Draft — pending legal review
This document is a draft. Operator details shown in [square brackets] have not been filled in yet, and the text has not been reviewed by counsel.
Privacy Policy
- Last updated:
- 2 November 2026
- Effective:
- [Effective Date]
- Version:
- 2026-11-02
This policy explains what personal data GP Emergency Referral collects about doctors, hospital staff and patients, why, who can see it, and how long we keep it.
1. Who we are
GP Emergency Referral is operated by [Company Name]. For personal data processed under this policy we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), a body corporate under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the controller under the EU GDPR where it applies.
- Operator
- [Company Name]
- Registered address
- [Registered Address]
- CIN
- [CIN]
- Contact
- [Contact Email]
2. Whose data this covers
- Referring doctors, hospital staff (admins, managers, on-duty doctors, referral desk and ambulance drivers) and platform admins — the people who hold accounts.
- Patients — whose health information doctors include in referral summaries and notes. Patients do not have accounts. The referring and receiving doctors decide what to share; we process it only to deliver and record the referral.
- Hospital contacts and payers whose details are entered for billing.
3. Personal data we collect
| Category | What | Source |
|---|---|---|
| Account | Name, email address, 8-digit user ID (staff without email), account type and hospital role, password (stored only as an Argon2id hash), email verification status, date and version of the Terms you accepted, date of your standing call-recording consent. | You; your hospital admin or manager (staff accounts) |
| Doctor profile | Full name, medical registration number and council, system of medicine, qualification, speciality, mobile number, current organisation, city, practice address and (optionally) practice location, verification status, duty status and roster shifts, hospital and speciality mappings, cover arrangements. | You; the hospital that invited you; platform admins (verification) |
| Hospital | Name, address, location, main and referral-desk phone numbers, email, emergency department, specialities, facilities, staff memberships, subscription and credit balance. | Hospital admin |
| Referral and patient health information | Patient age and sex, presenting complaint, working diagnosis, vitals, investigations, treatment given, reason for referral; referral note (which may include an optional patient name and identifier); outcome, alternative suggestions, arrival confirmation. | Referring and receiving doctors |
| Location | Your device location (only when you allow it in the browser or app), place names you search for, practice and hospital locations; the referral's origin point and computed distance and travel time. | Your device; you; mapping service |
| Calls | Who called whom, when, ringing/answer/end times, duration, status and end reason, device identifiers for the call, consent timestamps, whether an SMS fallback was sent; call recordings (audio) where enabled. | Generated by the Platform during calls |
| Devices and notifications | Web push subscription (endpoint and keys, browser user agent); mobile push tokens (Expo, Apple VoIP/APNs, Google FCM) and platform; in-app notifications sent to you. | Your browser or app |
| Security and audit | Sign-in sessions (IP address, user agent, created/last-used times), hashed refresh and one-time tokens, rate-limit counters keyed by IP address or email, and an audit log of significant actions (who did what, when, on which record). | Generated by the Platform |
| Payments | Payment amount, units, status, gateway order and payment IDs, manual payment references, credit ledger and revenue allocation records (including the onboarding person's name). | Hospital admin; payment gateway; platform admins |
| Misuse and appeals | Complaints (reason, details), admin review notes, strikes, restrictions, appeals. | Doctors; platform admins |
Health information, medical records, passwords and financial information are sensitive personal data under the SPDI Rules, and health data is special-category data under the GDPR. We apply the safeguards in section 9 to them.
4. Patient health information
The pre-call summary is designed to be minimal and clinical. Doctors are asked not to enter names, phone numbers, addresses, ID numbers or other direct identifiers in it. The referral note has optional patient name and identifier fields for continuity of care at the receiving hospital.
A referral, its calls and its note are visible only to:
- the referring doctor;
- the receiving doctor and any doctor who was called on it;
- active doctors of the receiving hospital mapped to the referral's speciality, and its emergency physicians;
- admins of the receiving hospital; and
- platform admins.
Push notifications shown on a lock screen carry only the caller's name and speciality, not clinical details.
5. Why we use it
- To create and secure accounts, verify doctors' registrations and hospitals, and let hospitals manage their staff, rosters and capabilities.
- To show referring doctors which hospitals have an emergency speciality available, ranked by suitability and distance, and to connect in-app calls.
- To deliver the referral summary, notifications (in-app, email, web push, mobile push, SMS fallback), outcomes, arrival confirmations and referral notes.
- To record calls where enabled, and to investigate complaints and misuse.
- To process subscriptions, credits and payments.
- To keep an audit trail, prevent abuse (rate limits, lockouts), keep the Platform secure and comply with law.
