Privacy Policy

In this Privacy Policy, unless the context requires otherwise:

• “Company” means DocFollow Technologies Private Limited, a company incorporated under the Companies Act, 2013, having its registered office at 4-1-105, R K Nagar, Nawabpeta, Nellore – 524002, Andhra Pradesh, India.
• “App” means the DocFollow Doctor and DocFollow Patient mobile applications operated by the Company.
• “User” means any person who registers on or uses the App, and includes a User-Doctor, a User-Patient and a Clinic Staff member.
• “User-Doctor” means a medical practitioner registered with a State Medical Council or the National Medical Commission who uses the App.
• “User-Patient” means a patient, or a parent or lawful guardian acting on behalf of a patient, who uses the App to communicate with a User-Doctor.
• “Clinic Staff” means a receptionist or assistant authorised by a User-Doctor to register patients and upload records on the User-Doctor’s behalf.
• “Treating Doctor” means the User-Doctor with whom a User-Patient has an established connection on the App.

The App is a doctor-patient communication platform that enables a User-Patient to message the User-Patient’s Treating Doctor, and enables the Treating Doctor to view the User-Patient’s medical context alongside those messages.

For the purposes of the DPDP Act, 2023, the Company acts as a Data Fiduciary, and determines the purpose and means of processing personal data on the App.

Every User-Doctor is an independent medical practitioner registered with a State Medical Council or the National Medical Commission. Clinical decisions, diagnoses and prescriptions are the sole responsibility of the Treating Doctor. The Company provides the communication channel and record-keeping tools, and does not itself provide medical advice, diagnosis or treatment.

The App is not a directory or marketplace. It does not list, recommend or refer User-Patients to other doctors.

The Company collects only such personal data as is necessary to provide the App, in accordance with the principle of data minimisation.

3.1 From User-Doctors

3.2 From User-Patients

3.3 Health Data Recorded by User-Doctors

A Treating Doctor, or Clinic Staff authorised by the Treating Doctor, may record the following as part of clinical practice: medical history, current medications, allergies, diagnoses, prescriptions (including photographs of paper prescriptions), laboratory reports and private clinical notes.

Private clinical notes recorded by a User-Doctor are visible only to that User-Doctor and are never shown to the User-Patient.

The Company processes personal data only for the following purposes:

• operating the messaging service between a User-Patient and the Treating Doctor;
• displaying the User-Patient’s medical context to the Treating Doctor alongside a conversation;
• storing and retrieving prescriptions and health records;
• authenticating Users through one-time passwords;
• sending notifications about new messages;
• verifying the registration of User-Doctors;
• detecting misuse, preventing fraud and maintaining the security of the App; and
• complying with legal obligations under Indian law.

The Company does not use health data for advertising, does not sell it, and does not share it with pharmaceutical companies, insurers, employers or data brokers.

The Company processes personal data on the basis of the explicit, informed consent of the User, obtained separately for each distinct purpose as required by the DPDP Act, 2023 and the DPDP Rules, 2025. Where processing is necessary to comply with a legal obligation, including medical record-keeping obligations, the Company relies on that legal obligation.

A single consent to all terms is not treated as valid consent for health data. The Company therefore obtains separate and granular consent from each User for each distinct purpose.

6.1 Granular Consent at Registration

Consent is obtained as separate, individually selectable items. No item is pre-selected. Each item may be accepted or declined on its own, and declining an optional item does not prevent a User from using the core service.

Each consent is recorded individually for every User, with a timestamp, the version of this Privacy Policy in force at the time, and the exact wording shown to the User. A User may review and change optional consents at any time through Settings → Privacy → Manage Consent.

6.2 Withdrawal of Consent

A User may withdraw any consent at any time through Settings → Privacy → Manage Consent, or by writing to privacy@docfollow.in.

• Withdrawal of an optional consent disables only the corresponding feature; the rest of the App continues to function.
• Withdrawal of a required consent is treated as a request to close the account.
• On withdrawal, the Company stops the relevant processing and deletes the associated data, subject to the retention obligations set out in Section 11.

6.3 Connection Consent

Where a User-Patient’s mobile number matches a record created by a User-Doctor, the User-Patient is shown a confirmation screen identifying the User-Doctor and the clinic, and must expressly accept before any connection is established. Accounts are never connected automatically.

6.4 Secondary Use of Data

Data provided for communication between a User-Patient and the Treating Doctor is used solely for that purpose. The Company does not, directly or indirectly, use the identifiable data of User-Doctors or User-Patients for research, analytics, commercial insights or any other secondary purpose.

If the Company proposes to use anonymised or aggregated data for research or product development, it shall first obtain fresh, separate and explicit consent from the Users concerned. Declining such consent shall not affect a User’s use of the App. No such processing takes place until consent is given.

7.1 Location of Data

• All personal and health data is stored on cloud servers located in India.
• The Company uses [cloud provider — to be confirmed] data centres located in India.
• No health data of User-Patients is stored outside India.

7.2 Security Safeguards

• All data is encrypted in transit using TLS 1.2 or higher, and at rest using AES-256.
• Authentication is by one-time password; no passwords are stored.
• Role-based access ensures that a User-Doctor can access only the User-Doctor’s own patients, and a User-Patient can access only the User-Patient’s own records.
• Clinic Staff have restricted access and cannot read conversations between a User-Doctor and a User-Patient.
• Messages cannot be edited or deleted after they are sent, so that the record of each consultation remains accurate.
• Access to backend systems is limited to authorised personnel of the Company, and every such access is logged.
• No health data is cached on a User’s device in plain text, and sessions time out after 30 minutes of inactivity.
• The Company conducts periodic security reviews of its infrastructure.

