Privacy Policy

1. Introduction

At DoctorDocs ("we", "our", or "us"), your privacy and the absolute security of your documents are our highest priorities. This Privacy Policy describes how we collect, use, protect, and disclose your personal data when you use DoctorDocs tools at doctordocs.in.

This policy is written to comply with the following applicable laws:

• India: The Digital Personal Data Protection (DPDPA) Act 2023 and its rules
• European Union: General Data Protection Regulation (GDPR) (EU) 2016/679
• United Kingdom: UK GDPR and the Data Protection Act 2018
• United States (California): California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) 2023

2. Document Security & Zero-Retention Policy

We operate under a strict privacy-first architecture. We explicitly differentiate between tools that run 100% locally on your machine and those requiring encrypted cloud AI inference:

• Local Browser Tools: Core utilities (PDF merging, splitting, image conversion, hash generation, standard in-browser OCR) run entirely within your web browser using WebAssembly. Your files are never uploaded to our servers.
• AI & OCR Processing: When using advanced tools (Handwriting Analysis, Doctor Prescription OCR, Lab Report Interpretation, AI Text Tools), your images or text are securely transmitted over TLS 1.3 to enterprise AI APIs. These providers are contractually prohibited from retaining or training on your data.
• Zero Retention: Files sent for processing are held in volatile RAM, processed instantly, and immediately discarded upon response delivery. We do NOT maintain databases of your uploaded files or extracted text.
• AI Model Inputs: Text passed to AI models is never logged or stored per enterprise Data Processing Agreements.
• Breach Notification: In the event of a data breach involving personal information, we will notify affected users within 72 hours of discovery in accordance with GDPR and DPDPA 2023 requirements.

3. HIPAA & Medical Non-Compliance Notice

4. Information We Collect

We collect the minimum information necessary:

• Usage Data: We use Microsoft Clarity, Google Analytics, and Vercel Analytics to collect anonymous, aggregated diagnostics (browser type, pages visited, session duration) to improve our platform. This data cannot be used to identify you personally. Raw analytics data is purged within 30 days; only aggregated metrics are retained.
• Account Information: If you subscribe to a Premium plan, we collect your email address and payment reference number. We do not collect, process, or store credit card numbers or raw financial instruments. Payments are processed by third-party payment processors (Razorpay/PayPal) under their own security certifications.
• No Biometric Data: We do not collect fingerprints, facial recognition data, or any biometric identifiers.
• No Sensitive Personal Data: We do not collect or sell racial/ethnic origin, political opinions, religious beliefs, health data, sexual orientation, or any other special category data.
• Document Content: Never stored. All document processing is either local (in-browser) or ephemeral server-side (immediately discarded after processing).

5. Google AdSense & Advertising Cookies

See our full Cookie Policy for details.

6. Third-Party Service Providers & Subprocessors

We partner exclusively with security-certified enterprise vendors to operate our platform. All subprocessors are bound by Data Processing Agreements (DPAs) compliant with India DPDPA 2023, EU/UK GDPR, and California CCPA/CPRA. We do not sell your personal information to any third party.

7. Your Rights Under GDPR & UK GDPR (EU & UK Users)

If you are located in the EU or UK, you have the following rights under GDPR/UK GDPR:

• Right of Access: Request a copy of personal data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no overriding legal reason to retain it.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decision-Making: Not be subject to solely automated decisions that significantly affect you.

To exercise any right, email prabhu@doctordocs.in. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your national DPA in the EU).

8. Your Rights Under DPDPA 2023 (Indian Users)

Under India's Digital Personal Data Protection Act 2023, you ("Data Principal") have the following rights:

• Right to Access Information: Obtain a summary of personal data we process and the processing activities.
• Right to Correction & Erasure: Request correction of inaccurate or incomplete personal data, and erasure of data no longer necessary for the purpose it was collected.
• Right to Grievance Redressal: Have your grievance redressed by our Grievance Officer within 15 business days (see Section 13).
• Right to Nominate: Nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.
• Right to Withdraw Consent: Withdraw consent for processing of your personal data at any time (see Section 11).

As a Data Fiduciary under DPDPA 2023, DoctorDocs is committed to processing your personal data lawfully, fairly, and transparently. We maintain a record of all data processing activities as required by law.

9. Your Rights Under CCPA/CPRA (California, USA Users)

If you are a California resident, the CCPA/CPRA grants you the following rights:

• Right to Know: Know what personal information we collect, use, disclose, and sell.
• Right to Delete: Request deletion of personal information we have collected about you.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. This right is moot, but affirmed.
• Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined by CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right.

To exercise your California rights, email prabhu@doctordocs.in with the subject line "CCPA Request".

10. Data Retention

• Document Content: Never stored. All document processing is ephemeral.
• AI Query Text: Not retained by us or our AI providers.
• Account Data (email, subscription status): Retained for the duration of your subscription plus 3 years for legal/tax compliance, then permanently deleted.
• Analytics Data: Raw event data is purged within 30 days. Only aggregated, anonymized statistics are retained indefinitely.
• Server Logs: IP addresses in server logs are hashed and purged within 90 days.

11. Consent & Withdrawal

Where processing is based on your consent (e.g., optional analytics cookies, marketing emails), you may withdraw that consent at any time by:

• Adjusting your browser's cookie settings to reject non-essential cookies
• Emailing prabhu@doctordocs.in with the subject line "Withdraw Consent"
• Using the unsubscribe link in any marketing email we send

Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

12. Children's Privacy

India (DPDPA 2023): Under the DPDPA 2023, a "child" is defined as a person under 18 years of age. We do not knowingly process personal data of children without verifiable parental consent. If we become aware that a user under 18 in India has provided personal data without parental consent, we will delete it immediately.

Other Jurisdictions: DoctorDocs does not knowingly collect personal information from children under 13 (COPPA, US) or under 16 (GDPR, EU/UK). If we learn we have collected such data, we will delete it promptly.

13. Grievance Officer (Required by DPDPA 2023)

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, or legal requirements. For material changes, we will provide at least 30 days' notice by posting the updated policy on this page, updating the "Last Updated" date, and (for registered users) sending an email notification. Continued use of our services after the effective date constitutes acceptance of the updated policy.

15. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact our Data Protection Officer: