In short
- For patient records, your clinic is the data fiduciary and DoctorKhata is its data processor.
- We use patient records only to run DoctorKhata for your clinic. Nothing else.
- If something goes wrong, we tell the clinic owner within 24 hours.
- Download everything any time; deleted clinics leave our backups within 60 days.
On this page
01Who is responsible
The same split applies as in our Privacy policy:
- Data
- Your account and subscription
- Examples
- Your name, email, login, role, clinic settings, payments to DoctorKhata
- Who decides how it's used
- DoctorKhata
- DoctorKhata's role
- Data fiduciary
- Data
- Patient records
- Examples
- Patients' details, visits, vitals, prescriptions, bills, pharmacy entries
- Who decides how it's used
- Your clinic
- DoctorKhata's role
- Data processor: we only store and process it for the clinic, on its instructions
These terms set out what we, as the data processor, promise your clinic about patient records. For your own account data, DoctorKhata is the data fiduciary and our Privacy policy applies.
02We follow your instructions
We process clinic data only to provide DoctorKhata to your clinic, as your use of the app instructs us. We don't use it for anything else: no selling, no advertising, no training AI models, no sharing beyond the providers described below.
Some buttons, such as "WhatsApp" on a follow-up or "Print", open your staff's own WhatsApp or printer with the details filled in. That message is sent by your clinic from its own phone, not by DoctorKhata, and we don't receive a copy.
03Confidentiality
Only people who need to, to run and support DoctorKhata, can reach the systems that hold clinic data, and they are bound to keep it confidential. We don't look at patient records unless you ask us to help with a problem or the law requires it, and any such access is recorded.
04Security
- Encryption on every connection and in storage.
- Each clinic's data sealed off from every other clinic, and tested on every change.
- Role-based access for your staff, optional or required 2-step login, and an activity log of every look and change that your clinic owner can read but nobody can edit.
- Prescriptions and bills that can't be quietly rewritten or deleted.
- Nightly encrypted backups kept for 30 days; logs kept for at least one year.
05Service providers
We use these providers to run DoctorKhata. Each is bound by contract to protect the data:
- Service
- Razorpay
- What it does
- Takes subscription payments for DoctorKhata. Never your patients' payments.
- Where
- India
- Service
- What it does
- "Continue with Google" sign-in, only if you choose it
- Where
- Worldwide
- Service
- Cloud hosting and database
- What it does
- Runs the app and stores clinic records, encrypted
- Where
- Stored in Singapore; served through a worldwide network
- Service
- Email delivery
- What it does
- Account emails: verification, password reset, staff invites
- Where
- United States
- Service
- Email inbox
- What it does
- Receives the emails you send us, so we can answer them
- Where
- Worldwide
- Service
- Backup storage
- What it does
- Keeps the nightly backups. They're encrypted before they leave us, and only we hold the key.
- Where
- United States
- Service
- SMS delivery
- What it does
- Sends the code that confirms a clinic's phone number, once SMS is switched on
- Where
- India
Patient records stay with our hosting provider and in our encrypted backups. You can ask for the names of all our providers at hello@doctorkhata.in. Before adding a provider that handles patient records, we'll email clinic owners so you can object.
06Breaches
If we become aware of a breach affecting your clinic's data, we'll tell the clinic owner without delay (and in any case within 24 hours), with what we know, and keep you updated. We'll give you what you need to inform your patients and the Data Protection Board, and help you do so.
07Helping with patients' rights
The app lets you find, correct and print a patient's records. If you need help answering a patient's request (for access, correction or erasure), we'll help within a reasonable time. Issued prescriptions and bills can't be edited or deleted by design; where the law requires erasure, contact us and we'll handle it.
08When you leave
The clinic owner can download all the clinic's data at any time from Settings → Plan. When a clinic asks us to delete it, we delete its records within 30 days and they leave our backups within 30 days after that, except where the law requires us to keep something (such as billing records).
09Checks
You can ask us how we meet these terms, and we'll answer in writing. Contact our Grievance Officer, Manthan Singla (email hello@doctorkhata.in).
Questions about this page?
Write to Manthan Singla, our Grievance Officer, at hello@doctorkhata.in. We reply within 48 hours.