Privacy Policy

1. Who We Are

108doctors is a healthcare platform that works with your clinic to manage your appointments, medical records, prescriptions, lab reports, billing, and pharmacy. When your clinic registers you on 108doctors, we communicate with you directly, for example, through WhatsApp to send you appointment reminders, lab results, prescription updates, and other information related to your care.

This policy explains what information we handle, why, how we protect it, and what rights you have. It is written for you, the patient, in plain language.

We are based in India and follow India's Digital Personal Data Protection Act, 2023 (DPDP Act), the DPDP Rules 2025, the Information Technology Act 2000, and all other applicable Indian laws governing health data and privacy.

2. What Information We Handle

When your clinic registers you on 108doctors, the following information is processed through our platform:

Your identity information - your name, phone number, address, age, and gender, as provided by you to your clinic during registration.

Your health information - appointment details, diagnoses, treatment notes, prescriptions, lab results, and medication records. This is the most sensitive category of data we handle, and it receives the highest level of protection.

Financial and billing information - consultation fees, payment records, insurance details if applicable, and invoices generated through the platform.

Pharmacy records - prescriptions filled, medications dispensed, and related records. For Schedule H and Schedule H1 drugs, we maintain the additional records required under the Drugs and Cosmetics Act, 1940.

Communication records - messages sent to you through WhatsApp, including appointment reminders, lab results, prescription updates, and other clinic-related information. We keep a log of what was sent and when.

Technical information - basic device and usage data necessary to keep the platform running, secure, and stable. We do not track your browsing activity or build advertising profiles.

3. Why We Use This Information

Every piece of information we handle has a clear, stated purpose:

To support your care - managing your appointments, maintaining your medical record, processing your bills, coordinating prescriptions with the pharmacy, and delivering lab results to you and your doctor.

To communicate with you - sending you appointment reminders, lab results, prescription updates, and other information related to your care through WhatsApp. These messages may contain clinical information such as your test results or medication details, and are sent through WhatsApp's Business Platform, which encrypts messages during transit.

In a medical emergency - if there is an urgent medical situation, Indian law (DPDP Act, Section 4(2)) allows your data to be processed without separate consent to protect your life or provide immediate care. This is a safeguard, not a routine practice.

To keep the platform safe - detecting security threats, preventing unauthorized access, and maintaining the reliability of the system.

To improve healthcare through anonymized insights - we may use fully anonymized, aggregated data (where no individual can be identified) to understand broad health trends, such as which medications are commonly prescribed in a given region. Section 7 below explains exactly how we do this and why it is safe.

We do not use your information to advertise to you. We do not sell your information to anyone. We do not share your identifiable data with any third party for their own purposes.

4. How Your Information Enters Our Platform

When you visit your clinic and provide your name, phone number, and other details for the purpose of receiving care, your clinic registers you on 108doctors as part of their standard process. By providing your information to the clinic for the purpose of treatment, your data is processed through the platform as a necessary part of how your clinic operates.

After registration, we send you a WhatsApp message informing you that your clinic uses 108doctors, explaining what the platform does, and providing a link to this privacy policy so you can read the full details of how your data is handled.

You do not need to sign multiple forms or respond to any message to continue receiving care. Your agreement to receive treatment at the clinic includes the use of the technology the clinic relies on to provide that treatment.

If at any point you wish to stop your data from being processed through 108doctors, you may exercise your rights described in Section 5 below.

5. Your Rights Over Your Information

Indian law gives you enforceable rights over your personal data. Here is what you can do:

See your data - you can ask us what personal information we hold about you, and we will provide it.

Correct it - if anything is wrong or outdated, you can ask us to fix it.

Delete it - you can ask us to erase your personal data. We will do so, except where the law requires your clinic to retain certain medical records. The Medical Council of India (now NMC) requires indoor patient records to be kept for a minimum of 3 years, and outpatient records for 2 years. Pharmacy records for Schedule H and H1 drugs must be retained as required by the Drugs and Cosmetics Act. If any part of your deletion request cannot be fulfilled due to a legal requirement, we will tell you clearly what is being retained and why.

Stop processing - you can ask us to stop processing your data. Since your data is processed as part of receiving care at your clinic, this may affect your clinic's ability to continue managing your care through 108doctors. If you wish to stop, please contact us and we will work with your clinic to arrange this. Nominate someone - you can nominate another person to exercise your data rights on your behalf in case of your death or incapacity. This is a right given to you under the DPDP Act.

To exercise any of these rights, contact us at info@108doctors.com. We will acknowledge your request within 48 hours and resolve it within 7 days.

