Privacy Notice

Version 2.0 · Updated 5 November 2026 · Terms and Conditions

This notice explains what personal data Vaidyara collects, why, who sees it and what you can do about it. It is given under the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the rules made under it. We have tried to write it in plain language.

1. Who is responsible for your data

Vaidyara ("we", "us") runs vaidyara.com: a booking and patient portal for patients, and a practice management service for clinics. Two different roles apply:

For your account and sign-in details (name, email, mobile number, password, security records, how you use Vaidyara) we are the Data Fiduciary: we decide why and how this data is used.
For medical, appointment, billing and other records a clinic keeps about its patients, the clinic is the Data Fiduciary and Vaidyara is its Data Processor. We store and handle those records only for the clinic and on its instructions. If you are a patient, the clinic is the first place to ask about your medical record.

2. What we collect

Everyone: name, email address, mobile number, password (stored only as a one-way hash by our sign-in provider), sign-in method, device and browser details, IP address and the times you signed in, and a record of what you agreed to and when.
Patients: date or year of birth, gender, family members you add, appointments, visit records, prescriptions, reports, bills, reviews, and any file you or a clinic upload. This is health data, which needs particular care. We treat all of it as sensitive.
Clinic owners, doctors, nurses and receptionists: role, clinic, professional registration details, work schedule, and an audit log of what you view or change in patient records.
Vaidyara AI: if a clinic turns it on, voice or text you give the assistant is processed to produce a reply or a draft note. We keep counts of how often each person uses it, not what was said.
Payments: handled by Razorpay. We receive the status and reference of a payment, not your card or UPI details.

We do not buy personal data about you, and we do not use advertising or tracking cookies.

3. Why we use it

We use your data only for the purposes you agreed to, and for the uses the Act allows without consent:

to create and secure your account, and to sign you in (including one-time codes by SMS and links by email);
to book and manage appointments and run a clinic: queues, consultations, prescriptions, billing and reminders;
to let the right people see the right records: a clinic sees only its own patients;
to send service messages about your appointments, bills, security and account;
to keep Vaidyara safe, prevent fraud and misuse, fix faults and meet legal duties;
to respond in a medical emergency or to protect life, where the law allows use without consent.

We do not sell personal data. We do not show advertising based on health data. Anything beyond the purposes above will be asked of you separately, and you can say no without losing the service you came for.

5. How we protect it

Each clinic's data is kept apart from every other clinic's at the database level. Connections are encrypted, sensitive fields are encrypted at rest, files open only through short-lived links, access to patient records is logged, and staff accounts can use two-step verification. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.

6. How long we keep it

We keep account data while your account is open. Clinical records are kept as long as the clinic needs them and the law that applies to doctors and clinics requires. When data is no longer needed for its purpose and no law requires us to keep it, we delete it or make it anonymous. If you ask us to erase your data, we do so subject to those legal duties and tell you what had to be kept and why.

7. Your rights

Under the DPDP Act you may:

Know: get a summary of the personal data we hold about you, how it is used and who it is shared with;
Correct and complete inaccurate or incomplete data, and erase data that is no longer needed;
Withdraw consent at any time. It is as easy to withdraw as it was to give: write to us, or delete your account. Withdrawing does not affect what we did before, and some services cannot work without your data;
Complain to us, and if we do not resolve it, to the Data Protection Board of India;
Nominate another person to exercise these rights if you die or cannot.

You also have duties: give correct information, do not pretend to be someone else, and do not file false complaints.

To use a right, write to the Grievance Officer at vaidyara.com@gmail.com. We reply within a reasonable time and, for complaints, within the period the law sets. For a medical record held by a clinic, we pass your request to that clinic, which decides it.

8. Children

A person under 18 can use Vaidyara only through a parent or lawful guardian, who must give consent on the child's behalf. Parents can add a child as a family member and manage their records. We do not track children's behaviour or show them advertising.

9. Cookies

We use only the cookies needed to keep you signed in and secure, and to remember choices like your sign-in role. We use no advertising or analytics cookies.

10. Changes to this notice

If we change this notice in a way that matters, we update the version and date at the top and ask you to agree again when you next sign in. Earlier versions are available from us on request.

11. Contact and Grievance Officer

Grievance Officer, Vaidyara
Email: vaidyara.com@gmail.com

You can also read our Terms and Conditions.