Data Protection (DPDP Act 2023)

1. Overview

This page explains your rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, and under the Information Technology Act, 2000 and the SPDI Rules, 2011, and how to exercise them with [Company Name] as the Data Fiduciary for GP Emergency Referral. It supplements the Privacy Policy.

You are a "Data Principal" if the data is about you — for example as a referring doctor, a member of hospital staff, or a patient whose information appears in a referral.

2. Your rights as a Data Principal

• Right to information (Section 11). A summary of the personal data we process about you, the processing activities, and the identities of the Data Fiduciaries and Data Processors we have shared it with, with a description of the data shared.
• Right to correction, completion, updating and erasure (Section 12). Inaccurate or incomplete data will be corrected or completed, and data you no longer want us to process will be erased unless we must keep it for a specified purpose or by law.
• Right to withdraw consent (Section 6(4)). As easily as you gave it. Withdrawal does not affect processing done before it.
• Right of grievance redressal (Section 13). A readily available way to complain to us, and then to the Data Protection Board of India.
• Right to nominate (Section 14). You may nominate another person to exercise your rights if you die or become incapable.
• Review and correction of sensitive data (SPDI Rules). You may review the sensitive personal data (such as health or financial information, or passwords) you provided and ask for it to be corrected.

3. How to exercise your rights

Some changes you can make yourself in the app:

• Update your profile, practice details and mobile number from your profile page.
• Change your password and sign out other devices under Account > Security.
• Turn off web push in your browser settings, or notifications in your phone's settings; decline location access in your browser or app.

For everything else — a copy or summary of your data, erasure or account closure, withdrawing your standing call-recording consent, nominating someone, or a grievance — write to our Grievance Officer at [Grievance Officer Email] from the email address on your account (or include your 8-digit user ID), stating:

1. your name and account email or user ID;
2. which right you want to exercise and what data or referral it concerns; and
3. for a patient request, enough detail to locate the referral (date, hospital).

We may ask you to verify your identity before acting. Patients may also approach the referring doctor, who can help identify the referral.

4. Grievance redressal timelines

• We acknowledge your request or grievance within 24 hours.
• We resolve it, or explain why we cannot, within 30 days of receipt.

If you are not satisfied with our response, or we do not respond in time, you may file a complaint with the Data Protection Board of India under Section 13(3) of the DPDP Act after exhausting this process.

Grievance Officer

[Grievance Officer Name]

Email

[Grievance Officer Email]

Phone

[Grievance Officer Phone]

Data protection contact

[DPO/Data Protection contact]

Postal address

[Company Name], [Registered Address]

5. Your duties (Section 15)

• Do not impersonate another person or give false particulars.
• Do not suppress material information when providing data (for example for verification).
• Do not register false or frivolous grievances or complaints.
• Furnish only verifiably authentic information when asking for correction or erasure.

6. Retention and erasure

We keep personal data only as long as needed for the purpose it was collected for, or as required by law, and then erase it (Section 8(7)). In summary:

• Account and profile data: while your account is active.
• Sign-in sessions: up to 30 days, then cleaned up automatically.
• Call recordings: 1,095 days by default, then permanently deleted.
• Referrals, notes, call records, complaints and audit logs: as clinical communication and accountability records, for as long as needed for clinical governance, disputes and legal obligations.
• Payment records: as required by tax and accounting law.

Full details are in the Privacy Policy.

7. Personal data breaches

If a personal data breach affects you, we will inform you and the Data Protection Board of India as required by the DPDP Act and its rules, describing the breach, its likely consequences and what we and you can do.