6. How We Protect Your Information

We take the following specific security measures, as required by the DPDP Rules 2025:

Encryption - your data is encrypted both when it is stored and when it is being transmitted between systems. This means even if someone intercepted the data, they could not read it.

Access controls - only authorized staff at your specific clinic can access your records. Staff from other clinics on the platform cannot see your data. Our own team can only access patient data for specific, logged support or security reasons.

Masking and tokenization - where possible, sensitive data elements are masked or tokenized so that even within our own systems, exposure is minimized.

Audit logging - every access to patient data is recorded: who accessed it, when, and what they did. These logs are retained for a minimum of 1 year, as required by the DPDP Rules.

Business continuity - we maintain backup and recovery systems so that your data is not lost due to technical failures, and remains available when your clinic needs it.

Regular review - our security practices are reviewed and updated regularly.

If something goes wrong - a data breach - we will inform the Data Protection Board and support your clinic in notifying you promptly. We will explain what happened, what data was affected, and what we are doing about it. Under the DPDP Act, every breach must be reported regardless of severity.

7. Aggregated, Anonymized Data - How We Use It and Why It Cannot Identify You

Separately from your personal medical records, we create large-scale, anonymous statistics to understand healthcare trends. For example: "How many patients in Maharashtra were prescribed a particular category of medication this quarter?" This kind of information helps improve healthcare delivery and our own product.

Here is exactly what we do to make sure this data can never be traced back to any individual:

We remove all identifying information - your name, phone number, address, age, and every other piece of data that could identify you is stripped out completely before any aggregation happens.

We only report on groups large enough to be safe - if a particular medication-region-time combination involves fewer than a minimum number of patients, we do not report on that group. We either merge it with a broader category or leave it out entirely. This is called small-cell suppression, and it is the standard method used worldwide to protect individuals in health data.

We generalize time periods - we use months or quarters, not exact prescription dates, to prevent identification through timing.

We keep this data completely separate - anonymized aggregate data lives in a different system from your identified medical records, with different access controls and different personnel.

If we ever plan to share this aggregate data outside 108doctors (for example, with a research institution or a health industry partner), we will notify clinics in advance and enter into a separate agreement for that purpose. This is not something we do under this policy today.

8. Who Else Can See Your Data

Your clinic and treating doctor - since they are providing your care.

The pharmacy - if your prescription is routed through the platform for dispensing.

Labs - if your clinic uses the platform to send lab orders or receive results.

Our technology partners - the companies that help us run the platform (cloud hosting, WhatsApp's Business Platform provider). Each of these partners is bound by a contract that requires them to protect your data, use it only for the specific service they provide to us, and not use it for their own purposes.

Government or regulatory authorities - only if required by law, such as a valid court order, a direction from the Data Protection Board, or a mandatory public health reporting obligation.

9. Cross-Border Data

Our primary systems and servers are located in India. However, some of our technology partners (such as Meta, which operates WhatsApp's messaging infrastructure, and our cloud hosting provider) may process certain data outside India as part of their normal operations. The DPDP Act permits data transfers to countries that the Indian government has not restricted. As of now, no countries have been placed on the restricted list. If that changes, we will adjust our operations accordingly.

10. How Long We Keep Your Data

Medical records (indoor/inpatient) - minimum 3 years from the date treatment began, as required by the Medical Council of India (now NMC) Regulations. Your clinic may choose to retain records longer based on the nature of treatment.

Medical records (outpatient) - minimum 2 years.

Pharmacy and drug dispensing records - as required under the Drugs and Cosmetics Act, 1940. Schedule H/H1 drug records follow their specific statutory retention periods.

Billing and financial records - as long as necessary for the stated purpose, plus any period required by tax or financial regulations.

WhatsApp communication logs - retained for 12 months, then deleted.

Security and audit logs - minimum 1 year, as required by the DPDP Rules.

When data is no longer needed for its stated purpose, and no law requires us to keep it, we delete it securely. If you ask for deletion, we delete everything we are legally permitted to delete and tell you clearly what, if anything, must be retained and for how long.

11. WhatsApp - What You Should Know

Your clinic communicates with you through WhatsApp using 108doctors' business number. Messages may include appointment reminders, lab results, prescription details, billing information, and other updates related to your care.

Some information about the fact that you are messaging a healthcare platform - such as timing and frequency - is metadata that is not fully protected the same way message content is. We treat this metadata as sensitive information in our own systems.

You can stop receiving WhatsApp messages at any time by contacting us at info@108doctors.com or 9606904177. Please note that this may affect your ability to receive timely updates about your appointments, lab results, and prescriptions.

12. How to Reach Us

If you have any questions about your data, want to exercise any of your rights, or have a concern about how your information is being handled:

Email: info@108doctors.com Phone: 9606904177