Privacy Policy

Last updated: 19 October 2026

DocFX® is a clinic management service (Android app, web booking forms and related services) operated by Stalwart Cyber Rafting Private Limited (CIN U72900MH2018PTC313072), Office No 804, Plot No 39/3, Haware Infotech Park, Sector 30A, Vashi, Navi Mumbai, Maharashtra 400705, India ("we", "us"). This policy explains what personal data we handle, why, and your rights under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable law.

1. Who is responsible for which data

• Patient data (people who book appointments or send enquiries to a clinic) is collected for the clinic, hospital or doctor ("Clinic") you are contacting. The Clinic is the Data Fiduciary for that data; we process it on the Clinic's behalf as its Data Processor. For requests about your patient record, you may contact the Clinic directly or write to us and we will forward it.
• Account data of Clinic users (doctors and their staff who use the DocFX app) is handled by us as Data Fiduciary.

2. Data we collect

From patients (via booking forms, the clinic's app entries or messages)

• Name, mobile number, email (optional), age and gender
• Purpose of visit, message, appointment date and time
• Clinic-recorded information: enquiry follow-up status, consultation notes, treatment packages and sessions, payments received
• One-time passwords (OTPs) used to verify your mobile number

From Clinic users (doctors and staff)

• Name, mobile number, email, clinic or hospital name, access level
• A push-notification token for each phone you sign in on
• Basic technical logs (time of request, IP address, errors) needed to keep the service secure and working

The Android app does not read your call history, SMS, contacts list or location. When you choose "Pick from contacts", Android shares only the single contact you select. The SMS one-time code is read only with your explicit consent through Google's SMS User Consent prompt.

3. Why we use it

• To book, manage and remind about appointments, enquiries and treatment packages for the Clinic
• To verify mobile numbers and sign users in (OTP)
• To notify Clinic users about new bookings, due follow-ups and due sessions
• To send patients confirmations and messages the Clinic chooses to send (e.g. session confirmation emails, reminders, review requests sent by clinic staff from their own WhatsApp)
• To secure the service, prevent misuse and meet legal obligations

We do not sell personal data and do not use patient data for advertising.

4. Sharing with service providers

We share data only as needed to run the service, with providers bound to protect it:

We may disclose data where required by law or a lawful order of an Indian authority.

5. How long we keep it

• Patient and Clinic records are kept while the Clinic uses DocFX, or until the Clinic or the person asks for deletion where the law allows.
• When a Clinic deletes its account, its data is deleted within 30 days, except where we must keep it longer by law.
• Server logs are kept for up to 180 days, as required by CERT-In directions, and then deleted.

6. Security

Data is encrypted in transit (HTTPS). Access is limited by role: for example, consultation notes are visible only to the doctor and staff the doctor gives full access to. We review our systems for security issues and will notify the Data Protection Board of India, CERT-In and affected persons of a personal data breach as required by law.

7. Your rights

Under the DPDP Act you can ask to access a summary of your data, correct or update it, erase it, withdraw consent, and nominate someone to exercise these rights for you. Email privacy@docfx.in from the mobile number or email on the record (we may verify your identity). Clinic users can also delete their account in the app (Profile → Delete my account) or as described on docfx.in/delete-account.html.

8. Children

Clinics may book appointments for patients under 18. In that case the parent or lawful guardian should make the booking and give consent. DocFX is not intended for use by children themselves.

9. Grievance Officer

10. Changes

We will post changes on this page and update the date above. Significant changes will be notified in the app.