Personal Care Begins With Respect for Personal Information.
This page summarizes privacy-related behavior visible in the current website source. It is not a complete or legally approved privacy notice. Processing purposes, provider arrangements, retention periods, legal contacts, and other operational details require confirmation by DocMedicano before this notice can be treated as final.
The website source does not establish the legal controller details or operational privacy commitments. Confirm these with the owner before publication as a final notice.
Firebase Authentication
Used by the website sign-in flows
Profile storage
Firestore and Storage paths are scoped to the signed-in patient UID in the reviewed rules.
Privacy questions
Use the existing Contact page; the designated privacy contact and response process need owner confirmation.
Your Information, Through Your Care Journey
The forms and rules in this website source identify available account and profile fields. They do not by themselves establish which fields are required in production, all service uses, or the legal basis for each use. Confirm those details before approving this notice.
| Care Journey Stage | Data Elements Collected | Classification | Purpose & Processing Boundary |
|---|---|---|---|
|
Account Creation
Initial Onboarding
|
The sign-up flow uses name and email fields; phone sign-in is supported. Date of birth and emergency-contact fields are available in the profile form. | Required | The source integrates Firebase Authentication for account sign-in and verification. Messaging providers and reminder behavior require owner confirmation. |
|
Consultation Booking
Doctor Matching
|
The profile form contains separate self and family profile fields. This source does not establish that appointment booking or provider matching is completed by this page. | Required | Profile data is saved under the authenticated account UID when profile storage is enabled. Clinical-service purposes and provider access require confirmation. |
|
During Teleconsultation
Clinical Interaction
|
Profile fields include health information such as allergies, medications, conditions, history, and measurements. The reviewed profile code does not implement a video/audio recording feature.
Recording practices for any separate consultation service are not established by this website source and must be confirmed by the service owner.
|
Clinical Confidential | The website source alone does not establish the purpose, recipient, or retention of clinical-service records. |
|
Payment & Invoicing
Financial Checkout
|
The cart stores a selected plan and profile IDs. Online plan checkout is temporarily unavailable; no payment is collected.
The exact payment fields sent to providers and any receipt or retention practices require confirmation; this source is not evidence of a provider's data handling.
|
Transaction | Payment processing is temporarily unavailable. Invoice, refund, statutory-purpose, and retention details require owner confirmation. |
|
CareConnect OPD & Labs
Partner Coordination
|
Service pages contain clinic, diagnostic, and home-care inquiry content. The reviewed source does not establish operational partner data flows. | Coordination | Any processing or sharing associated with these advertised services must be confirmed by the service owner. |
|
Support Inquiries
Care Assistance
|
Contact and inquiry forms are present in the website. The reviewed source does not establish their server-side recipient, logging, or call-recording behavior. | Service Log | The operational purposes and retention of support submissions require confirmation. |
Access Should Have a Reason
The reviewed rules enforce patient-owner checks for profile, cart, wallet, and entitlement paths. They also define doctor/admin access for some consultation records. This client source does not establish staff roles, audit logging, or production emergency-access procedures.
Treating Professionals
The client checks for a verified email address or phone sign-in before enabling patient profile access.
Care Coordinators
Staff managing clinic flow, slot adjustments, and physical arrival tokens.
Support & Billing Teams
Helpdesk agents addressing refund claims, booking issues, and connectivity tickets.
Technical Engineers
Cloud engineers and database administrators managing core uptime and encryption pipelines.
Want to see how our engineering team applies the "Least Privilege Principle" to your medical records?
Least Privilege & Break-Glass Protocol
At DocMedicano, no single engineer, employee, or support agent has unrestricted read access to clinical databases. All patient medical attachments, diagnostic PDFs, and doctor-patient chat transcripts are encrypted using AES-256 keys managed via AWS Key Management Service (KMS).
The "Break-Glass" Authorization Policy:
- This notice does not detail production access controls.
- Contact support for current information about emergency access procedures.
- Contact support for current information about audit logging and review procedures.
This notice does not certify alignment with ISO 27001 or ABDM security controls. Contact support for current details.
Sharing Should Be Understandable
Healthcare delivery is inherently collaborative. Delivering seamless care requires interaction with licensed doctors, diagnostic labs, cloud infrastructure, and regulatory authorities. We never sell your personal or medical data to advertisers or commercial brokers.
Licensed Clinicians & Partner Hospitals
When you book a video consultation or clinic appointment, your clinical concern, uploaded files, and demographic details are shared exclusively with the attending doctor to enable proper diagnosis and patient care.
Diagnostic Labs & Pharmacies
When you request home pathology collection or opt for prescription medicine delivery, details needed for a requested service may be shared with external labs or pharmacies. Ask the provider about relevant accreditation and licensing.
Cloud & Telehealth Infrastructure
SMS, email, and video features may rely on third-party services. Contact support for current details about provider locations and data safeguards.
Statutory & Lawful Government Authorities
Information is disclosed only under authentic, enforceable court orders, search warrants, or statutory disease reporting mandates established by the Ministry of Health and Family Welfare under the Epidemic Diseases framework.
Your Account Deserves Attention, Too
While we safeguard systems with clinical-grade cryptography, account security is a shared responsibility. Practical habits protect you from unauthorized access or social engineering attempts.
Unique Passwords
Use a dedicated, complex password or passkey. Never reuse workplace or casual web credentials for your health records.
Never Share OTPs
DocMedicano clinicians, nurses, and care coordinators will NEVER ask for your login OTP or payment UPI pin via phone or WhatsApp.
