1. Information We Collect

Doctors: Name, email, phone number, qualifications, experience, practice locations, procedures, photos, OTP verification data, IP address, user agent, consent timestamps.

Patients: Name, email, phone number (optional), appointment history, clinical feedback responses, IP address, user agent.

Automatically: Browser type, device information, IP address, access timestamps, pages visited.

2. How We Use Your Information

We use your information to: (a) operate and maintain the platform; (b) display doctor profiles and websites; (c) facilitate appointment scheduling; (d) process payments and subscriptions; (e) generate clinical ratings from patient feedback; (f) send transactional communications (receipts, reminders); (g) ensure security and prevent fraud; (h) comply with legal obligations.

3. Data Sharing

We do not sell your personal data. We share data only: (a) with the doctor you book an appointment with (patient data); (b) with payment processors for subscription payments; (c) when required by law or legal process; (d) to protect the rights and safety of our users.

4. Data Security

We implement industry-standard security measures including: HTTPS encryption in transit, password hashing (bcrypt), JWT-based authentication, OTP verification for doctor registration, IP/audit logging for consent records.

Premium doctors can export their interaction data in Fernet-encrypted (AES-128 CBC + HMAC-SHA256) format. Patients can download their own interaction history at any time. No personal health records or clinical data is stored on DocSite — only scheduling and interaction data. The encryption key is derived from the doctor's own passphrase and is not stored by DocSite.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Appointment records and feedback are retained for legal and medical record-keeping purposes. You may request deletion of your account and data (see Section 7).

6. Cookies & Local Storage

We use browser local storage for authentication tokens and PWA offline caching. We do not use third-party tracking cookies. The service worker caches doctor website pages for offline access.

7. Your Rights

You have the right to: (a) access your personal data; (b) correct inaccurate data; (c) request deletion of your data; (d) withdraw consent for data processing; (e) receive a copy of your data in a portable format (doctors: via encrypted export).

To exercise these rights, contact us at vt@chainx.live.

8. Compliance

DocSite is designed with data protection principles in mind, aligned with: (a) India's Digital Personal Data Protection Act 2023 (DPDP); (b) General Data Protection Regulation (GDPR) where applicable; (c) Health data handling best practices.

We are continuously improving our compliance posture. For specific compliance inquiries, contact vt@chainx.live.

9. Children's Privacy

DocSite is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or platform notification. Continued use of the platform after changes constitutes acceptance.

11. Contact

Data Protection Officer: vt@chainx.live

ChainX Tech Labs, India