Privacy Policy

1. Data we collect

Account data: name, email, phone, organisation, and role.

Clinical data (healthcare): patient records, appointment history, prescriptions, and consultation notes entered by clinics using the Service. This data is owned by the clinic ("Customer Data") and processed on their behalf.

Usage data: log entries, device type, IP address, timestamps, and feature interactions.

Communications: SMS OTP codes and push notifications for appointment reminders and prescription delivery.

2. How we use it

• To provide the Service (authentication, core functionality).
• To support our customers (troubleshooting, account management).
• To improve the Service via aggregate analytics — never tied back to identifiable users in marketing materials.
• To meet legal obligations.

We do not sell personal data. We do not use Customer Data to train third-party AI models without explicit written consent.

3. How we share it

• Sub-processors: a current list lives at atrivextech.com.
• Legal: when required by law, with notice to the customer where we are permitted to give it.
• Business transfers: in the event of a merger or acquisition, with notice.

4. Health records and India's data-protection law

A clinic's records of your visits — notes, prescriptions, bills — are the clinic's. Under India's Digital Personal Data Protection Act, 2023, the clinic decides how they are used (it is the Data Fiduciary) and AtriVex processes them on the clinic's behalf, only to run DoctorLync (as its Data Processor). Your patient-app account itself — your phone number and the details you add to your profile — is held by AtriVex.

Records are encrypted in transit (TLS 1.2+) and at rest. Each staff member sees only what their role needs, and views and changes of records are logged. A clinic keeps medical records for as long as the law requires of it; Indian Medical Council regulations ask for at least three years.

4a. ABHA and ABDM

Clinics using DoctorLync can take part in the Ayushman Bharat Digital Mission (ABDM), run by the National Health Authority.

• Creating or verifying an ABHA: with your agreement, clinic staff can create an ABHA using your Aadhaar number, or verify an existing ABHA, by a one-time password sent to your mobile. The Aadhaar number is sent encrypted to the National Health Authority and is not stored by DoctorLync. The ABHA number and address are kept on your record at that clinic.
• Your records in your ABHA app: visits at the clinic are linked to your ABHA address so you can see them in your ABHA app.
• Sharing with other doctors: records are shared with another hospital, lab or doctor only when you approve their request in your ABHA app. You can withdraw that consent there at any time. The clinic can see who received records and when.

5. Where your data is kept

DoctorLync's data is stored in India, on Amazon Web Services in Mumbai. Encrypted backup copies are also kept in Hyderabad, so they never leave India either. The services that deliver messages and video calls for us (section 3) handle only what they need to deliver them.

6. Retention

• Active accounts: data is kept as long as the account is active.
• Closed accounts: Customer Data is deleted within 30 days of account closure, except where law requires longer retention.
• Backups: any second of the last 35 days can be restored. Nightly and monthly backup copies are kept encrypted for up to 7 years, and weekly copies in Hyderabad for 35 days, then deleted. Data deleted from DoctorLync remains in these copies until they expire, and is used only to recover a clinic's records.

7. Your rights

You can:

• Access your data (export from Settings → Account, or email support@atrivextech.com).
• Correct your data (Settings → Account).
• Delete your patient account in the app (Profile → Delete account) or at doctorlync.com/delete-account. Clinics keep their own medical records of your visits, as the law requires.
• Withdraw consent, or ask us to stop or restrict processing (email support@atrivextech.com).
• Nominate someone to exercise these rights for you if you cannot.
• Raise a grievance with us at support@atrivextech.com, and, if it is not resolved, complain to the Data Protection Board of India.

We respond within 30 days. For records a clinic holds, we pass your request to that clinic, which decides it.

8. Security

We use TLS 1.2+ in transit, encryption at rest, role-based access controls, MFA for admin roles, audit logging, and regular security reviews. Report vulnerabilities to support@atrivextech.com.

9. Children

The patient app is for adults. A child's appointments and records are managed by a parent or guardian, on their own number, and a clinic records a child's details with that parent's or guardian's consent.

10. Changes

We will notify customers of material changes by email and via an in-app notice at least 30 days before they take effect.

11. Contact

support@atrivextech.com
Atrivex Technology Private Limited