We rely on your consent, which you give when you accept these terms and use the features described, and on the legitimate uses permitted by Section 7 of the DPDP Act — including data you voluntarily provide for a specified purpose, compliance with law or a court order, and responding to a medical emergency involving a threat to life or health. EU/EEA lawful bases are described in the GDPR notice.
We do not sell personal data, do not use it for advertising, and do not use analytics or advertising cookies or trackers. The Platform does not currently send your data to any AI or machine-learning service.
6. Call recordings
When call recording is enabled, a recording server operated by us receives each participant's microphone audio on a separate connection and stores one stereo file (caller on one channel, callee on the other) in private storage. Your browser or app never uploads a recording itself.
- Notice and consent. A recording notice appears next to the Call buttons; pressing Call is the caller's consent. Callees see the notice on the answer screen, or give a standing consent once in the app (needed when answering from the lock screen). If a callee has not consented, only the caller's side is recorded. In-call screens show a "Recording" label.
- Access. Only the referring doctor, the doctor or staff member who answered, an active admin of the referral's hospital and platform admins can play a recording. Playback links are short-lived (60 seconds or less) and every access is written to the audit log.
- Retention. 1,095 days by default, then permanently deleted.
7. Location data
To find the nearest suitable hospitals we use your device's location only if you allow it in your browser or app (you can decline and type a place or use your saved practice address instead). Coordinates are sent to our server in the search request, may be passed to OpenRouteService to estimate travel time, and the referral's origin point, distance and estimated travel time are stored with the referral. We do not track your location in the background.
9. International transfers
Our primary infrastructure is intended to be in India. Some providers (for example our email provider, Expo, Apple, Google and OpenRouteService) process data outside India, including in the United States and the European Union. Transfers outside India are made as permitted by Section 16 of the DPDP Act (we do not transfer to any country the Government of India has restricted). For EU/EEA users, see the GDPR notice.
10. How we protect it
- Encryption in transit (HTTPS/TLS; calls use encrypted WebRTC media).
- Passwords hashed with Argon2id; refresh, email-verification and password-reset tokens stored only as SHA-256 hashes; sign-in cookies are httpOnly, Secure and SameSite=Lax.
- Role-based access checks on every request, sign-in lockouts and rate limits, revocable sessions you can review under Account > Security.
- Recordings in private storage, never public, with short-lived access links.
- An audit log of significant actions, reviewed by platform admins.
No system is completely secure. If a personal data breach occurs we will notify affected users and the Data Protection Board of India (and, for EU/EEA users, the relevant supervisory authority) as the law requires. We do not claim any security certification.
11. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While your account is active. After closure we delete or anonymise it, except what we must keep for the records below or by law. |
| Sign-in sessions | Up to 30 days (7 days idle); expired session and token rows are cleaned up automatically. Email verification links expire after 24 hours, password reset links after 30 minutes. |
| Referrals, referral notes and call records | As clinical communication records, for as long as needed for continuity of care, clinical governance, dispute resolution and legal obligations. |
| Call recordings | 1,095 days (about three years) from the call by default, then permanently deleted by a scheduled purge. The operator can configure this period; this policy will be updated if it changes. |
| Push tokens | Until you sign out, unsubscribe or the push service reports the token invalid. |
| Rate-limit counters | Minutes to 24 hours. |
| Payment and credit records | As required by tax and accounting law (books of account are kept for at least eight years under the Companies Act, 2013). |
| Audit log, complaints and restrictions | For as long as the related records are kept, for accountability and security. |
12. Your rights
You can access, correct, complete, update and erase your personal data, withdraw consent, nominate another person to exercise your rights, and raise a grievance. How to do this, and our response times, are explained in Data Protection (DPDP Act). EU/EEA users have further rights described in the GDPR notice.
Withdrawing consent or deleting your account stops future processing but does not affect processing already done, and some records (referrals, recordings within their retention period, payments, audit logs) are kept as described above. Patients who want to exercise rights over referral information can contact the referring doctor or us.
13. Children
Accounts are only for adults (18+) acting in a professional capacity. Referrals may concern patients who are children; the referring doctor is responsible for obtaining the consent of a parent or lawful guardian where required, unless the law permits processing without it (for example, in a medical emergency).
15. Changes to this policy
We will update the "Last updated" date and version when this policy changes and notify you in the app or by email of material changes.
16. Contact and grievances
Grievance Officer
- Grievance Officer
- [Grievance Officer Name]
- [Grievance Officer Email]
- Phone
- [Grievance Officer Phone]
- Data protection contact
- [DPO/Data Protection contact]
- Postal address
- [Company Name], [Registered Address]
If you are not satisfied with our response you may complain to the Data Protection Board of India (or, in the EU/EEA, your supervisory authority).