7.3 Data Protection Impact Assessment

Health data is treated as high-risk processing. The Company shall conduct a Data Protection Impact Assessment before introducing any feature that materially changes how health data is processed, and before the App reaches a scale at which the Company may be notified as a Significant Data Fiduciary.

7.4 Personal Data Breach

In the event of a personal data breach, the Company shall inform the Data Protection Board of India and every affected User without undue delay, and shall submit a detailed report to the Data Protection Board within 72 hours, in accordance with the DPDP Rules, 2025. The Company shall take immediate steps to contain and remediate the breach and shall document the incident.

The Company, its employees and any person engaged by the Company shall keep all medical records, personal information, diagnoses and communications relating to a User-Patient strictly confidential. Such information shall not be disclosed, published or released to any third party except:

• with the express consent of the User-Patient;
• as strictly required or permitted by applicable law, such as public health reporting obligations or an order of a court or competent authority; or
• to the User-Patient’s Treating Doctor on the App, for the purpose of the User-Patient’s care.

All details provided by User-Doctors shall likewise be kept confidential.

This obligation of confidentiality between the Users and the Company shall survive the closure of any account and the termination of any agreement between a User and the Company.

The Company does not sell, rent or trade personal data. Personal data is shared only as follows:

The Company does not share health data with insurance companies, pharmaceutical companies, advertisers, data brokers, employers or any party not listed above.

Messages, prescriptions and health records exchanged between a User-Patient and the Treating Doctor constitute medical records of the Treating Doctor. Such records are retained for the period required under applicable medical record-keeping laws and regulations, including the Telemedicine Practice Guidelines, 2020 and the professional conduct regulations applicable to registered medical practitioners, even where a User-Patient closes the account. On expiry of that period, the records are deleted.

A User-Doctor who closes an account may export the User-Doctor’s records before closure. A User-Patient who closes an account ceases to have access to the App; consultation records held on behalf of the Treating Doctor are retained only as set out above.

The Company shall address every erasure request within the period prescribed under the DPDP Rules, 2025, and shall inform the User where any data must be retained under law, and for how long.

Where a User has consented to prescription images, the following process applies:

• the User-Doctor or authorised Clinic Staff photographs a paper prescription;
• the image is uploaded over an encrypted connection to the Company’s servers in India;
• the image is processed by an optical character recognition (OCR) service to read medicine names and dosages;
• the extracted text is shown to the User-Doctor for review and correction, and nothing is saved until the User-Doctor confirms it; and
• the original photograph is always retained as the authoritative record.

The OCR service is provided by Google Cloud, processing [within India / outside India — to be confirmed]. The provider acts as a Data Processor on the Company’s instructions under a data processing agreement, and does not retain images after processing or use them for its own purposes.

The App may hold health records of patients below 18 years of age, recorded by the Treating Doctor as part of clinical care.

• A person below 18 years of age cannot create an independent account. The account is created and used by a parent or lawful guardian.
• Before processing the data of a child, the Company obtains verifiable consent of the parent or lawful guardian, using a method approved under the DPDP Rules, 2025, and records the relationship.
• The Company does not track, monitor or profile children, and does not direct any targeted advertising at children.
• The Company does not process the data of a child in any manner likely to have a detrimental effect on the well-being of the child.

The Company relies on the following service providers. Each processes data on the Company’s instructions and not for its own purposes.

The App does not use cookies and does not track a User’s activity outside the App. Where a User has consented to service improvement, the Company collects anonymised, aggregated usage statistics that cannot identify any individual User.

Any grievance, complaint or issue relating to personal data shall, in the first instance, be addressed to the Grievance Officer:

• Name: Dr. J. Sreeharsha
• Designation: Founder and Director, DocFollow Technologies Private Limited
• Address: 4-1-105, R K Nagar, Nawabpeta, Nellore – 524002, Andhra Pradesh, India
• Email: privacy@docfollow.in
• Response time: Within 15 days of receipt of a complaint

A User who is not satisfied with the response of the Grievance Officer may approach the Data Protection Board of India in accordance with the DPDP Act, 2023.

• Users shall be notified within the App of any material change to this Privacy Policy.
• The “Last updated” date above shall be revised on every change.
• Where a change affects how health data is processed, the Company shall seek fresh consent rather than rely on continued use of the App.

• Company: DocFollow Technologies Private Limited
• CIN: U62011AP2026PTC127506
• Registered office: 4-1-105, R K Nagar, Nawabpeta, Nellore – 524002, Andhra Pradesh, India
• Email: privacy@docfollow.in
• Website: www.docfollow.in

Doctors can register on this website. The form asks for name, mobile number, email address, specialty, qualification, medical council and registration number, clinic name and address, a copy of the medical council registration certificate, and a copy of the doctor’s Aadhaar card as ID proof. Only our review team can open the certificate and the Aadhaar card.

This website is hosted by Cloudflare, which also checks that registration forms are sent by a person rather than a bot. Emails to doctors who register are sent through Resend.

This website does not use advertising or analytics cookies. It remembers whether you chose light or dark mode, in your own browser.