Privacy Notice for Patients
Version 2026-11 · How ConfirmDoc handles your personal data on the booking website and the patient app, under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules under it. Template — have a legal adviser review it before launch.
1. Who is responsible
- ConfirmDoc is a brand of Dady Affordable Hospitals Private Limited ("we"), (CIN U72900HR2020PTC085373, GSTIN 06AAHCD6671L2Z7), with its registered office at Plot No. 17, Phase 4, Maruti Udyog, Sector 18, Sarhol, Gurugram, Haryana 122015.
- For finding and booking (your account, searches, bookings made on the site, reviews, problem reports) Dady Affordable Hospitals Private Limited is the Data Fiduciary.
- For your medical records (consultation notes, prescriptions, test results, reports, bills) the hospital, clinic, lab or scan centre that treats you is the Data Fiduciary. ConfirmDoc stores them for that provider and shows them to you when you sign in.
2. What we collect and why
| Data | Why |
|---|---|
| Mobile number, name, age or date of birth, gender, family members you add | To create your account, book for you and your family, and send booking messages |
| Address and pincode (only for home sample collection) | So the lab can collect samples at home |
| Bookings, payments status (paid / unpaid / refunded) | To show your bookings, receipts and refunds |
| Prescriptions and reports you upload | Only to send to the provider you choose |
| Reviews and problem reports | To show verified reviews and to resolve complaints |
| Search words (without your phone number or name) | To improve the site and bring on providers patients look for |
| Your ABHA number and ABHA address, if you link them | To show your ABHA card and, with your consent, link and share records through ABDM — see ABDM & your ABHA. We never store your Aadhaar number |
| Your location, when you tap "Near me" | Only to sort results by distance for that search — it is not stored |
| Device and log data (IP address, browser) | Security, fraud prevention and keeping the service running |
We do not collect card numbers, UPI PINs or bank passwords: payments are handled by the provider's payment service (for example Razorpay).
3. Consent
- When you verify your mobile number or confirm a booking you agree to this notice. We record the version and the time.
- You can withdraw consent by deleting your account (from the patient app → Privacy, or by writing to the Grievance Officer). Records a provider must keep by law (for example medical records) stay with that provider.
4. Who sees your data
- The provider you book with — your details, booking and anything you send them.
- Service providers working for us — SMS / WhatsApp delivery, cloud hosting, email, the provider's payment gateway — only to do that job, under contract.
- Authorities — only when the law requires it.
- We do not sell your data or use your health information for advertising.
5. How long we keep it
- Account and booking data: while your account is active, then up to 3 years for disputes and tax / consumer-law records.
- Search logs: 2 years, without identity. Consent records: as long as needed to show consent was given.
- Medical records: as long as the provider must keep them by law.
6. Your rights
Under the DPDP Act you can ask to see your data, correct or update it, erase it (subject to legal holds), nominate someone to act for you if you are unable to, and complain. Use the patient app (Privacy) or write to the Grievance Officer. If you are not satisfied with the answer you can complain to the Data Protection Board of India.
7. Children
A parent or legal guardian books and consents for anyone under 18. We do not track children's behaviour or show them targeted advertising.
8. Security
Data is encrypted in transit and at rest, stored in India, access is limited and logged, and providers can see only their own patients. More in How we keep your data safe. If a breach affects you, we will tell you and the Data Protection Board as the law requires.
9. Contact
Grievance Officer — see the Grievance page. We reply within 24 hours and resolve within 15 days (at the latest within one month).