DoctorReview Pro← Back to app

Privacy Policy

Last updated: 12 July 2026

This Privacy Policy explains how The Presence Lab(“we”, “us”, “our”) collects, uses, and protects information through DoctorReview Pro(the “Service”). We are committed to handling all data in accordance with the Digital Personal Data Protection Act, 2023 (India), the Information Technology Act, 2000, and applicable healthcare data regulations.

1. Who this policy covers

This policy applies to two types of users of our Service:

  • Clinic users — doctors, clinic staff, and administrators who sign up for DoctorReview Pro to manage patient reviews
  • Patients — individuals who interact with the Service through QR codes, WhatsApp links, or direct review links shared by a clinic they have visited

2. Information we collect from clinics

When clinic users sign up and use the Service, we collect:

  • Full name and email address (for account creation)
  • Clinic name, doctor name, specialty, phone, address, and city (entered by the clinic)
  • Google review URL and brand customization (color, slug)
  • Payment information (handled by Razorpay — we do not see or store your card details)
  • Usage data: pages visited, actions taken, technical logs for debugging

3. Information we collect from patients

We collect minimal patient data, and only when the patient voluntarily provides it.

The Service works in two ways depending on the patient's review rating:

  • Positive reviews (4–5 stars): We do NOT collect any patient personal information. The Service simply helps the patient draft a review they can post on Google. The patient is redirected to Google to post the review under their own Google account.
  • Negative or neutral reviews (1–3 stars): We collect only what the patient voluntarily provides — their feedback message, and optionally their name, email, and phone number if they choose to share. This information is shared only with the relevant clinic so they can address the concern.

Patients are not required to provide any personal information to leave feedback. All fields except the feedback text are optional.

4. We do not collect health or medical data

DoctorReview Pro is not a medical records system. We do not collect, store, or process any of the following:

  • Medical history, diagnoses, or treatment information
  • Prescription or medication data
  • Health insurance or claims data
  • Lab results or any clinical records
  • Aadhaar or government ID numbers

If a patient voluntarily includes such information in a free-text feedback message, we treat it as confidential and process it only to deliver the feedback to the relevant clinic.

5. How we use information

We use the information we collect to:

  • Operate the Service (account access, review collection, notifications)
  • Send transactional emails (verification, password reset, billing receipts, negative review alerts)
  • Process subscription payments through Razorpay
  • Improve the Service through anonymized usage analytics
  • Detect and prevent abuse, fraud, and security incidents
  • Comply with legal obligations under Indian law

We do not sell, rent, or trade your data with third parties for marketing purposes.

6. Service providers we use

To operate the Service, we use the following trusted third-party providers:

  • Supabase — secure database hosting and user authentication
  • Vercel — application hosting and content delivery
  • Razorpay — payment processing
  • Resend — transactional email delivery
  • Google Gemini API — AI-powered review draft generation (text only, no personal information sent)

These providers process data only on our behalf, under contractual obligations to keep it secure and confidential.

7. Data security

We protect your data using industry-standard practices, including:

  • Encrypted connections (HTTPS/TLS) for all data in transit
  • Encrypted storage at rest (managed by Supabase)
  • Row-level security policies — clinic data is isolated, so one clinic cannot access another's data
  • Secure password storage (hashed, never stored as plain text)
  • Limited access — only authorized team members can access the production database, and only when necessary

No system is 100% secure, but we take reasonable care to protect your information.

8. Data retention

We retain your data as long as your account is active. If you delete your account, all associated data (clinic info, reviews, patient feedback, services, keywords) is permanently deleted within 30 days, except where retention is required by law (e.g., billing records kept for 7 years for tax purposes).

Patient feedback data is retained as long as the clinic account exists, since the clinic owns this data. Clinics can delete individual reviews from their inbox at any time.

9. Your rights under the DPDP Act, 2023

As a Data Principal under India's DPDP Act, 2023, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Erase your data (subject to legal retention requirements)
  • Withdraw consent for data processing at any time
  • Grievance redressal — file a complaint with us, and ultimately with the Data Protection Board of India if unresolved
  • Nominate another individual to exercise your rights in case of death or incapacity

To exercise any of these rights, email us at imran@thepresencelab.in. We will respond within 30 days.

10. Cookies and tracking

We use only essential cookies needed for the Service to function — such as keeping you signed in. We do not use advertising cookies, behavioural tracking, or third-party analytics that identify individuals.

11. Children's privacy

The Service is not intended for users under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided information through the Service, please contact us and we will delete it promptly.

12. International transfers

Some of our service providers (e.g., hosting, email delivery) operate from outside India. When data is transferred internationally, we ensure providers maintain protection standards equivalent to Indian law.

13. Changes to this policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email or through the Service. The “Last updated” date at the top of this page always reflects the most recent revision.

14. Contact and grievance officer

For any questions about this Privacy Policy, to exercise your rights under the DPDP Act, or to file a grievance regarding your personal data:

The Presence Lab
Email: imran@thepresencelab.in
Navi Mumbai, Maharashtra, India

We aim to acknowledge all grievances within 7 days and resolve them within 30 days.