In short
- For your own account, DoctorKhata is responsible for your data. For patient records, your clinic is responsible and we only store them for it.
- We never sell data, show adverts, or send patient records to AI services.
- Each clinic's records are sealed off from every other clinic, every look and change is logged, and everything is backed up nightly.
- You can ask to see, correct or delete your data, and complain to our Grievance Officer.
On this page
01Who we are
DoctorKhata (doctorkhata.in) is clinic software run by Manthan Singla, trading as DoctorKhata, Sangrur, India. In this policy "we" and "us" mean DoctorKhata.
02Who is responsible for which data
DoctorKhata holds two kinds of personal data, and the law gives us a different role for each:
- Data
- Your account and subscription
- Examples
- Your name, email, login, role, clinic settings, payments to DoctorKhata
- Who decides how it's used
- DoctorKhata
- DoctorKhata's role
- Data fiduciary
- Data
- Patient records
- Examples
- Patients' details, visits, vitals, prescriptions, bills, pharmacy entries
- Who decides how it's used
- Your clinic
- DoctorKhata's role
- Data processor: we only store and process it for the clinic, on its instructions
Under India's Digital Personal Data Protection Act, 2023, the data fiduciary decides why and how data is used, and the data processor handles it only for the fiduciary. So this policy covers your account data in full. For patient records, the clinic's own notice to its patients applies, and our duties to the clinic are in our Data processing terms.
Patients: to see, correct or delete your records, please contact your clinic. If you write to us, we'll pass your request to the clinic and help it answer.
03What we collect about account holders
- Name, email address and a password (stored only in a form that can't be turned back into the password), or your Google account's name and email if you sign in with Google.
- Your role in each clinic (owner, doctor, receptionist or pharmacist), and for doctors their qualification and medical registration number, which print on prescriptions.
- Your clinic's name, address, phone number, GSTIN, logo, UPI ID and prescription layout.
- If you turn on 2-step login, the details needed to check your codes.
- Subscription details: plan, payment status and Razorpay reference numbers. We never see or store card numbers, bank details or UPI PINs; Razorpay handles those.
- Security records: sign-in times, IP address and browser (to stop misuse), and an activity log of who opened or changed which record.
04Booking an appointment online
Some clinics let patients send an appointment request from their page on doctorkhata.in. If you do:
- We collect the patient's name and mobile number, and if you give them, email, age, sex and the reason for the visit.
- We send these to the clinic you chose, so it can confirm or decline the request, usually after calling you. If it confirms, the clinic adds you to its patient records and its own notice to patients applies from then on.
- After you book, we show you a private link to your booking. Anyone with that link can see, change or cancel the booking, so keep it to yourself. If you gave an email, we also email you the clinic's answer; that email carries only the clinic, the doctor and the time: no medical details.
- To stop misuse, we limit how many requests one mobile number or network can send. We keep the network address only in a scrambled form that can't be turned back.
- We delete the personal details from the request about 30 days after it was made.
05Why we use it
- To create your account, sign you in safely and keep your clinic's records separate from every other clinic's.
- To run the features you use: prescriptions, patient records, pharmacy stock, bills, the queue and staff access.
- To take subscription payments and tell you about them.
- To send emails you need: verifying your email, resetting your password, staff invites, and important notices about your account or this policy. We don't send marketing emails without asking first.
- To keep DoctorKhata secure, investigate misuse, and meet legal duties (for example, keeping tax records).
We use your data only for these purposes. We do not sell personal data, show adverts, or send patient records to AI services.
06Who else handles data for us
We use a small number of trusted service providers, each bound by contract to protect the data and use it only to provide DoctorKhata:
- Service
- Razorpay
- What it does
- Takes subscription payments for DoctorKhata. Never your patients' payments.
- Where
- India
- Service
- What it does
- "Continue with Google" sign-in, only if you choose it
- Where
- Worldwide
- Service
- Cloud hosting and database
- What it does
- Runs the app and stores clinic records, encrypted
- Where
- Stored in Singapore; served through a worldwide network
- Service
- Email delivery
- What it does
- Account emails: verification, password reset, staff invites
- Where
- United States
- Service
- Email inbox
- What it does
- Receives the emails you send us, so we can answer them
- Where
- Worldwide
- Service
- Backup storage
- What it does
- Keeps the nightly backups. They're encrypted before they leave us, and only we hold the key.
- Where
- United States
- Service
- SMS delivery
- What it does
- Sends the code that confirms a clinic's phone number, once SMS is switched on
- Where
- India
Patient records stay with our hosting provider and in our encrypted backups. They never go to Razorpay, Google, or our email or SMS providers (the only exception is the online booking emails described above, which carry no medical details). Please don't email us patient details: if you need help with a record, tell us the clinic and what went wrong, and we'll find it.
Clinics can ask us for the names of all our providers at hello@doctorkhata.in. Some providers are outside India; Indian law currently allows this, and we will follow any restrictions the Government notifies. Before adding a provider that handles patient records, we'll tell clinic owners by email.
We share data with authorities only when Indian law requires it, and we push back on requests that are not lawful.
07How we protect it
- Everything is encrypted on its way to you and where it's stored.
- Each clinic's records are sealed off, so nobody from another clinic can ever see them.
- Each person has their own login and role; owners can require 2-step login; every look at or change to a patient record is logged.
- Weak and leaked passwords are refused, and repeated sign-in attempts are slowed down.
- Encrypted backups are taken every night and kept for 30 days.
No system is perfectly secure. If a breach affects your data, we will tell affected clinics and account holders without delay, with what happened, what it means for you and what we're doing, and we will report it to the Data Protection Board of India as the law requires.
08How long we keep it
- Account and clinic data: for as long as the account or clinic is in use.
- If a clinic stops paying, its records stay available read-only so they can be opened, printed and downloaded. The owner can ask us to delete the clinic: we delete its records within 30 days, and they leave our backups within 30 days after that.
- Bills, payment and tax records: as long as tax law requires (currently up to 8 years).
- Security logs (sign-ins, activity log): at least one year.
- Clinics decide how long they keep their patients' medical records, under the rules that apply to doctors.
09Your rights
You can ask us to:
- give you a summary of the personal data we hold about you and who we've shared it with;
- correct, complete or update it;
- erase it, where we don't need to keep it by law;
- withdraw any consent you gave (as easily as you gave it); this doesn't affect what was done before;
- name someone to use these rights for you if you die or can't act yourself.
Write to hello@doctorkhata.in. We may ask you to confirm it's really you. We'll reply within 30 days.
11Children
Accounts are for adults (18 or over) working in a clinic. Clinics may keep records of patients who are children; getting a parent's or guardian's consent for that is the clinic's responsibility, and we process those records only on the clinic's instructions.
12Complaints and our Grievance Officer
If you have a concern about your data, contact our Grievance Officer, Manthan Singla (email hello@doctorkhata.in).
We acknowledge complaints within 48 hours and resolve them within 30 days. If you're not satisfied, you can complain to the Data Protection Board of India.
13Changes to this policy
If we make a significant change, we'll tell account holders by email or in the app before it takes effect. The date at the top shows when this page last changed.
Questions about this page?
Write to Manthan Singla, our Grievance Officer, at hello@doctorkhata.in. We reply within 48 hours.