How your data is protected

An appointment is treated as sensitive data, because it is

A booking can reveal health information. We treat it as sensitive internally. The DPDP Act does not create a separate 'sensitive personal data' category; our handling must also account for other applicable privacy and professional rules.

Minimise operational logs

Application errors should record categories and status codes, not patient payloads. Database query notices are suppressed. Hosting logs, third-party delivery metadata and production error paths still need verification; this is not a claim that no provider ever processes an identifier.

Optional analytics on clinic information pages

The application has no advertising pixels or session replay. When configured, Google Analytics measures visits and enquiry clicks on selected clinic and company information pages, only after you allow it. The tag is excluded from profiles, search, application forms, accounts, bookings, consultations, chats and records. You can decline without affecting the service, or turn off analytics on an eligible page. Payments, hosted images, email and optional WhatsApp also involve service providers. See the privacy policy for what each workflow shares.

Consent is a record, not a checkbox

Every consent you give is stored as its own dated record: what it was for, when you gave it, and against which version of our policy. Withdrawing one consent, say WhatsApp reminders, does not disturb the others. A video consultation records its own separate consent, as telemedicine rules require.

Trace clinic access and corrections

Clinical views, edits and exports have audit events. Clinical and receipt corrections preserve previous versions after the revision migration is installed. Production log retention, alerting and operator access need separate controls; an application audit table is not a tamper-proof compliance certification.

Clinics see only their own patients

A clinic's access is scoped to appointments at that clinic, enforced inside every database query, not just hidden in the interface. Our own platform administration deliberately does not include browsing patient lists.

Separate online sign-in from the clinic vault

Online sign-in uses one-time links and hashed session tokens. The independent vault instead uses a clinic passphrase with PBKDF2-SHA256 and AES-256-GCM authenticated encryption. That passphrase is not sent to DocZen. It cannot be reset by support; the clinic must keep a separate recovery copy.

Your card and UPI details never touch our servers

Online payments run inside Razorpay's own secure checkout. We receive a confirmation that a payment happened, never the instrument you paid with. When a paid consultation is cancelled, we request a refund through Razorpay and track its status. Provider failures require reconciliation, so a refund is not guaranteed to complete at cancellation.

Reviews are tied to completed visits

Only the account that booked a completed appointment can leave its review. We do not display the account holder's name beside it. Written comments are published after moderation, so please leave out details that could identify you or someone else.

We do not sell data. To anyone. In any form.

Patient records are not sold, rented, used for advertising or supplied for AI training. Limited processing by contracted infrastructure, messaging and payment providers is necessary for the online service. Required legal disclosures remain possible. See the privacy policy for these distinctions.

What we do not claim

We do not currently hold an ISO 27001 certification, and we do not display a HIPAA badge or claim a completed legal compliance audit. Applicable law depends on the service and the parties involved. The controls above do not replace legal review or independent security testing. If we obtain a formal certification, it will appear here with the certificate itself, not just the logo.

Questions about your data, or a request to see or erase it, are handled through the contact on our privacy policy page. We answer those personally.