Privacy Policy

Effective Date: March 15, 2026
Last Updated: November 1, 2026
Version: 1.0
Data Fiduciary: DOCWO SERVICES PRIVATE LIMITED
Registered Office: Building No. 5/257A8, Suite No. 162 B, Heiley Offices, Basement Floor, Pallath Square, Kalamassery, Ernakulam, Kanayannur, Kerala, India, 683104
Contact / Privacy Office: privacy@docwo.com | +91 99614 53665

1. Introduction and Scope

DOCWO SERVICES PRIVATE LIMITED ("Docwo", "We", "Us", or "Our") recognizes the importance of privacy, confidentiality, and data security. This Privacy Policy ("Policy") explains how we collect, process, store, protect, and disclose personal data, including health data, when you access or interact with our websites, web applications, mobile applications, APIs, clinic management portals, and the Docwo TV waiting-room display application (together, the "Platform").

This Policy is formulated in compliance with:

The Digital Personal Data Protection Act, 2023 ("DPDPA") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules");
The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
Directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B of the IT Act.

Our security and privacy practices are also designed with reference to international frameworks, including the EU General Data Protection Regulation (GDPR) and the US Health Insurance Portability and Accountability Act (HIPAA). Where you use the Platform from outside India, you may have additional rights under the laws of your country, which we will honour as required.

2. Roles: Data Fiduciary and Data Processor

Docwo as Data Fiduciary: For user accounts, authentication, billing records, device identifiers, notification preferences, marketing preferences, and Platform usage and security telemetry, Docwo determines the purpose and means of processing and acts as the Data Fiduciary (the "Data Controller" under GDPR).
Docwo as Data Processor: For clinical consultation notes, diagnostic findings, treatment plans, e-prescriptions, and clinic queue records created by or for an independent clinic or medical practitioner, the respective Clinic or Doctor is the Data Fiduciary, and Docwo processes that data on its behalf as a Data Processor, providing secure hosting, transmission, and software services under contract.

3. Categories of Data Collected

We collect only the data necessary to provide healthcare appointment, clinic queue, and clinic management services.

3.1 Personal Data

Identity & Contact Details: Full name, mobile phone number, email address, physical address, date of birth, gender, and profile image.
Sign-in Details: One-Time Password (OTP) verification records and, where you choose to sign in with Google, the basic profile information Google shares with us (name, email address, and profile image).

3.2 Health Data (Sensitive Personal Data)

Clinical Details: Reason for consultation, reported symptoms, vital signs, clinical notes, medical history you upload, diagnostic reports, and e-prescriptions.
Queue and Appointment Records: Doctor selected, clinic location, appointment date and slot, token number, check-in status, and consultation timestamps.

3.3 Financial and Transactional Information

Billing Details: Clinic invoices, consultation fee breakdown, platform convenience fees, payment status, and Razorpay transaction, order, and refund identifiers.
Important: Docwo never collects or stores full credit/debit card numbers, CVVs, UPI PINs, or net banking credentials. All payments are processed directly by our PCI-DSS certified payment partner, Razorpay.

3.4 Technical, Device, and Usage Data

Device & Connection: IP address, browser type and version, operating system and version, device model, time zone, app version, and session information.
Push Notification Tokens: Firebase Cloud Messaging (FCM) device tokens used only to deliver queue updates, appointment alerts, and other notifications you have not opted out of.
Cookies and Similar Technologies: See Section 6.

3.5 Docwo TV Waiting-Room Displays

Clinics may show their live queue on a television in the waiting room using the Docwo TV application or a web browser. For these displays:

What the TV shows: Token numbers, queue status (such as the token now being served, upcoming tokens, missed tokens, and the number of people waiting), doctor names and specialties, room labels, and doctor break or availability status. The TV never displays patient names, contact details, or any health information. Because the screen is visible to everyone in the waiting room, clinics must not enter patient information into doctor names or room labels.
What we collect from the TV: A unique device token issued when the TV is paired with a clinic, the app version, TV model, operating system version, the text-to-speech languages available on the TV, the time the TV was last connected, and the IP address used to connect.
Purpose: To show the clinic's queue on the correct screen, keep the display up to date, let the clinic see and manage its displays, announce token calls in the chosen language, and keep the service secure.
No personal accounts on the TV: No individual signs in on the TV, and the Docwo TV application contains no advertising, analytics, or tracking libraries.
Removing a display: When a clinic removes a display in the Docwo dashboard, the TV's device token is revoked immediately and the TV can no longer receive any data. The clinic may ask us to delete the related device details at any time.

3.6 Security Controls (Summary)

All data is protected through multiple layers of security, described in Section 5, including field-level encryption of personal, health, and financial data at rest, encryption of all data in transit, and hashed (blind) indexes for searching phone numbers and email addresses.

