Privacy Policy
Version 2 · Effective 2026-10-01
- Introduction and scope — DoconDuty is a healthcare practice-management platform operated by [confirm full legal name of operator] (“DoconDuty”, “we”, “us” or “our”). The platform provides software features for clinics, hospitals, doctors, front-desk staff, patients and, where enabled, pharmacies and diagnostic laboratories. This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit our website, create an account, use our application, interact with our support team or otherwise use our services. We aim to handle personal information lawfully, transparently and only for legitimate purposes connected with providing and improving our services, complying with legal obligations and protecting users. This Policy should be read together with our Terms & Conditions and any specific notice or consent presented when you use a particular feature.
- Information we collect — Depending on the features used and the user's role, we may collect the following categories of information: Account and identity information: Name, email address, phone number, login credentials in protected form, account role and account status. Clinic and professional information: Clinic or organisation name, business contact details, professional profile, qualifications, registration details provided by healthcare professionals, staff accounts and clinic configuration. Patient and clinical information: Patient name and contact details, appointment history, symptoms, medical history, allergies, diagnoses, vitals, prescriptions, treatment plans, consultation notes, medical documents, investigation reports and other information entered by authorised users for patient care. Billing and subscription information: Subscription plan, invoice and payment status, transaction references, payment confirmations, billing contact details and records needed to manage the customer relationship. Where payments are made by bank transfer or another manual method, we may process the proof and reference details provided to verify payment. Communications: Support requests, feedback, correspondence and information you choose to submit. Technical and usage information: IP address, browser and device information, log data, authentication events, error reports and information about how the platform is used. Location information: Approximate or precise location information only where a feature requests or uses it, such as a location-dependent function. The specific purpose and permission requirements will depend on the feature. We do not ask users to submit information unrelated to the relevant service. Users should avoid entering unnecessary personal or medical information into free-text fields.
- How we obtain information — We collect information directly from users when they register, complete a profile, book or manage an appointment, enter clinical information, upload a document, contact support or make a subscription payment. We may also receive information from an authorised clinic, doctor, front-desk employee, laboratory, pharmacy or other organisation using DoconDuty to manage its operations and patient relationships. Technical information may be generated automatically when the website or application is accessed. Third-party services may collect information when they are enabled and used, subject to their configuration and applicable consent requirements. Users who provide another person's information must have appropriate authority to do so and must follow applicable privacy, confidentiality and professional obligations.
- Purposes and lawful basis for processing — We use personal information, as applicable, to: Create and administer user accounts and authenticate users. Provide appointment scheduling, patient management, clinical documentation, prescription, reporting and other enabled platform functions. Make patient information available to the appropriate clinic and authorised care team. Maintain medical records and support continuity of care. Process subscriptions, verify manual payments, issue invoices and provide customer support. Send essential service, security, appointment and account communications. Diagnose technical problems, maintain service reliability and prevent fraud, misuse and unauthorised access. Measure website performance and improve the service, where permitted and subject to applicable consent requirements. Operate optional AI-assisted or other third-party features only where enabled, appropriately disclosed and lawfully configured. Comply with applicable law, respond to lawful requests and establish, exercise or defend legal claims. We will process personal data on a lawful basis applicable to the particular activity, including valid consent where required or another basis permitted by applicable law. Where consent is relied upon, users may withdraw it through an available mechanism or by contacting us. Withdrawal does not invalidate processing lawfully completed before withdrawal and may affect features that depend on the relevant processing.
- Health information and confidentiality — Health information is particularly sensitive in practical terms. We expect clinics, doctors, employees and other authorised users to access patient information only for legitimate, authorised purposes. A clinic or healthcare professional remains responsible for ensuring that patient information is collected and used with the required authority, notice or consent; that access is limited to appropriate personnel; and that records are maintained in accordance with applicable professional and legal requirements. DoconDuty is software that supports healthcare administration and documentation. Access to information through the platform does not authorise a user to disclose it to another person or use it for an unrelated purpose. Users must not share accounts, disclose login credentials, access records without authority or use patient information for unauthorised marketing, personal interest or discrimination.
- Sharing and third-party service providers — We may disclose information only as appropriate for the relevant purpose, including: Authorised clinics and care teams: Patient information may be accessible to the clinic or healthcare organisation responsible for the patient's care and its authorised users, according to the platform's access controls and configuration. Infrastructure and technical providers: Hosting, database, storage, security, email, communications and other providers may process information to operate or support the service. AI and other optional integrations: If an AI-assisted feature or external integration processes information, the relevant provider, information categories, purpose, retention and transfer arrangements must be disclosed in the feature-specific notice where applicable. We will not represent that health information is never sent to an AI provider unless that has been verified. Analytics and website services: Website analytics, advertising measurement, mapping, fonts and similar services may receive technical or usage information where they are enabled. Optional tracking should respect applicable consent and preference requirements. Legal and safety disclosures: Information may be disclosed where required by law, pursuant to valid legal process, to protect rights or safety, or to investigate fraud, security incidents or misuse. Business transfers: If the business is reorganised, merged or transferred, information may be transferred as part of that transaction subject to applicable law and appropriate safeguards. We do not sell personal information as a business model. We do not authorise service providers to use patient information for unrelated purposes merely because they provide services to us. Actual provider arrangements and their contractual terms must be verified before publication.
