-training and no-retention terms]
• SMS delivery for one-time passwords. [provider name]
• Push notifications, through Google Firebase Cloud Messaging. Notifications never contain medical information: they say “Sent you a message”, not what the message says.
• Email, through Resend, for messages to doctors who register on this website.
• This website is hosted by Cloudflare, which also checks that registration forms are sent by a person rather than a bot.

Our database, and the photos and documents added to DocFollow, are stored in India. [confirm hosting locations before publishing]

Some providers, such as those for push notifications and email, may process limited information, such as a notification token or an email address, outside India. They do not receive medical information.

• All connections to DocFollow are encrypted.
• Photos and documents are encrypted in private storage, and open only through links that expire. [confirm database encryption at rest before claiming it]
• Notifications and lock-screen alerts never show medical content.
• The apps keep a limited copy of recent conversations on your phone so they work without signal. Logging out removes it from the phone.
• Access by our team is limited, and logged.

• Account details are kept while your account is open.
• Medical records and messages may need to be kept after an account is closed, because doctors have a legal duty to keep clinical records. [lawyer to confirm the retention period and what is deleted on request]
• Automated prescription readings are deleted after 7 days. The medicines a person reviewed and saved, and the original photo, stay with the record.
• Website registrations that are not approved are kept for [retention period].

Under the Digital Personal Data Protection Act, you can ask us to:

• tell you what personal information we hold about you and how we use it;
• correct, complete or update your information;
• delete your information, where we are not required to keep it [lawyer to confirm how erasure applies to clinical records];
• withdraw your consent;
• nominate someone to act for you if you die or become unable to act;
• hear and resolve a complaint.

To use these rights, contact our Grievance Officer below. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

A doctor may treat patients under 18. Where a patient is a child, we process their information only with the consent of a parent or lawful guardian, as the law requires. [lawyer to confirm how parental consent is obtained and verified]

This website does not use advertising or analytics cookies. It remembers whether you chose light or dark mode, in your own browser. When you register, Cloudflare’s bot check may use technical signals from your browser to confirm you are a person.

If we change this policy in a way that affects you, we will tell you in the app and ask for your consent again where the law requires it. The version at the top of this page is the one recorded with your consent. See also our Terms of Service.

For any privacy question, request or complaint, contact:

• Grievance Officer: [name]
• Email: [privacy email]
• Address: [registered address]

We will respond within [response period].