Effective Date: 7 November 2026 · Applies to the hApItal app, hapital.in and hapitaldoctor.in
hApItal is a doctor discovery, appointment booking and emergency services platform operated by Hapitech Technologies LLP (“hApItech”, “we”, “us”), Gujarat, India. For the personal data described here, hApItech is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
The hApItal app on Google Play (“hApItal – Find & Book Doctors”) is published by Hapitech Technologies LLP.
This policy explains what personal data we collect, why, who can see it, how we protect it, how long we keep it, and the rights you have over it.
Your account. Your mobile number, which we verify with a one-time code sent on WhatsApp (or by SMS if WhatsApp cannot be reached). Your name and date of birth (we use it to confirm you are at least 18 and keep your age on your bookings), and optionally your gender and e-mail address.
Your bookings. For each appointment, the name, age and gender of the person being seen, any weight or symptom note you type into the booking, the doctor, the date, time, token number and status. If you book for a family member, these details are about that family member.
Your health profile (optional). If you choose to fill it in for yourself or for a family member you add: date of birth, blood group, height, weight, marital status, emergency contact, city or area, allergies, current and past medicines, long-term illnesses, injuries, surgeries, smoking and alcohol habits, activity level, food preference and occupation. You decide what to fill in, and who can see it (see section 3).
Prescriptions and reports that your doctor or the doctor’s clinic staff create or upload for your appointment, and any health checks recorded at the visit (such as blood pressure or weight).
Your device. A push-notification token, device type, operating system, app version and app language, to send you notifications and fix problems. If you have not chosen a city, the app asks a location look-up service once for your approximate city from your internet (IP) address. Location is used only if you allow it, and only in two places: the emergency section, where your GPS position sorts nearby services, and “Use my location” when you choose your town, where your phone turns your position into a town name. Your GPS position is never stored. The app does not use your camera, the files on your phone, or an advertising ID, and it does not look through your photos (see Profile photo below).
Profile photo (optional). If you choose to add one in Profile, you pick a single picture with your phone’s own photo picker; the app sees only that picture and stores a small copy of it. Only you and the hApItech team can see it — doctors and other patients never do. You can change or remove it at any time in Profile, and it is deleted with your account.
Your choices. When you agreed to our Terms and this policy, and whether you said yes or no to updates and offers, with the date and time.
Doctors. Name, mobile number, e-mail, medical registration number and certificate, speciality, clinic details and location, fee, schedule and photo. When a doctor searches for the clinic address, the text typed and the approximate position of the device are sent to a map service to suggest matching places. For payments: the payment reference, amount, invoice and, if given, GSTIN. We never see or store card, UPI or bank details.
Clinic staff. If a doctor gives a staff member their own login: the staff member’s name, e-mail and the parts of the clinic the doctor allows them to use.
Hospitals and multi-specialist clinics. If a hospital opens a hospital account: the hospital’s name, address, contact numbers, e-mail, specialities, logo and photos, its registration certificate (kept private and seen only by the hApItech team, for the “Trusted hospital” badge), its GST number and billing name if it gives them, its plan and payments, and the name and e-mail of each reception login it creates.
Sign-in and security (doctors and clinic staff). To protect clinic records we keep the list of signed-in devices (device and browser type, approximate place and internet address), whether two-step sign-in is turned on, and a clinic activity record of who added, changed or removed bookings, prescriptions and settings, with the device, approximate place and internet address. We use these to limit how many devices can be signed in, to e-mail you when your login is used on a new device, and to let the doctor see what happened in the clinic account.
Your health profile is shown to a doctor only if you turn on “Share with doctors” in Profile. Each family member has their own switch.
This rule is enforced by our systems, not only hidden on screen. Your health details are never shown to other patients, the public, advertisers or other doctors you have not booked. You can turn the switch off at any time, and doctors stop seeing those details straight away.
Only to run hApItal: to sign you in; to book, manage and move appointments and assign tokens; to send booking, token, reminder, re-checkup, cancellation and prescription notifications; to show prescriptions and reports; to show nearby emergency services; to verify doctors’ registrations; to process doctors’ payments and invoices; to keep accounts and the platform safe; and to fix problems and improve the service.
Patients receive appointment notifications as push notifications and in the app’s notification list. The login code is sent on WhatsApp (or by SMS). Doctors and clinic staff see booking updates in their dashboard and receive e-mails about their own account (for example a new password, a sign-in from a new device, or a change to two-step sign-in).
We do not sell your data, and we do not use your health details for advertising or for any automated decision about your care.
