Privacy Policy

At Healthcare Diagnostic MC, we take your privacy seriously. This Privacy Policy explains what personal data we collect, how we use it, how we protect it, and your rights regarding your data. This policy is designed in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable Indian laws.

1. Data We Collect

We collect only the minimum personal data necessary to provide our services. This includes:

Patient Information

• Full name
• Phone number
• Email address
• Appointment history and scheduling details
• Queue and visit status

Clinic Information

• Clinic name and contact details
• Staff names and roles
• Department and service information
• Scheduling and operational data

We do not collect sensitive health records, medical diagnoses, prescriptions, or treatment notes through this platform.

2. Purpose of Data Collection

Your personal data is collected and processed only for specific, legitimate purposes:

• Appointment management — booking, rescheduling, cancellation, and reminders
• Queue tracking — showing your real-time position and estimated wait time
• Communication — sending appointment confirmations, reminders, and updates via email or SMS
• Clinic operations — helping the clinic manage daily workflow, patient flow, and scheduling
• Service improvement — understanding usage patterns to improve platform reliability and features

We do not use your data for advertising, profiling, or any purpose unrelated to the services described above.

3. Consent

By using this platform — including booking an appointment, checking your queue status, or submitting a contact form — you consent to the collection and use of your data as described in this policy.

You may withdraw your consent at any time by contacting us. However, withdrawal of consent may affect our ability to provide certain services to you (such as appointment reminders).

4. Data Storage & Security

Your data is stored in a secure, cloud-hosted database with the following protections:

• Encryption in transit — all data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security)
• Encryption at rest — data stored in our database is encrypted at rest
• Access controls — only authorized clinic staff and platform administrators can access patient data, limited to what is necessary for their role
• Cloud infrastructure — our database is hosted on a reputable cloud provider with enterprise-grade security, automated backups, and infrastructure monitoring

While we implement industry-standard security measures, no system is completely immune to breaches. In the unlikely event of a data breach, we will notify affected individuals and relevant authorities as required by law.

5. Data Retention

We retain your personal data as follows:

• Active accounts — your data is retained for as long as the clinic maintains an active subscription with the platform
• After clinic subscription ends — all patient data associated with that clinic is permanently deleted within 60 days of subscription cancellation
• Patient data on request — if you request deletion of your data, it will be removed within 60 days of the request
• Backups — data in automated backups is retained in line with our backup retention schedule and is permanently purged when the retention window expires

6. Data Sharing

We do not sell, rent, or trade your personal data. Your data may be shared only in the following circumstances:

• With the clinic — the clinic you are visiting has access to your appointment and contact data as needed to provide care
• Service providers — we use trusted third-party services for hosting, email delivery, and SMS notifications. These providers process data on our behalf under strict data processing agreements
• Legal requirements — we may disclose data if required by law, court order, or government authority

We do not share your data with other clinics, advertisers, or any unrelated third parties.

7. Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable law, you have the following rights:

• Right to access — you can request a copy of the personal data we hold about you
• Right to correction — you can request correction of inaccurate or incomplete data
• Right to erasure — you can request deletion of your personal data, subject to any legal obligations that require us to retain it
• Right to withdraw consent — you can withdraw your consent for data processing at any time
• Right to grievance redressal — you can raise concerns about how your data is handled

To exercise any of these rights, please contact us at care.hdmc@gmail.com. We will respond to your request within 30 days.

8. Cookies & Tracking

This platform uses only essential cookies required for the website to function (such as session management). We do not use advertising cookies, tracking pixels, or analytics tools that share data with third parties.

9. Children's Privacy

This platform is not intended for use by children under the age of 18 without parental or guardian supervision. We do not knowingly collect personal data from children without verifiable parental consent. If you believe a child's data has been submitted without proper consent, please contact us so we can take appropriate action.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated policy will be posted on this page with a revised "Last updated" date. We encourage you to review this page periodically.

11. Grievance Officer

In accordance with the DPDPA 2023, if you have any concerns about how your data is being processed, you may contact our Grievance Officer: care.hdmc@gmail.com.

We will acknowledge your grievance within 48 hours and resolve it within 30 days.

12. Contact

For any privacy-related questions or requests, please reach out to us at care.hdmc@gmail.com.