Privacy notice for patients

• Your clinic. The doctor you are booking with decides what is recorded about you and is responsible for it under the Digital Personal Data Protection Act, 2023 (the “Data Fiduciary”).
• hpills is the software the clinic uses, run by Dashasoft Private Limited. We store and process your details only on the clinic’s behalf, so the booking page and your prescriptions work (the “Data Processor”).

When you book: the patient’s name, age (optional), your mobile number, the reason for the visit (optional) and the time you picked. We use them to text you a one-time code that proves the number is yours, to pass your request to the clinic, and to send you appointment messages (confirmation, reminder, cancellation). Once the clinic has it, your booking becomes part of your record at that clinic.

When you sign in to see your prescriptions: your mobile number, to text you a code. After that you see only the slips and receipts that clinics have issued to that number.

Always: your connection’s IP address and browser, in our server logs, to stop abuse (for example, someone sending hundreds of codes) and to keep the service secure.

We do not use your details for advertising or marketing, we do not sell them, and we do not share them with anyone except the people below.

• The clinic you booked with — and only that clinic. Another clinic on hpills cannot see your booking.
• Our SMS provider, to deliver the code and appointment texts. It receives your number, the clinic’s name and the appointment time — never your medical details.
• Our hosting provider, where the data is stored, in Mumbai, India.

Each provider is named on the sub-processor page.

• A request you never confirmed (the code was not entered): the code expires after 10 minutes, and the request is deleted automatically soon after.
• A confirmed booking: kept as part of your clinic record for as long as the clinic keeps its records. Doctors are often required to retain clinical records for some years, so a clinic may not be able to delete everything on request.
• Portal sign-in: lasts 30 days on that device. Tap “Sign out” to end it sooner.
• Server logs: 180 days, in India, as Indian cyber-security rules (CERT-In) require.

You can ask to:

• see what is held about you and who it has been shared with;
• correct or complete anything that is wrong;
• have data erased that is no longer needed;
• withdraw your consent — as easily as you gave it;
• nominate someone to act for you if you die or cannot act yourself.

Ask your clinic first — they hold your record and decide what is in it. If you cannot reach them, or your concern is about hpills itself, write to us (below). We will pass it to the clinic and help them answer you.

If the patient is under 18, the booking should be made by a parent or guardian, using their own mobile number.

Grievance Officer: [grievance officer name]
Email: contact@hpills.com
Address: H-23, Second Floor, Gali No-1Jharkhandi Road, Bhola Nath NagarNorth East Delhi, Delhi 110032India

We acknowledge every complaint and resolve it within 90 days. If you are not satisfied, you can complain to the Data Protection Board of India.

How we protect data is on the security page. The notice for doctors, who use hpills to run their practice, is the privacy policy.