Privacy policy

Two different relationships run through this product, and they carry different duties.

• Patient records belong to the clinic. Under the Digital Personal Data Protection Act 2023, the clinic is the Data Fiduciary for its patients and OPDone is its Data Processor. We hold and process that data on the clinic's instructions and for no purpose of our own.
• Clinic account data is ours to hold. The people who sign in, what they subscribe to, what they are invoiced — for that, OPDone is the Data Fiduciary.

A patient asking what is held about them should ask their clinic. We will help the clinic answer, but we will not disclose a patient's record to anyone other than the clinic that holds it.

• Patients — name, date of birth, gender, phone, email, address, blood group, allergies, and the clinical record built over time: appointments, consultation notes, vitals, prescriptions, certificates, investigations, invoices and payments.
• Clinic staff — name, email, phone, role, medical registration number, employment state, and where payroll is used, salary, statutory identifiers and bank details for salary payment.
• The clinic — its name, branches, addresses, GSTIN, letterhead and payment settings.
• Activity — who did what and when, on records where attribution matters. This exists so a clinic can answer its own questions about its own data.

We do not run advertising, we do not profile patients, and we do not sell or share data with anyone for their own purposes.

Data is held in a managed PostgreSQL database in an Indian region, with the application served from infrastructure that may process requests outside India. Records at rest stay in India.

Backups are encrypted and retained by our database provider under their own schedule. Traffic is encrypted in transit throughout.

This is the part worth stating precisely, because it is the risk that matters most in shared clinical software.

Isolation is enforced in the database itself through row-level security, not by filters in application code. Every table holding clinic data carries the clinic's identity and a policy that checks it against the signed-in session. A query that forgets to filter returns nothing rather than returning another clinic's records.

The identity a session claims is read from a server-controlled token, never from anything the user can edit. Within a clinic, what a person can see follows their role — a receptionist does not read payroll, and prescribing is limited to doctors.

We use a small number of sub-processors, each for a stated purpose:

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Razorpay — card and netbanking payments, where the clinic has enabled it. Card details are handled by Razorpay and never reach us.
• Email and WhatsApp providers — for the reminders and documents a clinic chooses to send. Where a clinic supplies its own credentials, messages go through the clinic's own account.
• Cloud storage and video providers — Google Drive or Microsoft OneDrive, and Zoom or Google Meet, only where a clinic connects its own account, in which case files and meetings live under that account rather than ours.

While the clinic's account is active, its records are kept — a clinical record is not ours to age out, and Indian medical record retention expectations run to years, not months.

If a clinic closes its account, we retain its data for 90 days so it can be exported or the account restored, then delete it. Say the word before then and we delete it sooner. Financial records required for statutory purposes — invoices, GST returns — are kept for the period the law requires regardless.

Activity logs are append-only by design. They are what a clinic reads when it asks who changed something, and a log that can be edited answers nothing.

Under the DPDP Act you may ask for access to your data, correction of what is wrong, erasure where it is no longer needed, and you may nominate someone to exercise these on your behalf.

• If you are a patient — ask the clinic that treats you. They hold the record and control it.
• If you are a clinic — write to privacy@opdone.in. Your data exports in a standard format on request; it is yours.

If a breach affects a clinic's data we will tell that clinic without undue delay, describe what happened and what we are doing, and notify the Data Protection Board as the Act requires.

We set a session cookie so you stay signed in, and a small number of preferences — whether the sidebar is collapsed, for instance. There are no advertising or cross-site tracking cookies.

Our Grievance Officer can be reached at grievance@opdone.in, or by post at OPDone Technologies Private Limited, Registered office address, Pune, Maharashtra, India — 411000. We reply within 30 days.

Unsatisfied with our answer, you may complain to the Data Protection Board of India.

If we change this policy in a way that materially affects how data is handled, we will tell account holders before it takes effect rather than editing the page quietly.