Privacy Policy
Last updated: 24 September 2026
This policy explains what personal data ClinicForYou handles, why, and what you can ask us to do with it. It is written for India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).
1. Who we are
ClinicForYou is a service operated by MBB INTERVIEW PREPARATION COACHING (OPC) PRIVATE LIMITED, a company registered in India.
- Registered address
- Flat 2041, Tower 2, Prestige Ferns Residency, Harlur Road, HSR Layout, Bengaluru 560102, Karnataka, India
- ashrithshetty15@gmail.com
- Phone / WhatsApp
- +91 96112 34765
2. Our role: we act for the clinic
ClinicForYou is a tool clinics use to talk to their own patients. The clinic decides which patients it communicates with and why. Under the DPDP Act the clinic is the Data Fiduciary and ClinicForYou is a Data Processor acting on the clinic's instructions.
In practice this means: we do not decide what a clinic does with its patient list, we do not contact patients for our own purposes, and if you are a patient asking about your data, the clinic you visited is the first place to ask. We will help them, and you can also write to us directly using the address above.
3. Data we process
About the clinic
- Clinic name, address and contact details.
- Doctor names, qualifications, specialty, working hours and leave dates.
- An optional profile photograph, if the doctor uploads one.
- The clinic's WhatsApp Business number and account identifiers.
- Login credentials for the dashboard.
About patients
- Name and mobile number.
- Preferred language (English or Kannada).
- Appointment details — which doctor, date, time, and whether the visit happened, was cancelled or was missed.
- The content of WhatsApp messages exchanged between the patient and the clinic through the assistant.
- Where the booking came from, and basic timing used to estimate waiting times.
Notes and documents the clinic adds
The dashboard lets clinic staff write a free-text note against a visit, and attach documents to it — for example a lab report or a prescription the clinic itself produced.
This content can be health information, and we treat it as such. It is visible only to that clinic's signed-in staff, is never shown to other clinics, is never used for any purpose beyond showing it back to the clinic, and is deleted when the clinic deletes the note or document, or when the account is closed (see section 7).
ClinicForYou is not a medical-records system and is not intended to be used as one. The clinic decides what it puts in these fields and is responsible for having a lawful basis to do so.
What we do not collect
- No payment card details. We do not process patient payments.
- No government identifiers — no Aadhaar, PAN or similar.
- No location tracking, no advertising identifiers, no behavioural profiling.
- No cookies for tracking or analytics on this website. This site sets no cookies at all.
4. Why we process it
We use the data above only to run the service the clinic has asked for:
- Taking, changing and cancelling appointments.
- Sending appointment confirmations and reminders on WhatsApp.
- Replying with a WhatsApp message when a patient gives a missed call to the clinic.
- Showing the clinic its own queue, bookings, patient list and summary reports.
- Keeping the service secure, diagnosing faults, and preventing misuse.
We do not sell personal data. We do not share it with advertisers. We do not use patient data to train models or to market anything to patients.
5. Consent for WhatsApp messages
WhatsApp messages are sent from the clinic's own WhatsApp Business number. The clinic is responsible for having the patient's consent to be contacted there, and for complying with the WhatsApp Business Messaging Policy. A patient can stop messages at any time by telling the clinic, or by blocking the number in WhatsApp.
6. Who else is involved
We use a small number of service providers to run ClinicForYou. Each processes data only to provide their service to us.
| Provider | What they do | Data involved |
|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Delivers the WhatsApp messages between the clinic and its patients | Patient mobile number and message content |
| Exotel | Telephony for the missed-call feature, where a clinic uses it | Caller's mobile number and the number dialled |
| Railway | Hosting for the application and its database | All data described in section 3 |
| Vercel | Hosting for this website only | None. This site has no login, no forms and no tracking |
Some of these providers operate infrastructure outside India. Where that happens, the transfer is made in accordance with the DPDP Act and the provider's own contractual commitments.
We may also disclose data where we are required to by law, or to establish or defend a legal claim.
7. How long we keep it
- While the clinic uses the service. Appointment history and patient contact details stay available to the clinic so it can recognise returning patients and see past visits.
- After an account closes: deleted within 90 days. When a clinic stops using ClinicForYou, its data — including patient records, notes and documents — is deleted within 90 days.
- On request: sooner. A clinic or a patient can ask for deletion at any time. See section 9.
WhatsApp message delivery is handled by Meta, and their retention of message data is governed by their own policies.
8. How we protect it
- All traffic to the service and this website is encrypted in transit using HTTPS.
- Access to the dashboard requires a per-clinic key; sessions are signed and expire.
- Each clinic can only ever see its own patients. Every lookup is scoped to the signed-in clinic, and this is enforced in the code rather than left to the screen you are on.
- Incoming WhatsApp messages are verified as genuinely from Meta before being accepted.
- The waiting-room display screen shows appointment times or token numbers only — never a patient's name.
- Access to production systems is limited to the people who operate the service.
No service can promise perfect security. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.
9. Your rights
Under the DPDP Act you may ask us to:
- Access the personal data we hold about you.
- Correct anything that is inaccurate, incomplete or out of date.
- Erase your data, where we are not required to keep it.
- Nominate someone to exercise these rights on your behalf if you are unable to.
- Complain if you are unhappy with how we have handled a request.
To make a request, email ashrithshetty15@gmail.com with the details set out on our Data Deletion page. We respond within 30 days.
If you are a patient, please also tell the clinic you visited — they are the Data Fiduciary and they hold the relationship with you.
10. Children
ClinicForYou is used by clinics, not by children directly. Where a clinic books an appointment for a child, the clinic is responsible for obtaining verifiable consent from a parent or guardian as the DPDP Act requires. We do not knowingly process a child's data for any purpose other than that appointment, and we do not use it for tracking or advertising.
11. Grievance Officer
If you are not satisfied with how we have handled your data or your request, you can contact our Grievance Officer:
- Grievance Officer
- Ashrith Shetty
- ashrithshetty15@gmail.com
- Address
- Flat 2041, Tower 2, Prestige Ferns Residency, Harlur Road, HSR Layout, Bengaluru 560102, Karnataka, India
You also have the right to complain to the Data Protection Board of India.
12. Changes to this policy
If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle personal data, we will tell the clinics using ClinicForYou by email to their registered address before it takes effect.