Privacy Policy

Effective date: 9 November 2026 · Version 1.0

This Privacy Policy explains how Anahata ("we", "us") collects, uses, shares and protects personal data when you use DoctorOne. We follow the Information Technology Act, 2000, the SPDI Rules, 2011 and the Digital Personal Data Protection Act, 2023 and its Rules. For India, we are the "Data Fiduciary" for the data described here.

1. Data we collect

All users

• Mobile number (for login by OTP) and your role (patient, doctor, facility, sub-user).
• Device information to protect your account: device identifier, device model and operating system, app version, and push-notification token.
• Security answers you give when you sign in on a new device or recover an account.
• Technical logs: IP address, timestamps, error and crash information, and actions in the app that relate to security and fraud checks.
• Support tickets, complaints and messages you send us, and your notification history.

Patients (and people you book for)

• Name, age or date of birth, sex, phone number and address (village or area, district, pin code, state) of the person being seen. Other address fields are optional.
• Booking details: doctor, facility, session, serial number, payment status, refund status, attendance status.
• Whether the booking was made for someone else.

Doctors

• Name, phone, date of birth, sex, address (kept private, not shown to patients), qualifications, specialty, registration number and council, photo, and the sessions and fees you set.

Facilities

• Business name, category, address, PAN, trade licence number, GST or CIN (where given), authorised person's name and phone, sub-user details, listed doctors, fees and sessions.
• Bank details are collected and held by our payment partner during KYC. We store only the bank name and the last 4 digits of the account.

Payments

• Amount, order and payment reference numbers, status and refunds. Card, UPI and bank credentials are handled only by the payment partner and never reach our servers.

2. What we do not collect

• Precise (GPS) location, your contacts, photos or files on your phone, microphone or camera data (other than a profile photo you choose to upload).
• Medical records, prescriptions, diagnoses or test reports. Consultations happen at the Facility, not on DoctorOne.
• Advertising identifiers for ads. We do not show ads and do not sell data.

3. Why we use your data

• To create and secure your account and verify it is you.
• To run bookings: hold slots, take payments, issue serial numbers, show patient lists to the doctor and Facility, mark attendance, handle cancellations, refunds, payouts and complaints.
• To send OTPs, booking confirmations, reminders, badge notices and other service notifications by SMS, push and in-app messages.
• To verify doctors and Facilities and manage the Verified badge.
• To prevent fraud and misuse, enforce our Terms and keep records the law requires.
• To provide support and improve the Platform (aggregate statistics only).
• To comply with law and respond to valid orders of authorities.

4. Legal basis

We process data with your consent (given when you sign up and book) and for the "legitimate uses" allowed by the DPDP Act, such as providing the service you asked for, meeting legal obligations, and preventing fraud. Where the SPDI Rules apply to sensitive data such as payment-related information, we act in line with them. You can withdraw consent at any time by deleting your account, although this may stop us from providing the service.

5. Who can see your data

• Doctors see the name, age, sex and phone of patients booked with them in their sessions, and only for booked sessions. Patients never see a doctor's phone number or private address.
• Facilities see their own bookings and patient details for those bookings. A Facility sees a doctor's phone only when the doctor has accepted its invitation.
• DoctorOne staff see data only as their role needs. Access to a person's details is logged. Facility owners cannot see complaints raised against them.
• Other users see only the public profile of doctors and Facilities (name, specialty, fee, timings, photo, badge).

6. Sharing with service providers

We share data with service providers that process it for us under contract, only as needed:

• Razorpay for payments, KYC and payouts.
• SMS and OTP provider MSG91 (or another licensed provider) for messages.
• Supabase and cloud infrastructure for database, storage and servers.
• Cloudflare for security and content delivery.
• Push services of Google (Firebase) and Apple for notifications.

We may also disclose data to courts, police or government authorities when the law requires, or to protect rights, safety and prevent fraud. We do not sell your personal data and do not share it for advertising.

7. How long we keep data

• Patient personal details on a booking: removed or anonymised about 90 days after the session; details of minors are erased after the session end and the 24-hour payout hold.
• Notifications: 90 days.
• Accounts: until you delete them. After deletion we remove or anonymise your profile; we keep payment, tax and accounting records, and records needed for disputes or legal claims, for as long as the law requires (8 years for financial records).
• Security and access logs: 180 days.

8. Children

DoctorOne accounts are for people aged 18 and over. A parent or guardian may book for a child and gives consent for the child's data. We do not track, profile or send targeted advertising to children. Please contact us if you believe a child has made an account.

9. Security

We protect data with encryption in transit, access controls on every table (row level security), restricted staff access with logging, device checks on sign-in, and regular backups. No system is fully secure, so please protect your phone and OTPs.

10. Your rights

Under the DPDP Act you may:

• ask for a summary of the data we hold and who we shared it with;
• correct or complete your data (edit your profile, or contact us);
• ask us to erase your data (Delete account), subject to legal retention;
• withdraw consent;
• nominate another person to exercise rights if you die or cannot act;
• raise a grievance with us and, if not resolved, complain to the Data Protection Board of India.

To use a right, write to the Grievance Officer. We respond within 30 days. We may need to verify your identity first.

11. Deleting your account

Go to Options menu, Delete account in the app. You can also request deletion on our website at https://www.doctorone.app/delete-account if you cannot open the app. Deletion is not possible while you have upcoming bookings, pending refunds, unpaid payouts or unpaid charges; the app tells you what to clear first. After you ask, your account is deleted after 30 days. If you log in again during these 30 days, the deletion is cancelled and your account stays as it is. When the 30 days end, your personal profile is removed or anonymised as described in section 7.

12. Data storage and transfers

Your data is stored on servers located in Mumbai, India. If any provider processes data outside India, we ensure it is done in line with Indian law and the restrictions the Government may notify.

13. Data breach

If a breach affects your personal data, we will notify the Data Protection Board and affected users as the law requires.

14. Cookies and analytics on the website

The website uses only essential cookies needed to run it. The mobile app does not use advertising trackers. In the app we do not show ads or build advertising profiles.

15. Permissions the app asks for

• Notifications to send booking and account alerts (optional).
• Photos or camera only if you choose to upload a profile photo (optional).
• The app does not ask for location, contacts, microphone or SMS reading permission.

16. Changes to this policy

The Owner (Anahata / DoctorOne) may change, edit, update or remove any part of this policy at any time. We will post the new version in the app and on our website with a new effective date, and notify you of important changes. Continuing to use the Platform after that date means you accept the updated policy.

17. Contact

Grievance Officer / Data Protection contact: Mrinal Mahato, [email protected], Anahata, Motipur, Hura, Purulia, West Bengal, 723130, India.