Effective Date: 21 August 2026 · Applies to all users of the hApItal platform
hApItal is a healthcare appointment marketplace and emergency services directory developed and operated by hApItech. We are committed to protecting the privacy of every individual who uses our platform, whether as a patient seeking a doctor or as a doctor listing their practice. This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, how we protect it, and what rights you have over it. It also explains what permissions the hApItal patient application may request from your device and how those permissions are used. By accessing or using hApItal, you acknowledge that you have read and understood this policy.
When you use hApItal as a patient, we collect your mobile phone number to create and verify your account through a one-time password. When you book an appointment, we collect your name, age, gender, and a brief description of your symptoms, which are necessary to complete the booking and inform the treating doctor. Where you book an appointment on behalf of a family member, we collect the name, age, and gender of the family member for whom the appointment is being made. We also retain a record of your appointment history, the status of each appointment, and any reviews or ratings you submit. If a consultation fee is charged, we receive a payment transaction reference from our payment processor, Razorpay. We do not store your card number, UPI ID, or bank account details at any point.
When you use the emergency services section of the patient application and grant location permission, we collect your device's approximate GPS coordinates at the moment you initiate the search. These coordinates are used solely to calculate the distance between your current location and nearby emergency service providers — such as ambulance services, hospitals, blood banks, and pharmacies — and to display those results sorted by proximity. Your location coordinates are processed in real time and are not stored on our servers after the results are displayed. You may decline to grant location permission, in which case you can still search for services manually, though distance-based sorting will not be available.
When you enable push notifications in the patient application, we collect a unique push notification token assigned to your device by the notification infrastructure. This token is used solely to deliver appointment-related notifications directly to your device and is not used to identify or track you personally. You may revoke notification permission at any time through your device settings, and doing so will not affect your ability to book appointments or use any other feature of the platform.
When you use hApItal as a doctor, we collect your name, mobile number, email address, medical registration number, and specialty at the time of registration. We also collect your clinic name, address, city, state, consultation fee, availability schedule, and profile photograph. If you configure time-based appointment slots, we retain your slot schedule, including the days, times, and maximum patient capacity you have set for each slot. Prescriptions you create through the platform are stored securely and associated with the relevant patient appointment. As part of the credential verification process, you will be required to upload a copy of your medical registration certificate; this document is stored in private encrypted storage and is reviewed by hApItech's review team for the sole purpose of confirming the validity of your registration. It is not shared with patients or any third party. Prescription reports or supporting medical documents you upload to accompany a consultation are likewise stored in private encrypted storage and linked only to the specific appointment they relate to.
Members of the hApItech team may access booking records, patient contact details, and appointment information in the course of providing customer support, resolving disputes between patients and doctors, investigating reports of misconduct, or maintaining the integrity and safety of the platform. This access is limited strictly to what is necessary for the specific operational purpose and is subject to internal confidentiality obligations. Patient personal information is never accessed by hApItech staff for commercial purposes or shared internally beyond what is required to resolve the matter at hand.
In addition to the above, we may collect certain technical information about your device and usage, such as device type, operating system version, and app version, solely for the purpose of diagnosing technical issues and improving platform performance. We do not use this information to identify you personally.
We use the information we collect exclusively to operate and improve the hApItal platform. This includes creating and verifying your account using OTP-based authentication, facilitating the booking and management of appointments between patients and doctors, managing time-based appointment slots and assigning token numbers to patients reflecting their position in the queue for a given slot, sending appointment notifications to both patients and doctors through SMS, WhatsApp, and push notification to your device, generating and delivering digital prescriptions and supporting medical documents, processing payments through our payment partner Razorpay, displaying doctor profiles to patients who are searching by city or medical specialty, displaying nearby emergency service providers sorted by proximity when a patient grants location access, sending re-checkup reminders to patients at the direction of the treating doctor when a follow-up visit is recommended, and reviewing doctor credential documents to verify that listed practitioners hold valid medical registrations.
For doctors who opt into our promotional listing feature, we use profile information to display advertisements within the patient-facing application, and we record anonymised interaction data — such as whether a promoted listing was viewed or tapped — solely to provide accurate performance reporting to the participating doctor. This interaction data is not linked to individual patient identities in any report shared outside hApItech. We do not use your personal information for unsolicited marketing, profiling for third-party purposes, or any form of automated decision-making that could affect your healthcare or your access to the platform.
