Patient Privacy Notice

The clinic you are booking with. Its name, address and phone number are on the booking page you used and on any message you receive. Under the Digital Personal Data Protection Act, 2023 the clinic is the data fiduciary: it decides why your data is collected and what is done with it.

SQABY Technologies provides the software, Sqavio Doctor, and stores the data on the clinic’s behalf. We are the data processor. We act on the clinic’s instructions and we do not decide anything about your records ourselves.

• When you book: your name, phone number, and the doctor, date and time you chose. Sometimes your age, gender or email if the clinic asks for them.
• When you are treated: whatever the clinic records — your complaint, examination notes, vitals, diagnosis, prescription and investigations.
• When you pay: the amount, the mode of payment and a reference. If you pay online, the card or UPI details go to the payment company, not to the clinic or to Sqavio.

• Giving you care, and keeping the record of it that a clinic is expected to keep.
• Contacting you about your own appointment — a confirmation, a reminder, your prescription, your bill.
• Billing, receipts and the clinic’s accounts.

It is not used to advertise to you, and neither the clinic through Sqavio nor Sqavio itself sells your details. One clinic cannot see another clinic’s patients.

If you agree to it, the clinic can send you WhatsApp or email messages about your appointment, your prescription, your bill and a follow-up that is due. You are asked about this separately from the booking itself, and you can say no and still book.

Every message tells you how to stop. If you stop them, it takes effect immediately and it does not affect your treatment.

• Staff at the clinic, according to their job — the front desk sees your appointment and bill; the doctor sees your clinical record.
• Sqavio, only as needed to run the software for the clinic, and our staff do not browse clinic records.
• The payment company (Razorpay or Cashfree) if you pay online — they see what a payment needs, and they handle the card or UPI details.
• The messaging provider that delivers a WhatsApp or email message to you.
• Anyone the law requires, such as a court order.

The full list of companies involved is on the sub-processors page.

The clinic decides, and medical records are usually kept for years because the rules that apply to clinics expect that. Ask the clinic what its retention period is. If the clinic stops using Sqavio, its data is exported to it and then deleted from our systems on the timetable in our agreement with the clinic.

You can ask the clinic to:

• tell you what it holds about you,
• correct anything wrong or incomplete,
• erase what it no longer needs to keep,
• stop sending you messages, and
• tell you who it has shared your details with.

Ask the clinic first — they hold the relationship with you and they can do all of this themselves. If the clinic does not respond, write to us at [email protected] and we will contact them and tell you what happened. You may also complain to the Data Protection Board of India.

A clinic cannot always erase a clinical record on request: there are rules about keeping medical records, and those may require the clinic to hold on to it. They should explain that to you if it applies.

Where a patient is a child, the clinic obtains consent from a parent or guardian as the law requires. A child’s data is never used for tracking, profiling or advertising.