How we handle your information

01 - Overview

Door to Care ("we," "us," "our") uses this appointment booking and clinic management system to run our practice. This policy explains what information we collect when you book an appointment or interact with this site, how we use it, and the choices you have.

02 - Information we collect

When you book an appointment, we collect:

• Your name and phone number (required)
• Your email address (optional, used to send booking confirmations)
• Visit type and any notes you choose to share for the doctor
• If someone books for you (for example a parent for a child), their name and relationship to you
• For home sample collection, the address you give

If you visit us and a receipt is generated, we also record the services or medicines billed and the payment method used. We do not collect or store payment card details ourselves — online payments, when enabled, are processed directly by Razorpay, a licensed payment gateway.

03 - How we use your information

We use the information you provide to:

• Schedule, confirm, and manage your appointments
• Send you a booking confirmation
• Generate billing receipts for services and medicines provided
• Maintain your records for continuity of care (the doctor's notes, prescriptions, tests and follow-ups)
• Remind you of follow-ups and vaccinations you are due for, if you gave an email
• Keep a record of when you agreed to this notice and of your email choices

We do not sell your information, and we do not use it for advertising or marketing by third parties.

04 - How we protect your information

Your data is stored with Supabase, a secure database provider, in India (Mumbai), with these safeguards:

• All connections are encrypted (HTTPS), and the database is encrypted on disk
• Only our approved staff can see patient records, and each person sees only what their role needs
• Staff sign in with their Google account or their own password (stored only as a one-way hash, never readable); the clinic owner also uses a second-step code
• Every view, change, deletion and export of records is logged with who did it and when, and the log is kept for at least a year
• Data from different clinics on the system is kept strictly separate

05 - How long we keep your information

We keep patient, visit and billing records for at least 3 years from your last visit, as Indian medical record rules require, and longer where tax law requires it. After that we review them and delete or anonymise what is no longer needed. You can ask us to remove your records sooner; we will do so unless the law requires us to keep them.

06 - Your rights

Under India's Digital Personal Data Protection Act, 2023, you can:

• Ask what personal data we hold about you, and get a copy
• Ask us to correct or update it
• Ask us to delete it, subject to the record-keeping rules above
• Stop our emails at any time: every email has an Unsubscribe link, or tell us
• Name someone to exercise these rights for you
• Complain to our grievance contact (section 08), and if you are not satisfied, to the Data Protection Board of India

For a child, a parent or guardian books for them and can use these rights for them. We may ask you to confirm who you are before we act. We reply to requests within 30 days, and always within 90 days.

07 - Service providers we use

Each receives only the information it needs for its job:

• yaanee — the software that runs this booking and clinic system for us
• Supabase — database and staff sign-in
• Vercel — website hosting
• Resend — sending booking confirmation emails
• Google — staff sign-in, for staff who choose it
• Razorpay — online payments, when enabled (we never see or store card details)

Some providers may process data outside India, as Indian law permits.

08 - Grievance contact

For questions about this policy, to use your rights, or to complain, contact:

Door to Care Phone: (+91) 9999037144

09 - If something goes wrong

If your personal data is ever exposed in a security incident, we will tell you without delay — what happened, what it means for you and what we are doing about it — and report it to the Data Protection Board of India and CERT-In as the law requires.

10 - Changes to this policy

We may update this policy when our practices or the law change. The "last updated" date at the top always shows the latest version.