Privacy Policy

A product of WeMoDa Solutions Pvt Ltd

Last updated: October 2026

This page is translated for convenience. If the translation differs from the English text, the English text applies.

This Privacy Policy applies to ClinicDrs, developed and operated by WeMoDa Solutions Pvt Ltd ("we", "us", "our"). It explains how we collect, use, store, and protect personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA).

1. Data We Collect

Clinic Data: Clinic name, address, phone, staff details, service catalog, billing records.

Patient Data (collected by clinics): Name, phone number, age, gender, visit history, vitals, prescriptions, billing records.

Video Consultation Data: When a clinic holds a video consultation, the call's audio and video pass through ClinicDrs's own video servers in India. If the clinic records the consultation with the patient's consent, the recording is stored as part of the patient's record.

Technical Data: IP address, device type, browser, usage analytics.

2. How We Use Data

We process data solely to provide clinic management services: appointment management, billing, prescription generation, WhatsApp communication, and analytics. We do not sell personal data to third parties.

3. Data Storage & Security

All clinic data is stored in India: application and PostgreSQL on DigitalOcean in Bangalore (BLR1), and clinical files in AWS S3 Mumbai (ap-south-1). We use encrypted connections (TLS) in transit, encryption at rest, PostgreSQL Row-Level Security policies enforced at the database layer for tenant isolation, and AES-256-GCM application-level encryption for our most sensitive patient data fields.

4. Video Consultations & Recordings

Video calls. Video consultations run on servers operated by ClinicDrs in India. Patients join through a secure link sent by their clinic; no separate video account or app is needed. Call audio and video are encrypted in transit between each participant's device and our servers. We do not use third-party video-calling services, and we do not route consultation calls through servers outside India.

Recording is optional and needs your consent. A consultation is recorded only if your clinic has turned recording on, and only after you agree on your call page, separately for each consultation. Agreeing once does not cover future consultations. While a recording is in progress, both you and the doctor see a recording indicator, and you can stop the recording at any time during the call. If you stop it, that recording is discarded and is not saved.

Where recordings are kept. A saved recording is stored in your clinic's record on our storage in India (AWS Mumbai). Only authorised staff of your clinic can access it.

Transcripts. We do not create a written transcript or summary of a recording unless your clinic has turned this on. Where it is turned on, it is processed only on servers in India. Consultation recordings and transcripts are never sent to AI or transcription services outside India.

5. Your Rights (DPDPA 2023)

Under the DPDPA, you have the right to:

• Access: Request a copy of all your personal data
• Correction: Request correction of inaccurate data
• Erasure: Request deletion of all your data
• Portability: Export your data in machine-readable format (JSON)
• Withdraw Consent: Withdraw consent at any time
• Recordings: You can stop a recording during your call at any time. To ask for a recording that has already been saved to be deleted before its 30 days end, contact your clinic or our Grievance Officer.

To exercise these rights, contact your clinic administrator or email us at [email protected].

6. Children's Data

For patients under 18, we require verifiable parental consent as per DPDPA Section 9. Clinics are responsible for obtaining this consent before creating patient records for minors.

7. Data Sharing

We share data only with:

• WhatsApp (Meta): Phone numbers for message delivery
• MSG91: Phone numbers for OTP verification
• Razorpay: Payment processing
• ABDM: Health records (only with patient consent)

8. Data Retention

Patient records are retained for as long as the clinic maintains an active account, except for video consultation recordings. A recording is automatically and permanently deleted 30 days after it is saved, or sooner if the clinic has chosen a shorter period. Any transcript or summary made from it is deleted at the same time. Upon clinic account deletion, all data is erased within 30 days. Audit logs, which record that a consultation took place or that consent was given but contain no recording content, are retained for 7 years as required by Indian regulations.

9. Breach Notification

In the event of a data breach, we will notify the Data Protection Board and affected individuals within 72 hours as per DPDPA requirements.

10. Grievance Redressal

As required under Section 13 of the DPDPA 2023, we have appointed a Grievance Officer to address complaints about how your personal data is processed.

Grievance Officer: WeMoDa Solutions Pvt Ltd Data Protection Team

Email: [email protected]

To file a grievance, email the Grievance Officer with your name, contact details, the clinic involved (if applicable), and a description of your concern. We will acknowledge receipt within 48 hours and aim to resolve grievances within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

11. Contact

Data Protection Officer: [email protected]

WeMoDa Solutions Pvt Ltd, India