Privacy Policy

1. Scope & consent

By creating an account, browsing the directory, booking an appointment, or otherwise using the Services, you agree to this Privacy Policy and, where required, provide your consent to the processing described here. If you do not agree, please do not use the Services. Sensitive personal data (including health information) is collected and processed only with the relevant consent or a lawful basis.

2. Information we collect

2.1 Information you provide

• Account & clinic data: name, clinic name, email, phone, password (stored only as a hash), specialty, registration/qualification details, and clinic address.
• Billing data: billing name, GSTIN, and payment confirmations. Card/UPI details are handled by our payment gateway (Razorpay) and are not stored on our servers.
• Patient & health data (entered by clinics): patient demographics, contact details, visit notes, vitals, diagnoses, prescriptions, lab/test results, invoices and uploaded documents. This is entered and controlled by the clinic.
• Directory & booking data: doctor profile details and, when a patient books, the patient's name, phone and reason for visit.
• Communications: support requests, demo enquiries and feedback you send us.

2.2 Information collected automatically

• Technical data: IP address, device and browser type, and pages viewed, used for security, diagnostics and analytics.
• Cookies: see Section 8.

We do not knowingly collect more than is necessary, and we exclude information that is publicly available or that you are not required to provide.

3. How we use information

• To provide, operate, secure and improve the Services;
• To let clinics manage patients, appointments, prescriptions and billing;
• To power the public directory and appointment booking;
• To process subscriptions, send invoices and apply GST;
• To send service, security and (with consent) product communications;
• To detect, prevent and investigate fraud, abuse and security incidents;
• To comply with legal, tax and healthcare record-keeping obligations.

We do not sell personal data, and we do not use patient data to train AI models — ours or anyone else's.

4. How we share information

We share personal data only as needed and with appropriate safeguards:

• With the clinic: patient data is accessible to the authorised staff of the clinic that created it, based on their role-based permissions.
• With sub-processors: vetted vendors who help us run the Services (hosting, messaging via Meta WhatsApp / MSG91, email, and payments via Razorpay), under contract and only on a need-to-know basis.
• For legal reasons: where required by law, court order, or a valid request from a competent authority, or to protect rights, safety and the integrity of the Services.
• Business transfers: in connection with a merger, acquisition or reorganisation, subject to this policy.

5. Data storage, residency & security

You choose your data residency region at signup (India, EU, US, UAE or Singapore) and your data — including backups and analytics — stays in that region. We protect data with encryption in transit (TLS) and at rest (AES-256), role-based access controls, audit logging, and regular security testing. No system is perfectly secure, and we cannot guarantee absolute security against hacking, phishing or unauthorised access beyond our reasonable control. Please keep your password confidential and log out of shared devices.

6. Data retention

We retain personal data only for as long as necessary for the purposes above, or as required by applicable law (including medical record-retention rules). When no longer needed, data is deleted or anonymised securely. Clinics control their patient data and can export or delete it; on account closure we erase production data within 30 days and from backups within the backup-rotation window, except where law requires retention.

7. Your rights

Subject to applicable law (including the Digital Personal Data Protection Act, 2023 in India, and GDPR where it applies), you may:

• access, correct, or update your personal data;
• request deletion / erasure of your personal data;
• withdraw consent (this won't affect prior lawful processing);
• request a portable copy of your data;
• nominate, where DPDP allows, another person to exercise your rights; and
• raise a grievance with our Grievance Officer (Section 11).

If you are a patient whose data sits with a clinic, please contact that clinic (the fiduciary) first; we will assist the clinic in honouring your request. To exercise rights over data we control, email hello@eclinicpro.com with the subject "Data request" and your registered email/phone. We respond within 30 days.

8. Cookies

We use cookies and similar technologies to keep you signed in, remember preferences, keep the Services secure, and understand usage. You can control cookies through your browser settings; disabling some cookies may affect functionality. We do not control third-party cookies that those third parties may set.

9. Children

The Services are intended for clinics and adults. We do not knowingly create accounts for minors. Children's health records may be stored by a clinic as part of treatment, under the clinic's responsibility and the consent of a parent or guardian.

10. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a new "Last updated" date. Your continued use of the Services after changes take effect means you accept the updated policy.

11. Grievance Officer & contact

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, 2023, the contact details of our Grievance Officer are:

We acknowledge grievances within 24 hours and aim to resolve them within 15 days as required under applicable Indian law.

See also our Terms of Service and Refund & Cancellation Policy.