We send patients updates and offers from hApItal on WhatsApp or e-mail only if you tick “Send me hApItal updates & offers”. You can switch this off at any time in Profile. Saying no never affects your bookings or appointment messages. Doctors may receive messages about hApItal plans and features and can ask us to stop at any time.
The home screen can show promotions (ads) that doctors place for the towns they choose. Which promotions you see depends only on the town you selected — never on your health details, bookings or any profile of you. We count how many times each promotion is shown and tapped; these counts are not linked to you. We do not use advertising networks or advertising IDs.
The doctor you book (and the clinic staff the doctor allows), as described in section 3.
Hospitals and multi-specialist clinics. Some doctors work as part of a hospital account on hApItal (the doctor’s profile says so). If you book such a doctor: the hospital account sees only how many bookings each of its doctors has — never your name, health details or prescriptions; the hospital’s reception staff can see the details needed to manage the queue (your name, mobile number, age, gender, visit time and token) and can add or cancel a booking for you, but never see prescriptions, reports or health details; and your doctor may choose to let other doctors of the same hospital see your visits, prescriptions and readings from that hospital, only so they can treat you. If your doctor leaves the hospital, the records made there stay linked to the hospital unless the hospital agrees the doctor may keep them. You always keep access to all your own records in the app.
Service providers who process data for us, only on our instructions and only for these purposes:
Your account, booking and medical records are stored on servers in India. Some of these providers may handle limited data outside India — for example to deliver a notification or an e-mail, look up an approximate location, or keep an encrypted backup copy — as permitted by law.
We may also disclose information when the law, a court or a competent government authority requires it. We never sell, rent or trade personal data, and never share it with insurers, pharmaceutical companies, advertisers or data brokers.
A small number of authorised hApItech team members can access booking and account records to verify doctors, give support, resolve disputes and keep the platform safe. They sign in with two-step verification, access is limited by role, and the actions they take are recorded.
To protect patients, doctors and the platform, hApItech may block, suspend or remove an account that is fake, used for fraud or abuse, breaks our Terms, or must be removed under a court, government or police order. Before an account is removed, the reason is recorded.
Data is encrypted in transit and at rest. Access rules in our database let each patient see only their own records and each doctor (and the clinic staff they allow) see only their own patients’ booking details. Prescription reports and doctors’ registration certificates are kept in private storage and open only through links that expire. We keep regular backups. Doctors can turn on two-step sign-in for their login.
If a doctor saves clinic records on their own device (for example for working offline, or a downloaded export), that copy is under the doctor’s control and the doctor is responsible for keeping that device safe.
If a personal data breach happens, we will inform the affected people and the Data Protection Board of India as the law requires.
We keep your account while you use hApItal. Old data that is no longer needed is removed automatically:
Appointment and prescription records are medical records. Your doctors keep them for at least three years, in line with medical record-keeping norms in India. Payment records and invoices are kept for 8 years, as tax law requires.
Deleting your account (patients): you can delete it any time in the app (Profile → Delete my account) or at hapital.in/delete-account. It is deleted 3 days after you confirm; until then you can cancel. Your doctors keep the medical records of your visits for 3 more years, unlinked from your account, and then they are removed too.
Deleting a doctor account: a doctor can ask to delete the account from the doctor dashboard. It is deleted 7 days later and can be cancelled until then. Past bookings, prescriptions and payment records are kept for the periods above.
Record of each deletion: to show that a deletion was carried out, we keep a short record for 8 years: the patient ID, the last 4 digits of the mobile number, the date, how it was asked for and, if the hApItech team removed the account, the reason. It does not contain your name, full number or health details.
Unused accounts: if an account is not used for 3 years, we send a notice and delete it 30 days later unless you open the app. GPS positions from the emergency section are never stored.
Under the DPDP Act you can:
Write to hapitechops@gmail.com. We reply within 30 days.
You must be at least 18 years old to create your own hApItal account; we check this from the date of birth you give when you sign up. Under India’s Digital Personal Data Protection Act, 2023, anyone under 18 is a child, and a child’s data is handled only with a parent’s or legal guardian’s consent. So children cannot have their own account — a parent or legal guardian can add them as a family member and book for them; by doing so they confirm they are the child’s parent or guardian and give consent on the child’s behalf. If we learn that someone under 18 has created an account, we will close it.
Grievance Officer, Hapitech Technologies LLP
E-mail: hapitechops@gmail.com · Phone: +91 8320014893
Gujarat, India
We acknowledge every privacy request or complaint and resolve it within 30 days.
We may update this policy as our service or the law changes. For an important change, we will tell you in the app before it takes effect.