Privacy policy

This policy explains how DocZen (“DocZen”, “we”, “us”) collects, uses, stores and shares your personal data when you use doczen.in and the DocZen app, and how you can exercise your rights under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”). Under the DPDP Act, you are the Data Principal, the person the personal data is about, and DocZen is the Data Fiduciary, the entity that decides why and how that data is processed.

This page states the policy. For the specific protections our system enforces, what is never written to a log, who can see what, and what we refuse to do with your data, see how your data is protected.

What we collect

When you use DocZen, we collect:

• Your name, phone number, email address and city.
• Details of the appointment you book: which surgeon, which clinic, the speciality, the date and time, and its status (booked, cancelled, completed, no-show).
• Basic account activity, such as login times, needed to keep your account secure.

We do not ask you to upload medical records, prescriptions or diagnostic reports to book an appointment, and you should not send us any beyond what a booking form requires.

Why appointment data is treated as sensitive personal data

The fact that you booked an appointment with a named doctor of a named speciality can reveal something about your health, for example that you consulted a cardiologist or an oncologist. Because this can identify you and reveal sensitive information about you, we treat all appointment data as sensitive personal data and apply stricter internal handling to it than to ordinary account details: access is restricted to the systems and staff who need it to operate the booking, it is encrypted in transit, and it is never used for advertising or shared with data brokers.

Why we collect it: purpose limitation

We only use your personal data for the purpose you gave it to us: to show you relevant surgeons, to book and manage your appointment, to let the clinic identify you when you arrive, to send you appointment reminders and updates, and to run basic account security and support. We do not repurpose your data for an unrelated use without asking you again.

We do not sell your data

We do not sell your personal data to anyone, for any price. We do not run third-party advertising trackers on doczen.in or in the app, and your appointment history is never used to build an advertising profile of you.

Who we share your data with

We share your name, phone number and the appointment details with the specific clinic you book with, and only the information that clinic needs to hold your slot and see you for the visit. We may also share limited data with service providers who help us run DocZen, such as SMS or notification providers for appointment reminders, under contracts that restrict them to that purpose only. We do not share your data with any other clinic, surgeon or third party without your consent, except where required by law.

Your rights as a Data Principal

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it has been processed.
• Correction of inaccurate or incomplete personal data.
• Erasure of your personal data once it is no longer needed for the purpose it was collected for, subject to any legal retention requirement.
• Grievance redressal if you are unhappy with how we have handled your data or a request you made.
• Nominating another individual to exercise these rights on your behalf in the event of your death or incapacity.

How to exercise your rights

Email hello@doczen.in with the right you want to exercise and enough information for us to identify your account (name, phone number or registered email). We will respond within a reasonable time as required under the DPDP Act.

Consent and withdrawal

We process your personal data on the basis of the consent you give when you create an account or book an appointment. You may withdraw consent at any time by requesting account deletion at hello@doczen.in, though withdrawing consent will mean we can no longer provide the booking service to you, and it does not affect the lawfulness of processing carried out before withdrawal.

Retention

We retain a completed appointment record for three years from the date of the visit, in line with typical clinic record-keeping practice, and delete it thereafter unless a longer period is required by law or you have requested earlier deletion. Account details are retained for as long as your account is active.

Children and users under 18

DocZen does not offer direct accounts to individuals under 18. A parent or guardian books on behalf of a child using the parent's own account, in the same way they would add any other family member as a patient.

Where your data is stored

Your personal data is stored on servers located in India.

Cookies

We use a single session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

Grievance Officer

To be appointed before public launch. The DPDP Act requires a Data Fiduciary to designate a Grievance Officer to address complaints from Data Principals. Contact details for the Grievance Officer will be published here once appointed.