Skip to content
Sign in
Last updated 5 September 2026

Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how [QuickDoctory.com] ("QuickDoctory", "we", "us", "our"), the operator of the website www.quickdoctory.com and any associated mobile or web applications (collectively, the "Platform"), collects, uses, stores, shares, and protects information relating to individuals who use the Platform.

QuickDoctory is a cloud-based Out-Patient Department (OPD) and Clinic Relationship Management (CRM) system that helps clinics, individual practitioners, and healthcare facilities ("Clinics", "Practitioners", or "Customers") manage appointments, patient registration, billing, prescriptions, and related clinical workflows, and that enables patients ("Patients" or "End Users") to book appointments and interact with their Clinic through the Platform.

QuickDoctory is presently at prototype / early-access stage, offered on a limited basis at minimal/introductory charges as part of our participation in the Startup India initiative (DPIIT recognition: [insert DPIIT recognition number, if applicable]). This stage does not reduce our data-protection obligations; the same safeguards described in this Policy apply from day one of operation, and this Policy will be revised as the product, user base, and applicable regulatory obligations evolve.

By accessing or using the Platform, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use the Platform.

1.1 Who This Policy Covers

  • Clinics/Practitioners — organizations or individual doctors who register on QuickDoctory to manage their practice ("Customer", "Data Controller/Fiduciary" for the Patient data they input).
  • Patients/End Users — individuals whose appointment, demographic, billing, and health information is entered into the Platform by a Clinic, or who interact directly with a Clinic through the Platform (e.g., self-booking, patient portal).
  • Website Visitors — individuals who visit www.quickdoctory.com without creating an account.

2. Key Definitions

  • "Personal Data" / "Personal Information" — any information relating to an identified or identifiable natural person.
  • "Health Data" / "Protected Health Information (PHI)" / "Sensitive Personal Data" — data concerning physical or mental health, medical history, diagnoses, prescriptions, lab results, treatment notes, and similar clinical information.
  • "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
  • "Data Fiduciary" (DPDP Act) — the entity that determines the purpose and means of processing Personal Data (equivalent to "Controller" under GDPR).
  • "Data Principal" (DPDP Act) — the individual to whom the Personal Data relates (equivalent to "Data Subject" under GDPR).
  • "Consent Manager" — a person/entity registered with India's Data Protection Board through which a Data Principal may give, manage, review, or withdraw consent (as contemplated under the DPDP Act, 2023).
  • "De-identified/Aggregated Data" — data that has been processed so it can no longer, on its own, identify an individual.

3. Information We Collect

3.1 Information Clinics/Practitioners Provide About Themselves

  • Name, clinic name, registration/license number, specialization, qualifications.
  • Contact details: phone number, email address, clinic address.
  • Account credentials (username, password — stored using one-way hashing).
  • Billing details: GSTIN, bank account/UPI details for payouts (if applicable), and payment method used to pay QuickDoctory subscription fees.
  • Staff details, where a Clinic adds sub-users/receptionists/associate doctors.

3.2 Information Collected About Patients (entered by Clinics or by Patients directly)

  • Identity and contact data: name, age/date of birth, gender, phone number, email, address.
  • Appointment data: date, time, doctor, department, visit reason, status (booked/completed/cancelled/no-show).
  • Health Data: symptoms, diagnoses, prescriptions, treatment notes, lab/diagnostic reports or references, allergies, vitals, and medical history recorded during OPD visits.
  • Billing/insurance data: consultation fees, payment status, invoices, and (where applicable) insurance or payer details.
  • Identity documents, where a Clinic collects these for registration (e.g., Aadhaar/ID proof), only if the Clinic enables this field.

3.3 Information Collected Automatically

  • Device and log data: IP address, browser type, operating system, device identifiers, crash logs.
  • Usage data: pages/features accessed, click patterns, session duration, referring URLs.
  • Cookies and similar technologies (see Section 9).
  • Approximate location (derived from IP address), used only for service delivery and fraud prevention — we do not collect precise GPS location unless a specific feature requires it and you separately consent.

3.4 Information From Third Parties

  • Payment gateway/processor confirmations (e.g., transaction status; we do not store full card numbers).
  • SMS/WhatsApp/email delivery providers used to send appointment reminders and OTPs.
  • Analytics providers (e.g., aggregated usage statistics).