4. Purposes and Legal Grounds for Processing

We process personal data only for lawful purposes, on the basis of your consent or for legitimate uses permitted under Sections 6 and 7 of the DPDPA (and, where GDPR applies, Articles 6 and 9 GDPR):

Purpose of Processing	Category of Data	Legal Basis
Account Creation & Authentication	Name, Phone, Email, OTP, Google sign-in data	Consent; performance of our Terms of Service
Appointment Booking & OPD Token Queueing	Patient Name, Doctor, Slot Time, Token	Consent; performance of contract
E-Prescriptions & Medical Records Storage	Health Data, Symptoms, Prescriptions	Explicit consent; provision of healthcare services
Payment Processing & Invoicing	Fee amounts, Razorpay identifiers	Performance of contract; compliance with tax laws
Queue Alerts & Transactional Notifications	Phone, Email, FCM Device Tokens	Consent; performance of contract
Waiting-Room TV Displays	Token numbers, queue status, TV device data	Legitimate use requested by the clinic; performance of contract
Fraud Prevention & Security Monitoring	IP Address, User Agent, Activity Logs	Compliance with law (including CERT-In directions); security
Marketing & Health Campaigns (Optional)	Email, Phone	Separate, explicit, opt-in consent that you can withdraw

We do not use your health data for advertising, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

5. Security Safeguards and Technical Measures

Docwo maintains reasonable security safeguards as required by Section 8(5) of the DPDPA, the DPDP Rules, and Rule 8 of the SPDI Rules, with controls aligned to the ISO/IEC 27001 standard:

Field-Level Database Encryption: Sensitive fields (such as patient names, contact numbers, symptoms, clinical notes, and prescriptions) are encrypted at rest using AES-256-GCM.
Key Management: Encryption keys are held in a managed cloud key-management service (Microsoft Azure Key Vault), separate from the application data, with access restricted to authorised services and periodic key rotation.
Encryption in Transit: All communication between your device, our servers, and our service providers uses TLS 1.2 or higher, with HTTPS enforced.
Blind Indexing for Search: Phone numbers and email addresses are searched using keyed, hashed indexes, so they are not exposed in plaintext during database queries.
Role-Based Access Control (RBAC): Least-privilege access separates patients, clinic staff, doctors, and system administrators. Clinic staff can access only their own clinic's records.
Logging and Monitoring: Access to personal data and security events are logged and monitored to detect and investigate unauthorised access.
Privacy-Safe Notifications: Notifications shown on device lock screens and waiting-room TVs never contain health information. They show only generic queue information (for example, "Your token #14 has been called"); details are available only after you sign in.

No method of transmission or storage is completely secure, but we continuously review and improve these safeguards.

6. Cookies and Similar Technologies

Our websites and web applications use cookies and similar browser storage that are strictly necessary to keep you signed in, protect your session, remember your preferences, and keep the service secure. A waiting-room display opened in a web browser stores its device token in the browser so it stays paired. We do not use third-party advertising cookies. You can clear or block cookies in your browser settings, but parts of the Platform may then stop working.

7. Data Sharing and Third-Party Processors

Docwo never sells, rents, or monetises your personal or health data. We share data only as follows, and with service providers only under written contracts that require them to protect it and use it solely on our instructions:

Clinics and Doctors You Choose: The clinic and medical practitioner you book with receive your patient profile, symptoms, and relevant consultation history to provide your care. Clinics also see the device details of their own waiting-room displays.
Payments (Razorpay): Transaction amounts and order details, to process payments, settlements, and refunds.
Cloud Infrastructure and Security: Amazon Web Services (AWS) and Microsoft Azure for encrypted databases, application hosting, file storage, and key management; Cloudflare for network security and content delivery.
Communication Services:
- Postmark: Transactional emails and digital invoices.
- MSG91 and Twilio: SMS messages and OTP verification, sent through Telecom Regulatory Authority of India (TRAI) approved DLT templates for Indian numbers.
- Firebase Cloud Messaging (Google): Mobile push notifications.
Sign-in Services (Google): If you choose to sign in with Google, Google authenticates you and shares basic profile information with us.
Monitoring Services (Microsoft Azure Application Insights): Application performance and error monitoring, configured to exclude health information.
Legal Requirements: We may disclose information when required by law, a court order, or a lawful request from a government authority, including under Section 69 of the IT Act, 2000, and only to the extent required.
Business Transfers: If Docwo is involved in a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity, which will remain bound by this Policy.

8. Data Storage and Cross-Border Transfers

We primarily store and process personal data on servers located in India. Some service providers listed in Section 7 may process limited data outside India (for example, to deliver email or push notifications). Any such transfer is made in accordance with Section 16 of the DPDPA and the DPDP Rules, is never to a country restricted by the Government of India, and is protected by contractual and technical safeguards equivalent to those described in this Policy.

