1. Introduction

Do My Checkup ("DMC", "we", "us" or "our") operates a healthcare platform that may help patients discover healthcare providers, request or book appointments, and receive appointment updates. We may also provide doctors, clinics and hospitals with healthcare management software, including appointment management, patient registration, electronic medical records and administrative features.

This Privacy Policy explains how information may be collected, used, shared, stored and protected when you visit our website or use our services.

2. Information We Collect

The information collected depends on how you use our website, the features enabled, and the information supplied by you or an authorised healthcare organisation.

Personal and Contact Information

• Name and date of birth, where required.
• Phone number and email address.
• Address and location information where relevant.
• Account identifiers and registration details.
• Information submitted through contact or support forms.

Appointment Information

• Appointment requests, dates and times.
• Selected doctors, clinics or hospitals.
• Booking confirmations, changes and cancellations.
• Information needed to coordinate appointment services.

Healthcare and Medical Information

Depending on the service used, information may include patient identifiers, medical history, diagnoses, allergies, prescriptions, consultation notes, laboratory results, treatment records and other clinical information entered into healthcare software.

Doctor and Healthcare Organisation Information

For provider registration and account administration, information may include professional details, qualifications, registration or licence details, speciality, clinic or hospital information, schedules and verification documents.

Technical and Usage Information

Depending on our system configuration, we may process IP addresses, browser and device information, operating system details, access times, requested pages, error logs and security-related events.

Payment Information

Where payments are supported, we may receive transaction references, payment status, amounts and invoice information. Payment details may be processed by third-party payment providers.

3. How We Collect Information

Information may be collected:

• Directly when you register or submit a form.
• When you request or book an appointment.
• When a healthcare provider enters information into its software.
• Through website, hosting and security logs.
• Through authorised integrations and service providers.
• From other sources where lawful and necessary for a service.

4. How We Use Your Information

Depending on the service and applicable law, information may be used for the following purposes.

5. Legal Basis for Processing

Where applicable law requires a legal basis for processing personal information, we will use an appropriate basis for the relevant activity. Depending on the circumstances, this may include consent, performance of a contract, compliance with a legal obligation or another basis recognised by law.

The applicable basis depends on the country, information involved, purpose of processing and the role performed by DMC or the relevant healthcare organisation. This Policy does not replace any separate consent or authorisation required by law.

6. Information Sharing and Disclosure

We may share information when necessary to provide a requested service, operate our systems, protect users or meet legal obligations.

• Doctors, clinics or hospitals associated with an appointment.
• Authorised staff of healthcare organisations.
• Hosting, infrastructure and technical support providers.
• Payment, email, SMS and communication providers.
• Integration partners needed to deliver an enabled service.
• Professional advisers and auditors where appropriate.
• Authorities or other parties where disclosure is legally required or permitted.
• A successor or acquiring entity in a lawful business transaction, subject to applicable law.

7. Healthcare Information and Medical Records

Healthcare information requires particular care. Doctors, clinics and hospitals may determine how clinical records are used for patient care and their own operations. DMC may process information to provide appointment coordination, hosting, software, technical support and other agreed services.

The legal roles of DMC and a healthcare organisation depend on the actual processing activity and applicable law. Where required, appropriate data-processing, confidentiality or healthcare-data agreements must be established.

Patients should contact the relevant healthcare provider for clinical-record requests where that provider controls the record. DMC will assist with requests concerning information for which it has responsibility, subject to applicable law.

8. Data Security

We use or seek to implement technical and organisational safeguards appropriate to our services and the risks involved. No internet transmission or information system can be guaranteed to be completely secure.

Users and healthcare organisations must protect their credentials, restrict staff access appropriately and promptly report suspected unauthorised access or security incidents.

9. Data Retention and Deletion

Information is retained for as long as reasonably necessary for the relevant purposes, contractual arrangements, security requirements and applicable legal obligations.

Retention periods may differ for account information, appointments, payment records, technical logs and medical records. Healthcare organisations may have separate legal duties to retain clinical records.

Information may be deleted, anonymised or otherwise handled when it is no longer required, subject to applicable law, backup procedures and lawful retention requirements. Closing an account does not necessarily require immediate deletion of every record.

10. Your Privacy Rights

Depending on your location and applicable law, you may have rights relating to your personal information.

These rights are subject to applicable conditions and exceptions. Requests for clinical records may need to be directed to the healthcare organisation responsible for those records.

11. Cookies and Tracking Technologies

Our website may use cookies or similar technologies for essential functionality, security, preferences, analytics or other purposes. The actual technologies and providers depend on our website configuration.

Optional analytics or advertising technologies may require consent or a choice mechanism in some jurisdictions. You can also manage cookies through your browser, although blocking certain cookies may affect website functionality.

12. International Data Transfers

Our services may involve users, healthcare organisations, infrastructure or service providers in different countries. Information may be transferred across borders where necessary to provide a service and permitted by applicable law.

Where required, appropriate transfer mechanisms and safeguards must be used. Requirements depend on the countries involved, the information processed and the parties' legal roles.

13. Third-Party Services and Integrations

Our website or software may link to or integrate with third-party hosting, payment, communication, mapping, video consultation, identity verification or healthcare information services.

Third parties may process information under their own terms and privacy notices. Review the applicable notices before submitting information directly to those services.

Where an integration exchanges healthcare information, additional authorisation, consent, security measures or agreements may be required.

14. Marketing and Service Communications

We may send essential service communications, such as appointment confirmations, booking changes, account notices and security alerts, where permitted by law.

Marketing communications must comply with applicable consent, unsubscribe and electronic-communications requirements. You may opt out of eligible marketing messages using the available method. Essential service messages may still be necessary.

15. Children's Privacy

The collection and use of children's information must comply with the laws applicable to the child and the service. A parent or lawful guardian may need to act or provide authorisation where required.

Age requirements and parental-consent rules vary by jurisdiction. We will take appropriate action when we become aware of processing that violates applicable legal requirements.

16. Automated Processing and AI

If a service uses automated processing or artificial intelligence for support, administration, recommendations or other features, the relevant feature should explain its purpose and limitations where required by law.

This Policy does not authorise automated decisions involving health information where prohibited by law or where additional safeguards or consent are required.

17. Legal and Regulatory Requirements

Privacy and healthcare-data obligations depend on the countries where users, healthcare organisations and service providers operate, as well as the role DMC performs.

Depending on the circumstances, additional obligations may arise under India's digital personal data protection framework, the EU or UK data-protection regimes, United States health-information and consumer-protection rules, or other applicable laws.

Mentioning a law does not mean every provision applies to every user or that this Policy alone establishes compliance.

18. Changes to This Privacy Policy

We may update this Policy when our services, information practices or legal obligations change. We will update the revision date and provide additional notice or obtain consent where required by applicable law.

The revised Policy will apply from its stated effective date, subject to any required acceptance or consent process.