Privacy policy
Last updated: 22 July 2026
This Privacy Policy explains how VaidyaX (“VaidyaX”, “we”, “us”, “our”) collects, uses, shares, and protects personal data when you use our clinic-management platform, related apps, and website (together, the “Service”). It is written for clinics, hospitals, and their patients in India and follows the principles of India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”). For the operational and clinical records a clinic enters, that clinic is the Data Fiduciary and VaidyaX acts as a Data Processor on its behalf. Please read this policy together with our Terms of Service.
1. Who this policy covers
This policy applies to clinic owners, doctors, and staff who use VaidyaX, to visitors of our website, and to patients whose information a clinic processes through the Service. Where your clinic controls your records, please also refer to your clinic’s own privacy notice.
2. Information we collect
We collect: (a) account and clinic details — name, email, phone, clinic name, address, and login credentials; (b) operational and clinical data your clinic enters — appointments, patient contact details, visit and medical records, prescriptions, and billing entries; (c) payment information — processed by our payment partners; we do not store full card numbers; (d) communications — messages you send to support and notifications configured by your clinic; and (e) technical and usage data — device, browser, IP address, log data, and product analytics events used to keep the Service secure and improve it.
3. How we use your information
We use personal data to provide and operate the Service; to schedule appointments and send the WhatsApp, SMS, and email notifications your clinic configures; to process subscription payments; to provide customer support; to secure the platform and prevent misuse; to comply with legal obligations; and to improve our product using aggregated, de-identified information. We do not use patients’ health records for advertising, and we never sell personal data.
4. Legal basis and consent
We process personal data with the consent you and your clinic provide, to perform our contract with you, to comply with applicable law, and for the legitimate operation of the Service. Clinics are responsible for obtaining the consents required from their patients for the data they enter and the messages they send through VaidyaX.
5. Patient data and your clinic’s role
Clinical records belong to and are controlled by your clinic. We access them only to provide and support the Service, keep each clinic’s data logically isolated from others, and act on your clinic’s instructions to export or delete them. As a Data Processor, we process this data solely on your documented instructions.
6. Sharing and disclosure
We share data only with the sub-processors needed to run the Service — for example cloud hosting, payment gateways (such as Razorpay), and WhatsApp/SMS providers — each bound by contractual confidentiality and data-protection obligations. We may also disclose data where required by law or valid legal process, and in connection with a merger, acquisition, or asset sale, subject to this policy. We never sell personal data.
7. Cookies and analytics
Our website uses strictly necessary cookies to function and privacy-respecting analytics to understand usage and keep the site secure. You can control or block cookies through your browser settings; some features may not work correctly if you do.
8. Data security
We protect data with encryption in transit (TLS), role-based access controls, authentication, activity logging, regular backups, and monitoring. While no method of transmission or storage is completely secure, we work continuously to safeguard your information and to notify affected parties and authorities of a reportable breach as required by law.
9. Data retention
We retain personal data for as long as your account is active and as needed to provide the Service. On account closure you may export your data, after which we delete or de-identify it within a reasonable period, unless longer retention is required by law or for the establishment or defence of legal claims.
10. Where your data is stored
We primarily store and process data on infrastructure located in, or serving, India. Where any processing occurs outside India, we apply safeguards consistent with applicable law to ensure your data receives a comparable level of protection.
11. Your rights
Subject to applicable law, you may access and obtain a summary of your personal data, correct or update it, request its erasure, withdraw consent, and nominate another individual to exercise your rights in the event of death or incapacity. You also have the right to grievance redressal (see below). Patients should contact their clinic first, as the clinic controls their records.
12. Children’s data
VaidyaX is intended for use by clinics and their staff, not directly by patients or children. Where a clinic records information about a minor, the clinic is responsible for obtaining verifiable consent from a parent or lawful guardian as required by the DPDP Act and other applicable law.
13. Changes to this policy
We may update this policy from time to time. We will post the revised version here with a new “last updated” date and, for material changes, provide additional notice through the Service or by email. Your continued use of the Service after changes take effect means you accept the updated policy.
14. Grievance officer and contact
For questions, requests, or complaints about this policy or your personal data, contact our Grievance Officer at contact@vaidyax.com. We will acknowledge your request promptly and resolve it within the timelines required by the DPDP Act and other applicable law.
This page is provided for general information and is not legal advice. Please have it reviewed by qualified counsel before relying on it.