Privacy Policy

1. What we collect

From patients (entered by the patient, or by reception/the doctor on their behalf):

• Name, mobile number, age and gender
• Reason for visit and, if recorded, vitals such as blood pressure, weight, height, temperature and SpO2 — every field is optional
• Photos of prescriptions or reports the patient chooses to upload, and the doctor's consultation note
• Queue activity — token number, join/call times, and whether a token was completed or missed
• Payment activity for a visit — amount, method (cash, UPI at counter, or online), and status; ClinicQ does not store card or UPI credentials itself (see Section 4)

From clinic staff (doctors, reception, clinic admins):

• Name, username, mobile number and role, used to run the staff login and send password resets
• Activity within the app — logins, shift start/end, queue and settings changes — kept as a clinic activity log

Automatically: basic technical data such as IP address and browser type, and — on the device the patient checks in from — a small signed token kept in local storage so a returning patient doesn't have to retype their details next visit.

2. Why we collect it

• To run the queue: issue tokens, show live wait status, and notify patients when it's their turn
• To keep the visit and consultation record the clinic asked to be kept
• To operate staff logins and enforce that each clinic only sees its own patients and data
• To send WhatsApp updates the clinic or patient opted into (token confirmed, you're next, your turn, or an OTP where a clinic requires phone verification)
• To process online payments where a clinic offers them, and to keep the payment log every action is written to
• To bill the clinic for its ClinicQ subscription

We do not sell patient or clinic data, and we do not use it for advertising.

3. Who your data is visible to

Patient data for a visit is visible to that clinic's reception and the treating doctor only — never to another clinic, and never to a different doctor at the same clinic unless the clinic has more than one doctor and a clinic admin role is explicitly granted oversight (which still excludes clinical notes). A patient's own consultation notes are visible only to the treating doctor and, where recorded, reception's check-in details (vitals, contact info) — not the free-text note itself.

4. Third parties we use to run the Service

ClinicQ uses a small number of service providers ("processors") to operate the platform. They only receive what they need to do their specific job:

• Telnyx — delivers WhatsApp messages (OTPs and queue notifications) via the WhatsApp Business Platform. A patient's mobile number and the message content are shared with Telnyx/WhatsApp for delivery.
• Razorpay — processes online UPI payments a patient chooses to make. Card, UPI or bank details are handled directly by Razorpay; ClinicQ never receives or stores them, only the payment status and amount.
• Google Firebase — delivers the optional "Alert me when it's my turn" push notification to a patient's browser, only if the patient turns it on. It receives a device notification address and the notification text.
• An AI language-model provider — used only to understand a doctor's own WhatsApp reply to a shift reminder (for example "start" or "delay 30 minutes"). Patient information is not sent for this.
• Cloud infrastructure providers that host ClinicQ's servers and databases.

We don't share data with anyone else without the clinic's or patient's knowledge, except where required by law.

5. How long we keep it

We retain visit and consultation records for as long as the clinic's account is active and as needed to meet applicable medical-record and tax retention requirements, even after an account is closed. Staff login activity and payment logs are kept for the clinic's own audit trail. A patient can ask their clinic to delete their profile from ClinicQ at any time, subject to any retention the clinic itself is legally required to keep.

6. Security

• Staff passwords are never stored in plain text (scrypt-hashed) and are never chosen or seen by an administrator — a random one is generated and must be changed on first use.
• Every staff session is scoped to one clinic; the server enforces that a login can only reach its own clinic's data.
• Traffic to ClinicQ is encrypted in transit (HTTPS).
• A patient's phone is only linked to profiles it created itself unless the clinic requires WhatsApp OTP verification for that number.

7. Your choices

• WhatsApp updates are opt-in and can be turned off at check-in.
• A patient can ask reception, or ClinicQ directly, to correct or delete their stored information.
• "Remember me on this phone" is optional at check-in — declining it means the device won't be recognised on a future visit.
• Push notifications are opt-in and can be turned off in the browser settings at any time.
• Messages you send us through the Contact page or Help & support (name, email or mobile number, and what you write) are used only to reply to you and to improve the Service.

8. Grievance officer and contact

For any question about this policy, or to request access, correction or deletion of your data, write to praispranav@gmail.com or call or message +91 62039 02842. You can also use the Contact page. We aim to respond within a reasonable time and in any case as required by applicable Indian data protection law.

Brand: ClinicQ · Operated by: Altis Labs · PAN: GRTPK1849H · Udyam Registration No: UDYAM-BR-34-0066884