[LEGAL COPY: SUBJECT TO FINAL ADVOCATE / LEGAL COUNSEL REVIEW]
This Privacy Notice is structured to fulfill technical and procedural notice obligations under Section 5 of the Digital Personal Data Protection Act, 2023 (DPDP Act, India). Organizations should obtain formal sign-off from their appointed legal counsel prior to final commercial publishing.
SwasthPro Digital Personal Data Privacy Notice
Effective Date: 30 August 2026 | Version: 1.0 | Applicable Jurisdiction: India
1. Introduction & Role as Data Fiduciary
SwasthPro Healthcare Technologies ("SwasthPro", "we", "us", "our") operates healthcare discovery, appointment management, doctor portals, and hospital administrative software. In relation to the personal data collected through our portals, mobile interfaces, and APIs, SwasthPro acts as a Data Fiduciary in terms of Section 2(i) of the Digital Personal Data Protection Act, 2023 (DPDP Act).
2. Categories of Digital Personal Data Collected
We collect personal data directly from Data Principals when they interact with our platforms:
A. Patients & Consultation Seekers
- Full Name, Mobile Number, Email Address
- Age, Date of Birth, Gender
- Chief Medical Complaint, Symptoms, Reason for Consultation
- Prescription uploads, Diagnostic Reports, Appointment History
B. Healthcare Professionals (Doctors)
- Doctor Name, Phone, Email Address
- State Medical Council / National Medical Commission Registration Number
- Specializations, Qualifications, Clinical Experience
- Professional Photo, ID Proof, Hospital Affiliation Details
C. Hospital Staff & Administrators
- Official Full Name, Corporate Email, Mobile Number
- Cryptographically Hashed Passwords, Role Permissions
- System Audit Logs, IP Addresses, Device Fingerprints
D. Platform Visitors
- IP Address, Browser Type, Operating System
- Search queries (Doctors/Specialities/Hospitals sought)
- Cookie & Consent preferences
3. Specified Purposes for Data Processing
Under Section 4 and Section 6 of the DPDP Act, personal data is processed solely for specified, lawful purposes:
- Service Delivery & Medical Appointments: Facilitating doctor discovery, scheduling video consultations, and transmitting appointment notifications.
- Practitioner Identity Verification: Validating medical licenses against statutory regulatory registers (MCI/NMC/State Councils) to protect patients against fraudulent practitioners.
- Patient Communications (With Opt-In): Sending appointment reminders, schedule confirmations, and emergency tele-consultation links via WhatsApp and SMS.
- Platform Security & Legal Compliance: Safeguarding systems against unauthorized intrusions, enforcing access control, and fulfilling statutory accounting regulations.
4. Data Retention & Erasure Schedule
Personal data is retained only for the duration necessary to satisfy the purpose for which it was collected, or as mandated by Indian statutory regulations:
| Data Category | Retention Period | Statutory Ground |
|---|---|---|
| Clinical Records & Consultation Logs | 3 Years minimum from consultation | National Medical Commission (NMC) Regulations |
| Billing & Invoices | 7 Years from end of financial year | Income Tax Act & GST Compliance |
| User Account & Profile Details | Duration of active account + 30 days post erasure request | DPDP Act Section 12 (Right to Erasure) |
| Audit & Security Logs | 180 Days rolling window | CERT-In Cybersecurity Directives |
5. Third-Party Processors & Data Transfers
We engage vetted Data Processors under contractual data protection agreements:
- Cloud Infrastructure: Google Cloud Platform (GCP) — Data stored within sovereign Indian Data Center regions (Mumbai / Delhi).
- Communications: Meta WhatsApp Business Graph API for transactional appointment alerts.
- Tele-Health Video: Zoom Video Communications for encrypted peer consultation rooms.
6. Rights of Data Principals under DPDP Act 2023
As a Data Principal under Indian Law, you possess the following enforceable rights:
- Section 11 — Right to Access: Request a summary of personal data processed, identities of third parties with whom data was shared, and description of processing activities.
- Section 12 — Right to Correction & Erasure: Request updating of inaccurate or outdated information, or deletion of data no longer required for statutory purposes.
- Section 6(4) — Right to Withdraw Consent: Withdraw previously given consent with ease comparable to how consent was provided.
- Section 14 — Right to Nominate: Nominate an individual to exercise your data rights in the event of death or incapacity.
7. Grievance Redressal Officer & DPO Contact
In compliance with Section 13 of the DPDP Act, SwasthPro has designated a Data Protection Officer (DPO) to handle inquiries and grievances:
Designation: Data Protection Officer & Grievance Redressal Officer
Entity: SwasthPro Healthcare Technologies Private Limited
Direct Email: grievance@swasthpro.com
Response Timeline: We acknowledge requests within 48 hours and provide complete statutory resolution within 30 calendar days.