Privacy Policy

Effective Date: October 9, 2026
Last Updated: October 9, 2026

OPD.Care (“we”, “our”, “us”) is a healthcare technology provider committed to ensuring the highest standards of privacy, data protection, and information security in compliance with:

Indian IT Act, 2000
SPDI Rules, 2011 (Sensitive Personal Data Rules)
Digital Personal Data Protection Act, 2023
ISO/IEC 27001:2013 (Information Security)
Indian Medical Association’s ethical patient confidentiality guidelines

This Privacy Policy outlines how we collect, process, secure, and share your information while using OPD.Care services.

1. Applicability

This policy applies to doctors, hospitals, clinics, and healthcare professionals; patients and users of OPD.Care; and any third party handling personal or health information through OPD.Care.

2. Definitions

Personal Data: Identifiable information such as name, contact, email, etc.
Sensitive Personal Data (SPDI): Includes health records, biometric data, and financial information.
Processing: Any operation performed on personal data, such as collection, usage, storage, or deletion.
Health Information: Medical history, symptoms, consultation notes, reports, etc.

3. Data Collection

We collect information:

Directly from users during registration, consultation, and form submissions.
Through third-party integrations (e.g., labs, payment gateways).
Automatically via cookies, IP logs, and usage analytics.

Types of data:

Personal Info: Name, gender, contact, address, ID
Health Data: Records, prescriptions, history, allergies
Payment Info: Transaction IDs, billing logs (no card/CVV stored)
Device Info: IP, device ID, logs

4. Purpose of Processing

We use your data to:

Provide medical and appointment services
Maintain accurate medical records
Send reminders and alerts
Improve platform services via analytics (de-identified)
Fulfill regulatory or legal obligations

5. Consent Management

Explicit and informed consent is obtained before collecting sensitive data.
Consent can be withdrawn at any time by the user.
Withdrawal may restrict access to some features or services.

6. Security Measures

We implement ISO 27001 compliant practices:

AES-256 encryption (data at rest)
HTTPS/TLS encryption (data in transit)
Role-based access controls (RBAC)
OTP-based authentication
Secure audit logs and backups
Periodic VAPT and risk audits

7. Data Sharing and Disclosure

We DO NOT sell your data.

We share data only with:

Authorized doctors and clinics (with consent)
Diagnostic labs and partners (with consent)
Payment processors (PCI-DSS compliant)
Government authorities, if legally required

8. Data Retention Policy

Medical records: Stored for minimum 3 years or as legally required.
Deleted accounts: Data is securely erased or anonymized unless required for legal/tax purposes.
Billing: Retained as per tax compliance.

9. Cross-Border Data Transfers

Currently, data is stored within India.

If transferred outside India:

Only to countries with adequate protection
With user consent and legal safeguards

10. User Rights

Under Indian law and the DPDP Act, users can:

Access their personal data
Correct or update inaccuracies
Request deletion (subject to legal exceptions)
Withdraw consent
Request data portability
Lodge grievances

Requests can be sent to: privacy@opd.care.

11. Children’s Privacy

Users under 18 must have parental consent.
We do not knowingly collect data from minors.

12. Cookies & Tracking

We use cookies for:

Authentication and session management
Usage analytics and performance tracking

You may disable cookies in your browser settings.

13. Grievance Officer

Name: Mayur Lohar
Email: grievance@opd.care
Phone: +91 6358 150 818
Address:
410, Nilambar Primo, beside Nilambar Triumph, Gotri–Bansal Road.
Response Time: Within 7 business days

14. Policy Updates

We may update this policy periodically.
Major changes will be notified via email or in-app alerts.

15. Governing Law & Jurisdiction

This policy is governed by the laws of India.
Jurisdiction lies with the courts of Vadodara, Gujarat.