Keep Contacts Updated
Ensure your active phone number and emergency email are kept current. Outdated SIM numbers create account takeover vulnerabilities.
Sign Out Shared Devices
Always log out of cyber cafes, clinic lobby kiosks, or shared family tablets immediately after reading your medical discharge summary.
Report Suspicion
If you receive an unprompted OTP or notice an appointment you did not schedule, notify our emergency security desk immediately.
Care Messages and Promotions Should Be Clearly Distinguished
Critical healthcare notifications must never be obscured by marketing announcements. We separate vital clinical alerts from optional wellness content, giving you total agency over what reaches your device.
Critical transactional notifications necessary to deliver scheduled healthcare services safely:
- Teleconsultation joining links & PINs
- Doctor delay or rescheduling notifications
- Digitally signed e-prescription ready alerts
- Account verification OTPs & security resets
- Payment receipts and refund confirmations
These cannot be toggled off as they are integral to statutory clinical care delivery.
Discretionary lifestyle communications designed to keep you informed of preventive options:
- CarePass seasonal consultation bonus credits
- Preventive cardiac & diabetes screening camps
- Quarterly physician-authored health digests
- Partner diagnostic package discounts
Online communication-preference updates are unavailable on this page.
Communication Preferences
Online preference updates are unavailable.
WhatsApp Health Tips & Camps
Preventive health reminders on WhatsApp
Promotional SMS Updates
Seasonal packages & clinic voucher alerts
Physician Health Digest
Monthly medical editorial by DocMedicano doctors
This page does not save or synchronize communication preferences.
View Contact OptionsFamily Support Needs Clear Boundaries
In India, family members frequently coordinate medical care for elders or young children. DocMedicano simplifies multi-member booking while rigorously preserving the statutory confidentiality and individual dignity of every patient.
Distinct Patient Profiles
A single primary phone account can create separate sub-profiles for spouses, aging parents, or children. Profiles are stored separately in the patient account.
Adult Autonomy First
Sharing CarePass consultation credits does NOT automatically grant permission to read another adult family member’s confidential clinical summaries or prescriptions without explicit digital consent.
Minor Dependents
Records of children under 18 years are managed by the designated legal guardian. Upon reaching majority (18 years), profiles may be smoothly detached into an independent adult personal vault.
Instant Revocation
Any family delegate permission or caretaker access can be modified, paused, or permanently revoked at any time directly through the DocMedicano account settings.
Keeping Information—and Knowing When to Remove It
We retain information only as long as needed to deliver ongoing care, satisfy statutory medical regulations, and comply with tax and audit laws. Here is our exact statutory timeline.
Medical & Consult Records
Minimum 3 Years
In accordance with NMC Telemedicine Guidelines and MoHFW protocols, clinical prescription logs and encounter summaries are preserved for a minimum of 3 years to ensure clinical auditability.
Financial & Billing Records
7 Years
Under Indian GST and Income Tax statutory mandates, formal invoice references, payment transaction states, and refund ledger entries must be retained for 7 financial years.
Closure vs Deletion
Immediate Lock
Account closure immediately halts login capability, promotional outreach, and active processing. Medical records transition to cold encrypted archive until the statutory legal period concludes.
Consent Revocation
Instant Cessation
Under the DPDP Act 2023, you may revoke consent for discretionary processing. Upon revocation, all optional feeds and third-party lab booking syncs cease immediately without penalty.
Online Privacy Requests Unavailable
Privacy requests cannot be submitted from this page. Nothing entered here would be sent or stored. Use the Contact page to view the support options currently published.
Do not enter personal or medical information here. This page does not submit privacy requests.
View Contact OptionsIf Something Appears Wrong, Tell Us.
If you ever see unexpected account activity, receive unexpected verification SMS prompts, or notice a document that does not belong to you, please notify our immediate response desk. Our dedicated cybersecurity specialists treat data segregation integrity as our highest priority.
Security Researchers & Vulnerability Disclosure
We welcome constructive reports from ethical security researchers. DocMedicano operates a safe-harbor Responsible Vulnerability Disclosure Program.
Review security keys & security.txt at docmedicano.com/.well-known/security.txt
Protection That Can Be Explained
We believe trust is built on specific, verified technical safeguards rather than vague marketing jargon. Here are the core pillars that protect patient confidentiality every second.
Data Protection
Every connection to DocMedicano is enforced over modern TLS 1.3 encryption with Perfect Forward Secrecy. Database volumes and consultation document buckets are encrypted at rest using AES-256 with keys rotated every 90 days.
Account Protection
Strict time-based cryptographic OTPs, rate-limited login endpoints, continuous threat intelligence IP filtering, and automatic session invalidation upon concurrent browser access anomalies.
Staff Governance
Role-Based Access Control (RBAC) ensures employees only see what is required for their specific assignment. All staff sign legally binding confidentiality agreements and complete annual biomedical privacy training.
Recovery & Continuity
Automated, geographically separated encrypted backups created daily across AWS Mumbai and Hyderabad availability zones. Disaster recovery plans undergo verified recovery stress tests bi-annually.
24/7 Security Monitoring
Real-time automated SIEM telemetry scanning for abnormal data exfiltration patterns, credential stuffing, and unusual API volumes. Instant alerting routes directly to our on-call SecOps engineers.
External ABDM Governance
ABHA linking options depend on current service availability and applicable requirements.
Clear Information. A Place to Ask Questions.
Understanding how your personal and clinical information is handled should be an integral part of the healthcare experience. We are here whenever you need clarity.