Privacy Policy

1. Scope of this policy

This Privacy Policy explains how [Legal entity name] ("NeedsDoctor", "we", "us") handles information about you when you use needsdoctor.com, including its ayurvedic, homeopathic and pharmaceutical sections and any dashboards for patients, doctors, hospitals, relationship managers and vendors.

We handle personal data in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under it — including the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011, under which health information is treated as sensitive personal data.

2. Information we collect

Information you give us

Information collected automatically

• Session cookies used to keep you signed in and to protect forms against cross-site request forgery.
• IP address, recorded when you attempt to sign in. We use it to rate-limit repeated failed login attempts and to protect accounts against brute-force attacks.
• Browser user-agent and basic request details, recorded with password-reset requests as a security measure.
• Server logs generated by our hosting provider in the ordinary course of operating the service.

3. Health information

If you choose to complete your health record, the platform can store a substantial amount of sensitive information about you, including:

• Vitals — temperature, pulse, blood pressure and respiratory rate, with the date recorded.
• Allergies — food, environmental, metal and medication allergies.
• Medication — drug, dose, route, frequency and start/end dates.
• Personal history — smoking, alcohol and substance use, and sexual health history.
• Family history — conditions recorded against relatives.
• Past diseases and procedures, and blood group.
• Medical images and reports you upload, such as scans and prescriptions.
• Prescriptions issued to you through the platform.

4. How we use your information

• To create and administer your account, and to verify your email address.
• To let you search for practitioners, hospitals and services, and to request, confirm, reschedule or cancel appointments.
• To make your health record available to you, and to a practitioner in the context of a consultation you have booked with them.
• To send transactional messages: verification links, password resets, appointment confirmations, status changes and reminders.
• To operate in-platform messaging, notifications and reviews.
• To power AI-assisted features you choose to use — see section 7.
• To keep the platform secure: detecting and preventing fraud, abuse and unauthorised access, and rate-limiting sign-in attempts.
• To produce aggregated, non-identifying statistics that help us understand and improve the service.
• To comply with law and to respond to lawful requests from a competent authority.

We do not sell your personal data. We do not share your health information with advertisers, and we do not use it for advertising or profiling.

5. Consent and legal basis

We process your personal data on the basis of the consent you give when you create an account, complete a form, or choose to use a particular feature — and, where applicable, for the legitimate uses permitted under the Digital Personal Data Protection Act, 2023, such as complying with a legal obligation or responding to a medical emergency.

Your consent is specific, informed and freely given, and you may withdraw it at any time (see section 11). Withdrawing consent does not affect processing already carried out, and may mean we can no longer provide parts of the service.

6. Who we share it with

We share your information only in the circumstances below.

Publicly visible information — such as a practitioner's professional profile, listed services and prices, and the text of reviews — is by its nature accessible to anyone using the platform.

7. AI-assisted features

The platform offers optional AI-assisted features, including a symptom checker, search assistance, summaries and chat assistants. These are powered by third-party AI providers ([confirm provider(s) in use — e.g. Anthropic and/or OpenAI]).

• The text you enter into an AI feature is transmitted to the AI provider so it can generate a response.
• We keep a record of these interactions — the input, the response, the model used, and your account or session identifier — so we can investigate problems, monitor quality and prevent misuse.
• AI features are optional. You never have to use them to book an appointment.

8. Cookies and tracking

We use a small number of cookies, principally a session cookie that keeps you signed in and dismissal cookies that remember when you close a banner. Full detail — including the third-party analytics and tag services present on some pages — is set out in our Cookie Policy.

9. How we protect information

The platform implements, among other measures:

• Passwords stored only as salted bcrypt hashes, never in readable form.
• HTTPS in transit, with HTTP Strict Transport Security.
• CSRF tokens on state-changing forms, and honeypot fields on public forms.
• Rate limiting on sign-in endpoints to resist brute-force attempts.
• Parameterised database queries throughout, to resist SQL injection.
• A Content Security Policy and related security headers.
• Access controls so that a user can reach only their own records, and single-use, time-limited password-reset tokens stored as hashes.

10. How long we keep it

• Account and health information — for as long as your account is active, and thereafter only as long as needed for a lawful purpose.
• Appointment and prescription records — retained for the period required by applicable medical-records and professional obligations. [Confirm the applicable retention period with your legal adviser.]
• Password-reset tokens — expire within an hour and are invalidated once used.
• Failed sign-in records — retained briefly for security, then cleared automatically.
• Notifications — cleared periodically once read and aged.

When you ask us to delete your account, we erase or irreversibly anonymise your personal data except where we are required to retain it by law, or where it is needed to resolve a dispute or enforce our agreements.

11. Your rights

Subject to applicable law, you have the right to:

• Access — obtain a summary of the personal data we hold about you and how it is processed.
• Correction — have inaccurate or incomplete data corrected or completed. Most of it you can edit yourself from your dashboard.
• Erasure — ask us to delete your personal data where we no longer need it for the purpose it was collected.
• Withdraw consent — at any time, as easily as you gave it.
• Nominate — nominate another individual to exercise your rights in the event of your death or incapacity.
• Grievance redressal — raise a complaint with us, and thereafter with the Data Protection Board of India.

To exercise any of these, write to info@needsdoctor.com. We may need to verify your identity first. We aim to respond within 30 days.

12. Children's information

The platform is intended for users aged 18 and over. We do not knowingly create accounts for children. A parent or lawful guardian may record information about a child in their own account for the purpose of that child's care; by doing so they confirm they are authorised to provide that information and the associated consent. We do not undertake tracking or behavioural advertising directed at children. If you believe a child has created an account independently, please contact us and we will remove it.

13. If you are a doctor, hospital or vendor

• Your professional profile — including name, qualifications, speciality, registration number, location, services, prices and ratings — is published publicly so patients can find you. Please do not enter anything in these fields you do not intend to publish.
• When you access a patient's information through the platform, you act as an independent controller of that information for your own clinical and record-keeping purposes, and you are responsible for handling it lawfully and confidentially.
• Documents you upload for verification are used only to review and approve your listing.

14. Storage and transfers

Data is stored on servers operated by our hosting provider. Some of our service providers — notably AI and email providers — may process data outside India. Where that happens, we take reasonable steps to ensure appropriate safeguards, consistent with the Digital Personal Data Protection Act, 2023 and any restrictions notified by the Central Government. [Confirm the hosting region and the list of cross-border processors with your legal adviser.]

15. Breach notification

If a personal data breach occurs, we will notify the Data Protection Board of India and each affected user in the manner and within the timeframes required by law, describing what happened, the likely consequences, and the steps we are taking.

16. Changes to this policy

We may update this policy. The revision date at the top of this page always reflects the current version, and where a change is material we will make reasonable efforts to notify you directly.

17. Grievance officer & contact

For any question about this policy, to exercise a right, or to raise a complaint about how your data has been handled, contact our grievance officer:

We aim to acknowledge within 48 hours and resolve within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.