- Data storage, retention and deletion — We retain information for as long as reasonably necessary for the purpose for which it was collected, to provide the service, maintain relevant records, resolve disputes, enforce agreements and comply with applicable legal obligations. Medical records may need to be retained by healthcare professionals for periods prescribed by applicable law or professional rules. Clinics and practitioners are responsible for determining their record-retention obligations. A request to delete an account does not automatically require the deletion of records that must lawfully be retained. When information is no longer required and no legal obligation requires its retention, we will take appropriate steps to delete it, anonymise it or otherwise dispose of it securely, subject to technical and legal constraints. Specific retention periods, backup-expiry schedules and procedures for deleting information from active systems and backups must be established and documented by the operator before this Policy is published.
- Security measures — We use, or intend to maintain as appropriate to the service, reasonable technical and organisational safeguards to protect information against unauthorised access, disclosure, alteration, loss and misuse. Safeguards may include access restrictions, authentication controls, permission management, secure transmission, logging, backups, security testing, incident response and staff confidentiality obligations, to the extent implemented in the production environment. No online system can be guaranteed to be completely secure. Users should protect their credentials, use appropriate devices, report suspected account compromise and avoid sharing confidential information through unauthorised channels. We will handle security incidents and notifications in accordance with applicable legal requirements. Specific security certifications or guarantees will not be claimed unless independently verified.
- Cookies, analytics and similar technologies — Our website may use necessary technologies to support navigation, security, preferences and session management. Where enabled, analytics or advertising technologies may help us understand website usage and evaluate marketing performance. Where consent is required, optional technologies should not be activated before the required consent is obtained. Users should be provided with a meaningful way to reject optional tracking and change their preferences. Browser settings may also restrict cookies, although some functions may not operate properly if necessary technologies are disabled. The actual cookies, scripts, providers, data collected and consent behaviour should be listed and verified before publication.
- Children's information — DoconDuty is designed primarily for healthcare organisations and their authorised users. A parent, guardian or authorised healthcare provider may need to provide information concerning a child for legitimate care-related purposes. Where personal data relates to a child, processing must comply with the applicable legal requirements concerning parental or lawful-guardian consent and any restrictions that apply to tracking, monitoring or targeted advertising. We will not knowingly rely on a child's information for unrelated advertising purposes. The operator and participating clinics must implement appropriate age, authority and consent procedures for the features they provide. This section does not replace those operational controls.
- Data protection rights and requests — Subject to applicable law and its conditions, an individual may have rights to obtain information about processing, request access to personal data, seek correction or completion, request erasure where permitted, withdraw consent, raise a grievance and nominate another individual where the law provides for it. Requests can be submitted to [insert verified privacy/grievance email]. We may need to verify identity and authority before acting. Where a request concerns clinical records controlled by a clinic or healthcare professional, we may direct the requester to that organisation or coordinate with it as appropriate. We will respond within the period required by applicable law. We may retain information where required by law or where another lawful ground applies, and will explain relevant limitations where appropriate.
- Grievance and privacy contact — For privacy questions, data-protection requests or complaints, contact: Privacy / Grievance contact: Dhaval C. Gondaliya Email: info@shvettechnologies.in Postal address: 401-The Ikon Building, shadhuvasvani road, rajkot-5 Website: https://doconduty.net The operator must appoint and publish the contact details required by applicable law, monitor the contact channel and maintain a process for recording, investigating and responding to complaints.
- International processing and transfers — Some service providers may process information on infrastructure located outside India. Where this occurs, we will assess and manage the transfer in accordance with applicable Indian law, relevant government restrictions and contractual safeguards. The locations of hosting, backups, AI providers, email services and other processors must be verified. This Policy does not promise that all data is stored exclusively in India unless that is factually established.
- Changes to this Privacy Policy — We may update this Policy to reflect changes in the service, law or processing practices. The updated version will be published on this page with a revised effective or last-updated date. Where required, we will provide additional notice or obtain consent before implementing material changes. We will not treat publication of a revised Policy as a substitute for consent where consent is legally required.
- Applicable law — This Policy is intended to be interpreted in accordance with applicable laws of India, including relevant data-protection, information-technology and consumer-protection legislation, as in force and applicable to the relevant processing. Nothing in this Policy is intended to exclude a right or remedy that cannot lawfully be excluded.