4. How We Use Information

We process Personal Data only for purposes that are necessary, proportionate, and disclosed to you, including to:

  • Create and manage Clinic and Patient accounts, and authenticate logins.
  • Enable core CRM/OPD functions: appointment scheduling, queue/token management, e-prescriptions, billing and invoicing, and patient records within a Clinic's account.
  • Send transactional communications: appointment confirmations, reminders, OTPs, payment receipts, and service updates via SMS, WhatsApp, email, or push notification.
  • Process payments for subscription fees (from Clinics) and, where enabled, consultation fees (from Patients), through PCI-DSS compliant third-party payment gateways.
  • Provide customer support and respond to queries or grievances.
  • Maintain security, detect fraud, and prevent misuse of the Platform.
  • Improve and develop the Platform, including through aggregated/de-identified usage analytics.
  • Comply with applicable legal, regulatory, tax, and record-keeping obligations.
  • With separate, specific consent: send promotional/marketing communications about new features or offers (you may opt out at any time).

5. Legal Basis for Processing

Depending on your location, we rely on the following legal bases:

5.1 Under GDPR (EU/EEA users)

  • Consent — for optional features, marketing communications, and non-essential cookies.
  • Contractual necessity — to provide the Services a Clinic or Patient has signed up for.
  • Legal obligation — for tax, accounting, and regulatory record-keeping.
  • Legitimate interests — for fraud prevention, platform security, and service improvement, balanced against your rights.
  • Vital interests / substantial public interest in the area of public health — may apply narrowly to certain health-data processing, consistent with GDPR Article 9(2).

5.2 Under the DPDP Act, 2023 (India)

India's applicable data protection law is the Digital Personal Data Protection Act, 2023 ("DPDP Act"), together with the Digital Personal Data Protection Rules notified thereunder — not the earlier draft "Personal Data Protection Bill," which was never enacted. We process Personal Data on the basis of:

  • Free, informed, specific, and unambiguous Consent, obtained through clear notice at or before collection, and which you may withdraw at any time as easily as it was given.
  • Certain "legitimate uses" recognized under the DPDP Act (e.g., for a purpose for which you voluntarily provided data and did not indicate you did not consent; compliance with law; medical emergency or public health purposes).

5.3 Under HIPAA (U.S. users/Covered Entities), if applicable

QuickDoctory does not currently target or operate for U.S. healthcare providers as a general matter. If QuickDoctory is engaged by a U.S.-based Covered Entity (as defined under the Health Insurance Portability and Accountability Act, "HIPAA") to process Protected Health Information (PHI), QuickDoctory will act as a "Business Associate" and will enter into a Business Associate Agreement (BAA) with that Covered Entity, and will implement the administrative, physical, and technical safeguards required by the HIPAA Security Rule and Privacy Rule for the PHI it handles under that engagement.

6. How We Share Information

We do not sell Personal Data. We may share information as follows:

  • Within a Clinic's account — Patient data is visible to the Clinic/Practitioner and authorized staff the Clinic has added, since the Clinic is the data controller/fiduciary for its own patients.
  • Service providers/sub-processors — cloud hosting, SMS/WhatsApp/email delivery, payment gateways, customer support tools, and analytics providers, each bound by contractual confidentiality and data-protection obligations, and given access only to the data needed to perform their function.
  • Legal and regulatory disclosures — where required by law, court order, government request, or to establish/exercise/defend legal claims.
  • Business transfers — in connection with a merger, acquisition, financing due diligence, or sale of assets, subject to confidentiality obligations on the recipient.
  • Safety — where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of QuickDoctory, our users, or the public.
  • With your explicit consent — for any other purpose we disclose to you at the time.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Keep you logged in and remember preferences (strictly necessary cookies).
  • Understand how the Platform is used, to improve performance (analytics cookies).
  • Where enabled, measure the effectiveness of our own marketing (marketing cookies) — used only with consent for EEA/UK visitors.

You can control cookies through your browser settings. Disabling strictly necessary cookies may prevent you from logging in or using core features. We honor applicable consent-management requirements for EEA/UK visitors (a cookie-consent banner with granular accept/reject options) and do not currently respond to "Do Not Track" browser signals.

