Privacy Policy

We collect only what the service needs to work:

• Phone number — your identity on Dr.incity. Used for OTP sign-in and appointment SMS updates.
• Email address (optional) — if you give one, we use it to send your booking confirmation and to let you reach your bookings from another device.
• Name — shown to the clinic you book with so reception can identify you at the desk.
• Booking and queue records — which doctor and clinic you booked, your queue position and its status (waiting, checked in, in consultation, completed).
• Bed and ambulance requests — only if you use these features: the hospital, the bed or ambulance type, the pickup address you type for an ambulance, and any optional note you choose to add. Each request is sent to the one hospital you select, after you tick a separate consent box for that request.
• Notification records — a delivery log of the SMS updates we send you.
• Push notification token — only if you allow notifications in the app, so we can send queue alerts to your phone.
• Consent records — when you accepted this policy and the terms, and which version.
• Payment records — if you pay for a consultation online: the amount, what it was for, its status, any refund, and the reference numbers Cashfree gives us. We never see or store your card, bank account or UPI details.
• Website usage data — only if you allow analytics on our website: the pages you view and your browser and device type. See Cookies and website analytics.

Dr.incity is a queueing and booking service, not a medical records system. We do not collect: diagnoses, symptoms, prescriptions, medical history, lab reports or clinical notes; government IDs (Aadhaar, PAN, passport); insurance information; card numbers, bank account or UPI details (these go only to our payment processor); your device location, contacts, or photos. For appointments we never ask the reason for your visit: that is between you and your doctor. The optional notes on a bed or ambulance request are free text that you choose to type; please do not put a diagnosis or other medical details in them. The ambulance pickup address is an address you type, not your device location.

• Signing you in securely with a one-time password (no passwords stored).
• Creating and managing your bookings and live queue position.
• Sending operational SMS updates about your own appointment — for example when your turn is approaching or your position changes meaningfully. These are service messages, not marketing.
• Marketing SMS is sent only if you separately opt in, and you can withdraw that consent at any time from your account settings.

We do not sell personal data. We do not use it for advertising.

• Your consent — captured explicitly when you sign up, separate from your acceptance of the Terms, never bundled or pre-ticked. You can withdraw the optional parts at any time.
• Providing the service — handling your booking and queue data is necessary to give you the service you asked for.

• The clinic you book with — reception staff at that clinic see your name, phone number, and queue status for your appointment there. Other clinics cannot see you; access is isolated per clinic and enforced at the database level.
• The hospital you send a bed or ambulance request to — sees your name, phone number and the details of that request, and no other hospital does.
• Our SMS delivery provider (Airtel IQ, Bharti Airtel) — receives your phone number and the message text solely to deliver login codes and appointment SMS, and may not use it for anything else.
• Our infrastructure provider (Supabase) — hosts our database. Production data for Indian users is stored in an India-region project, encrypted in transit and at rest.
• Our email provider (Resend) — receives your email address and the message text solely to deliver sign-in codes and booking emails.
• Our website host (Vercel) — serves this website and sees ordinary server logs (such as your IP address and the page requested). Your booking details go from your device to our database, not through Vercel.
• Push notification services (Google Firebase Cloud Messaging, Apple Push Notification service) — if you allow notifications in the app, they receive a device token and the notification text, which never includes your doctor's name or medical details.
• Our payment processor (Cashfree Payments India Private Limited) — if you pay online, Cashfree collects your payment details directly on its own secure checkout and receives your name, mobile number, email (if given) and the amount, to process the payment and any refund. Cashfree is an RBI-authorised payment aggregator. Where the doctor's fee is paid online, Dr.incity receives it on the clinic's behalf and pays it to the clinic after your visit.

If you allow analytics on our website, Google (Google Analytics) also receives the usage data described under Cookies below. No other third party receives your personal data, and we do not sell it.

The website keeps a few cookies and similar items on your device. Most are needed to keep you signed in and to make payments and forms work, and are always on. Google Analytics is optional: it loads only if you click “Allow analytics” in the cookie notice, never runs on clinic staff and doctor screens, and has Google signals and ad personalisation switched off. You can change your answer at any time with “Cookie settings” in the footer. The Dr.incity mobile app uses no cookies and no analytics. The full list, with names and lifetimes, is in our Cookie Policy.

You can delete your account from inside the app or the website account page — no email or phone call required. When you delete your account:

• Your profile (name, phone number and email), your bookings and your queue history are permanently erased.
• Your bed requests, bed admissions and ambulance bookings are permanently erased, and a bed held for you is released back to the hospital.
• Any active queue entry or upcoming booking is cancelled and the seat is released. An upcoming booking you paid for is refunded under the refund policy.
• Notification records and push notification tokens are deleted.
• Clinics keep only non-identifying aggregate statistics, which can never be traced back to you.
• Payment records are kept, unlinked from you, for as long as Indian tax and accounting law requires (currently up to 8 years).
• You are signed out everywhere. Deletion cannot be undone.

You may sign up again later with the same phone number; that creates a fresh account with no connection to the deleted one.

Under the DPDP Act you can, at any time:

• Access the personal data we hold about you.
• Correct your name from account settings.
• Withdraw SMS marketing consent from account settings.
• Change your website cookie choice with “Cookie settings” in the footer.
• Delete your account and personal data, as described above.
• Raise a grievance with our Grievance Officer (below).

All traffic is encrypted with HTTPS. Access to your data is restricted by role-based rules enforced in the database itself — a patient can read only their own records, and a clinic only its own queue. One-time passwords are never stored by us and are rate-limited against abuse. If a breach affecting your personal data ever occurs, we will notify you and the Data Protection Board of India as required by law.

Dr.incity is not directed at children. We do not knowingly collect data from anyone under 18 unless a parent or guardian is completing the booking on their behalf.

If this policy changes materially, we will update the version number above and ask for your consent again in the app before the change applies to you. Continued silence is not treated as consent.

Grievance Officer: Sajid Shaikh, Drincity Healthtech Solutions LLP. admin@drincity.com. We acknowledge grievances within 72 hours and aim to resolve them within 15 days.

See also our Terms of Service.