Privacy Policy

Effective Date: 9 October 2026
Last Updated: 9 October 2026

This policy describes how OPD.Care handles personal data. Clinics using the product also have duties under:

Indian IT Act, 2000
SPDI Rules, 2011 (Sensitive Personal Data Rules)
Digital Personal Data Protection Act, 2023
Indian Medical Association’s ethical patient confidentiality guidelines

This Privacy Policy outlines how we collect, process, secure, and share your information while using OPD.Care services.

1. Applicability

This policy applies to doctors, hospitals, clinics, and healthcare professionals; patients and users of OPD.Care; and any third party handling personal or health information through OPD.Care.

2. Definitions

Personal Data: Identifiable information such as name, contact, email, etc.
Sensitive Personal Data (SPDI): Includes health records, biometric data, and financial information.
Processing: Any operation performed on personal data, such as collection, usage, storage, or deletion.
Health Information: Medical history, symptoms, consultation notes, reports, etc.

3. Data Collection

We collect information:

Directly from users during registration, consultation, and form submissions.
Through third-party integrations (e.g., labs, payment gateways).
Automatically via cookies, IP logs, and usage analytics.

Types of data:

Personal Info: Name, gender, contact, address, ID
Health Data: Records, prescriptions, history, allergies
Payment Info: Transaction IDs, billing logs (no card/CVV stored)
Device Info: IP, device ID, logs

4. Purpose of Processing

We use your data to:

Provide medical and appointment services
Maintain accurate medical records
Send reminders and alerts
Improve the product using analytics that do not include the patient’s name
Fulfill regulatory or legal obligations

5. Consent Management

On this website, non-essential cookies are used only after you opt in. The clinic app does not yet record a separate consent checkbox before a staff member saves a patient chart.
Consent can be withdrawn at any time, as easily as it was given: use “Cookie settings” in the footer for cookies, or write to privacy@opd.care for other data.
Withdrawal may restrict access to some features or services.

6. Security Measures

The product uses these safeguards today:

HTTPS/TLS for data in transit in production
Role-based access, with each clinic limited to its own records
Hashed passwords and hashed one-time login codes
An audit record when a patient, prescription, bill or lab report is created, updated or deleted
Lab files stored on a private disk, and public share links that expire after 7 days

Chart text is not encrypted inside the database. Multi-factor authentication, a SOC 2 report, and an ISO 27001 certificate are not in place. OPD Care has not published a penetration-test report.

7. Data Sharing and Disclosure

We DO NOT sell your data.

We share data only with:

Authorized doctors and clinics (with consent)
Diagnostic labs and partners (with consent)
Payment processors (PCI-DSS compliant)
Government authorities, if legally required

8. Data Retention Policy

Medical records: Kept for clinic care and for as long as the law requires. The product does not yet run an automatic retention or anonymization job.
Deletion requests: Email privacy@opd.care. Deleting a patient in the app removes the record and stored lab files. Some billing history may still need to be kept for tax reasons.
Billing: Retained as required for tax and accounting.

9. Cross-Border Data Transfers

Clinic records are stored in the application database. Product analytics may be processed by our analytics provider, which can be outside India. We do not sell clinic or patient data.

10. User Rights

Under Indian law and the DPDP Act, users can:

Access their personal data
Correct or update inaccuracies
Request deletion (subject to legal exceptions)
Withdraw consent
Request data portability
Lodge grievances

Requests can be sent to: privacy@opd.care.

11. Children’s Privacy

Users under 18 must have parental consent.
We do not knowingly collect data from minors.

12. Cookies & Tracking

We use cookies for:

Authentication and session management
Usage analytics and performance tracking (only with your consent)

You can manage your choices at any time via “Cookie settings” in the footer or in your browser settings. See our Cookie Policy for details.

13. Grievance Officer

Name: Mayur Lohar
Email: grievance@opd.care
Phone: +91 6358 150 818
Address:
410, Nilambar Primo, beside Nilambar Triumph, Gotri–Bansal Road.
Response Time: Within 7 business days

14. Policy Updates

We may update this policy periodically.
Major changes will be notified via email or in-app alerts.

15. Governing Law & Jurisdiction

This policy is governed by the laws of India.
Jurisdiction lies with the courts of Vadodara, Gujarat.