Patient privacy, plainly explained
How your patient data is protected on DocSite.
A one-pager you can share with your patients — written in plain language, with the technical details tucked away for the rare patient who wants to see them. No security jargon, no marketing fluff. Just what actually happens to a phone number from the moment a patient types it in.
Why this even needs explaining
Most patient bookings online aren't as private as they look.
When a patient books through an aggregator or a hospital chain, their phone number and condition usually end up in three places: the platform itself, the platform's marketing partners, and — eventually — a call-centre that follows up to upsell tests and packages. The patient gave consent to "see a doctor", but ended up giving consent to a marketing pipeline.
DocSite was built so that the doctor, not a marketing system, owns the patient relationship. The six layers below explain how that's technically enforced — in language a patient who has never written a line of code can read in 90 seconds.
The 6 protection layers
What actually happens to a patient's phone number on DocSite.
Your phone number and email are locked at rest.
Even if DocSite's database itself were ever copied or leaked, the rows containing your phone number and email would look like random scrambled text — unreadable without a key that DocSite never stores in the same place.
Every page you load uses a private connection.
Every time you book, message, or load a doctor's page, your browser and DocSite establish a private channel that nobody else on the network — your café Wi-Fi, your office router, even your internet provider — can read.
Only the doctor you reached out to can see your details.
DocSite's servers can read your booking and route it, but the doctor's authenticated session — and only that session — sees your decrypted contact details. Other doctors on the platform cannot.
Nobody at DocSite is reading your messages.
There is no marketing team, no aggregator partner, and no third-party advertiser with access to your conversations. We don't sell patient lists. We don't share data with hospital chains. The platform exists to connect you to your doctor — that's it.
India's privacy law (DPDPA) and NMC rules apply by default.
DocSite is built to comply with India's Digital Personal Data Protection Act and the National Medical Commission's telemedicine and patient-record guidelines. You have the right to ask for a copy of your data, or to ask for it to be deleted.
Your data lives in India.
DocSite's servers and database are hosted in Indian data centres. Your records are not transferred outside the country, which keeps them inside Indian privacy law and Indian courts.
Your rights as a patient
What you can ask for at any time.
A copy of your data
You can ask DocSite (or the doctor you reached out to) for everything they hold about you — bookings, messages, contact details — and get it in a readable format.
Your data deleted
You can ask for your records to be removed. Bookings older than the legally required retention window (NMC: 3 years for adults, 21 years for minors) will be deleted on request.
A correction
If your phone number, email, or any record about you is wrong, you can ask for it to be corrected. Doctors can do this directly from their dashboard.
A grievance heard
If you feel your data has been mishandled, write to privacy@docsite.care. Indian DPDPA gives you the right to escalate to the Data Protection Board if not resolved in 30 days.
Source: India's Digital Personal Data Protection Act, 2023 (§ 11–13) and the National Medical Commission's Telemedicine Practice Guidelines, 2020. DocSite implements both by default.
Trust isn't a tagline. It's a stack.
Six layers, one outcome — the patient–doctor conversation stays between the two of them. That's the entire reason DocSite exists.