The hApItal platform sends notifications to patients and doctors to keep them informed about appointment activity. Patients may receive the following types of notifications: a booking confirmation when an appointment is successfully placed, the token number assigned to them for a time-based slot, an appointment reminder ahead of the scheduled consultation time, a re-checkup reminder sent by the treating doctor when a follow-up visit is recommended, a notification when a doctor cancels or reschedules a confirmed appointment, and a notification when a digital prescription or supporting medical document is made available for viewing. Doctors may receive notifications when a new appointment is booked through their profile, when a patient cancels a confirmed appointment, and for other relevant changes to their booking activity. These notifications are delivered through a combination of SMS to the registered mobile number, WhatsApp to the registered mobile number, and push notification to the mobile device where the application is installed. You may manage push notification preferences through your device settings at any time.
hApItal shares personal information only to the extent necessary to provide the service. When a patient books an appointment, that patient's name, age, mobile number, and symptom description are shared with the specific doctor they have booked with, and with no one else. Doctor profiles, including name, clinic details, specialty, and consultation fee, are made accessible to patients as part of the discovery experience on the platform. Payment information is processed by Razorpay, and their privacy policy governs the handling of payment data. SMS and WhatsApp delivery for OTP and appointment notifications is handled by MSG91, which receives your mobile number and the message content only for the purpose of delivery. Push notifications are delivered through Expo's notification infrastructure, which receives your device's push token for the sole purpose of forwarding the notification to your device. Our platform infrastructure runs on Supabase, which stores your data on encrypted servers.
We do not sell, rent, share, or trade your personal information to any third party for commercial purposes. We do not share your data with insurance companies, pharmaceutical companies, advertisers, or data brokers under any circumstances. We may disclose information if required to do so by law, court order, or a competent government authority.
All data stored on the hApItal platform is encrypted at rest and in transit using industry-standard Transport Layer Security. Authentication is handled through one-time passwords sent to your registered mobile number, meaning no passwords are stored on our servers. Access to patient records within the platform is restricted on a per-appointment basis, so only the doctor involved in a specific appointment can view the corresponding patient details. Payment data never passes through our servers; it is handled entirely by Razorpay, which is a PCI-DSS compliant payment gateway.
Medical documents, including prescription reports and doctor verification certificates, are stored in private, non-publicly-accessible storage. These files cannot be accessed via a predictable or shareable URL. Access to prescription reports is provided to patients and doctors exclusively through time-limited cryptographically signed URLs, which expire twenty-four hours after they are generated. Doctor verification certificates are stored separately and are accessible only to hApItech's review team through separately generated signed URLs that expire within thirty minutes of generation. These access controls ensure that sensitive medical documents remain protected even in the event that a URL is inadvertently shared or captured in a log.
We retain your personal information for as long as your account remains active on the platform. Appointment records are retained for a minimum period of three years in order to comply with applicable medical record-keeping norms in India. If you request the deletion of your account, we will remove your personal identifiers from our active systems within thirty days of receiving a valid deletion request. Prescription records may be retained in anonymised form beyond this period for legal and compliance purposes. GPS location data collected during an emergency services session is not retained and is discarded immediately after results are returned to your device.
You have the right to access the personal information we hold about you at any time by contacting us. You may update your name, age, and other profile details directly within the application. If you believe any information we hold is inaccurate, you may request a correction, and we will act on it promptly. You have the right to request the deletion of your account and associated personal data by writing to us at hapitechops@gmail.com, and we will process this within thirty days. You may revoke location permission or notification permission at any time through your device's settings without any effect on your ability to access the core features of the platform. If you wish to opt out of appointment reminder SMS or WhatsApp notifications, you may contact our support team to make that arrangement.
hApItal does not knowingly collect personal information from individuals under the age of eighteen as account holders. A parent or legal guardian may use their own account to book an appointment on behalf of a minor family member, in which case the contact information of the parent or guardian is used for all communications. If we become aware that a person under eighteen has registered independently, we will take steps to remove that account.
hApItech reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. In the event of a material change, we will notify users via SMS or an in-app notification prior to the change taking effect. Your continued use of the hApItal platform after the effective date of any revision constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.
If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please reach out to us at hapitechops@gmail.com or call us at +91 8320014893. We are committed to addressing all privacy-related inquiries promptly and transparently.