To exercise any of these rights, write to us at privacy@quickdoctory.com. We will verify your identity before acting on a request and will respond within the timelines required by applicable law (e.g., without undue delay and generally within one month under GDPR). Where a Clinic is the Controller/Fiduciary for your Patient data, we may direct your request to the relevant Clinic and assist them in fulfilling it.

9. Data Security

We implement reasonable and appropriate technical and organizational measures to protect Personal Data, including:

  • Encryption of data in transit (TLS/HTTPS) and, for sensitive fields, encryption at rest.
  • Role-based access control, so staff and Clinic users only see data relevant to their role.
  • Hashed and salted password storage; no plaintext password storage.
  • Access logging and monitoring for the systems that store Health Data.
  • Periodic security reviews as the Platform scales beyond prototype stage; vulnerability management for production systems.
  • Vendor due diligence for sub-processors handling Personal Data.

No method of transmission or storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security, and you share information with us at your own risk.

10. Data Breach Notification

In the event of a Personal Data breach that poses a risk to your rights and freedoms, we will:

  • Notify the Data Protection Board of India and affected Data Principals, as required under the DPDP Act and rules made thereunder.
  • Notify the competent supervisory authority within 72 hours where feasible, and affected individuals without undue delay, as required under GDPR Articles 33–34, for EEA/UK users.
  • Notify affected individuals and, where applicable, the U.S. Department of Health and Human Services, as required under the HIPAA Breach Notification Rule, for any PHI we process as a Business Associate.

11. Data Retention

  • Patient/clinical records: retained for as long as the Clinic's account is active, and thereafter for the period required by applicable medical record-retention laws (which can range from a few years to several years depending on jurisdiction and record type), after which data is deleted or anonymized.
  • Account and billing data: retained for the duration of the account plus the period required for tax/accounting law (generally up to 8 years in India, unless a longer period applies).
  • Marketing consent records: retained until consent is withdrawn, plus a reasonable period for compliance evidence.
  • Logs/analytics data: retained for a limited period (e.g., 12–24 months) and then aggregated or deleted.

When a Clinic closes its account, we will retain or delete Patient data per the Clinic's instructions and applicable law; where deletion is requested but law requires retention (e.g., medical record laws), we will restrict further processing of that data to only what is legally required.

12. Children's Data

The Platform is intended for use by Clinics, Practitioners, and adult Patients. Where a Clinic records health information about a minor patient, such data is entered and managed by the Clinic/parent/guardian on the minor's behalf, and the Clinic is responsible for obtaining any parental/guardian consent required under applicable law (including verifiable parental consent under the DPDP Act, 2023, for the processing of a child's Personal Data). QuickDoctory does not knowingly allow minors to independently create accounts or self-register without such consent.

14. Third-Party Links and Integrations

The Platform may contain links to third-party websites (e.g., payment gateways, diagnostic labs, telemedicine tools) or allow Clinics to integrate third-party services. This Policy does not apply to those third parties, and we encourage you to review their privacy policies separately. We are not responsible for the privacy practices of any third-party site or service not operated by us.

16. Data Protection Officer / Privacy Contact

For any questions about this Policy or our data practices, or to exercise your rights, please contact our privacy team at dpo@quickdoctory.com. [If QuickDoctory processes data at a scale that triggers mandatory Data Protection Officer (DPO) appointment under GDPR (Art. 37) or "Significant Data Fiduciary" obligations under the DPDP Act, a formally appointed DPO's name and contact details, along with a Data Protection Impact Assessment process, will be published here.]

17. Startup India / Prototype-Stage Disclosure

QuickDoctory is offered by an early-stage startup participating in the Startup India initiative, presently offering a prototype version of the Platform at minimal introductory pricing to a limited set of Clinics for feedback and validation purposes. We disclose this so users understand:

  • Features, pricing, and data-retention/backup practices may change as the product matures from prototype to general availability.
  • The same core privacy and security commitments in this Policy apply during the prototype phase — early access does not mean reduced protection.
  • We will notify active Clinics/Patients of material changes to how their data is handled as the product evolves (see Section 18).

18. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will post the revised Policy on www.quickdoctory.com with an updated "Last Updated" date, and for material changes, we will provide additional notice (e.g., email or in-app notification) and, where required by law, seek fresh consent before the changes take effect.

19. Contact Us