9. Your Rights as a Data Principal

Under the DPDPA (Sections 11 to 14) and, where applicable, the GDPR (Articles 15 to 22), you have the following rights:

Right to Access: Obtain a summary of the personal data we hold about you, the processing we carry out, and the identities of the data fiduciaries and processors with whom it has been shared.
Right to Correction and Completion: Correct, complete, or update inaccurate or incomplete personal data, including through your profile settings.
Right to Erasure: Request deletion of your account and personal data, in accordance with our Account Deletion and Retention Policy and subject to retention required by law (Section 10).
Right to Withdraw Consent: Withdraw consent at any time, as easily as you gave it, through the Preference Centre, the unsubscribe link in our messages, or by contacting us. Withdrawal does not affect processing carried out before it, and we stop the related processing promptly.
Right to Nominate: Nominate an individual to exercise your rights on your behalf in the event of your death or incapacity (Section 14 of the DPDPA).
Right to Grievance Redressal: Have your grievances addressed by our Grievance Officer (Section 12), and, if you are not satisfied, approach the Data Protection Board of India.

You can exercise these rights by writing to privacy@docwo.com or through the options in the app. We may need to verify your identity before acting on a request. We acknowledge requests within forty-eight (48) hours and resolve them within fifteen (15) business days, or sooner where required by law.

10. Children's Personal Data

Individuals below the age of eighteen (18) may not create primary accounts or give consent on their own.
A child's health information may be processed only when provided by a parent or lawful guardian through a Dependent Profile, which constitutes verifiable consent of the parent or guardian under Section 9 of the DPDPA and the DPDP Rules. The parent or guardian confirms that they have the lawful authority to do so.
Docwo never tracks, behaviourally monitors, or targets advertising at children, or uses children's data for such purposes.

11. Data Retention and Deletion

We keep personal data only for as long as needed for the purposes in this Policy, or for longer where the law requires us to:

Data Classification	Active Period	Archive	Total Retention	Disposal Method
User Profile & Credentials	Account lifetime	30 days (soft delete)	Deleted 30 days after a deletion request	Cryptographic erasure and hard deletion
Medical Records & Prescriptions	2 years	8 years	Up to 10 years, in line with medical record-keeping requirements and limitation periods	Encrypted archive, then secure deletion
Invoices & Billing Transactions	2 years	6 years	8 years (Income Tax Act and GST law)	Secure electronic archive, then deletion
Security & Audit Logs	1 year	Up to 6 years	At least 1 year (DPDP Rules and CERT-In directions), up to 7 years	Automated permanent deletion
Waiting-Room TV Device Details	While the display is active	None	Until the clinic removes the display and asks for deletion	Hard deletion
Session Cache & Exported Files	7 days	None	7 days	Automated daily deletion

Where data is processed on behalf of a clinic, the clinic may instruct us on retention, subject to applicable law.

12. Personal Data Breach Notification

If a personal data breach occurs:

We activate our incident response plan to contain, investigate, and remediate it.
We report cyber security incidents to CERT-In within six (6) hours of becoming aware of them, as required by CERT-In directions.
We notify the Data Protection Board of India without delay, followed by a detailed report within seventy-two (72) hours, as required by the DPDP Rules.
We inform affected Data Principals without delay, in plain language, describing the nature of the breach, its likely consequences, the measures we have taken, and the steps you can take to protect yourself.

13. Changes to This Policy

We may update this Policy to reflect changes in our services or the law. We will publish the updated version on the Platform with a new effective date and, for material changes, notify you in the app or by email and, where required, ask for your consent again.

Last updated November 1, 2026: added the Docwo TV waiting-room displays (Section 3.5), cookies (Section 6), cross-border transfers (Section 8), and the DPDP Rules, 2025; updated our list of service providers; and updated retention periods and breach notification timelines.

14. Grievance Officer and Contact

For any questions, requests, or complaints about this Policy or our handling of your data, contact our Grievance Officer:

Officer: Grievance Redressal Officer & Data Protection Lead
Company: DOCWO SERVICES PRIVATE LIMITED
Office Address: Building No. 5/257A8, Suite No. 162 B, Heiley Offices, Basement Floor, Pallath Square, Kalamassery, Ernakulam, Kanayannur, Kerala, India, 683104
Privacy Email: privacy@docwo.com
Grievance Email: grievance@docwo.com
Helpline: +91 99614 53665 (Monday to Saturday, 10:00 AM to 6:00 PM IST)

Response Commitment:

Acknowledgement within forty-eight (48) hours.
Written resolution within fifteen (15) business days.

If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India.