Privacy Policy

1.Scope of this policy

This policy covers:

• This website, qlini.app, including its doctor search.
• Booking an appointment through Qlini — signing in with your mobile number, the family members you add, and the appointments you book.

For these, we decide why and how your data is used, so we are the Data Fiduciary. Your medical records at the clinic you visit are different — see section 5.

2.Who we are

Qlini is a product of Qlinio Private Limited (“Qlinio”, “we”, “us”), CIN U62011KL2026PTC105151, registered at 2/1149/I 100, Hilite Business Park, Tower 2, Iringallur, Kozhikode, Kerala 673014, India. The same company makes Qlinikit, the clinic software the clinics on Qlini use to run their appointments.

3.When you search for a doctor

You can search without signing in or telling us who you are.

• What you type and the speciality you pick — sent to our doctor directory to find matching doctors. We do not keep the text you type.
• Your location, only if you tap “Use my location” — your browser asks your permission first. The coordinates are sent with that search to sort doctors by distance; we do not store them or link them to you.
• Anonymous demand counts — we count how often each speciality is searched for in each area, so we know where patients are not finding doctors. That count never includes what you typed, your coordinates or anything that identifies you.
• Your IP address — recorded by our hosting as part of serving the site, and used to limit how many searches can be made in a minute, so the directory cannot be scraped.

We count page views with Vercel Web Analytics, served from this site’s own domain. It sets no cookies, cannot follow you to other websites, and builds no profile of you.

4.When you book an appointment

• Your mobile number — your account. We send a one-time code to it by SMS to confirm it is yours, and use it for messages about your bookings.
• Your name, and the details of family members you add (name, age or date of birth, sex, and how they are related to you) — so the clinic knows who the appointment is for.
• Your appointments — the clinic, doctor, date and time, the reason for the visit if you give one, and whether you attended or cancelled.
• Payments — if you pay online, you pay in Razorpay’s secure payment window, which opens on the payment page and is governed by Razorpay’s own privacy policy. We receive the amount and whether it succeeded; we never see or store your card, UPI or bank details.

We use this only to make, manage and remind you of your bookings, to process payments and refunds, and to keep your account secure.

5.What your clinic holds

When you book, your booking goes to the clinic you chose. Once you are seen there, your consultation notes, prescriptions and test results are the clinic’s records: the clinic is the Data Fiduciary for them, and we store them only on the clinic’s instructions, as its Data Processor.

For a copy, a correction or deletion of your medical records, the clinic is the right place to ask. If you write to us about records a clinic holds, we will pass your request to that clinic and tell you we have done so.

6.Cookies

This website sets no cookies. When you sign in, a sign-in token is kept in your browser’s storage so you stay signed in — for the open tab only, or for 30 days if you choose “keep me signed in”. Signing out deletes it. It is used for nothing else, and we use no advertising or tracking cookies anywhere. Razorpay’s payment window, when you open it, may set its own cookies for fraud prevention.

7.What we never do

• We do not sell your personal data or share it with data brokers.
• We do not show you ads, or use your health data to target anything at you.
• We do not use your records to train AI models.
• We do not put your name or health details in notifications — messages say “your appointment is confirmed”, not why you are seeing a doctor.
• We make no automated decisions about you that have legal or similar effects.

8.Our lawful basis

We rely on your consent, which you give when you sign in and book after reading this notice, and on the provisions of the DPDP Act permitting processing for a purpose you have voluntarily provided your data for. You can withdraw consent at any time by writing to [email protected]; withdrawing does not affect a booking already made, and the clinic may still need to keep its records of your visit.

9.Who we share it with

We share personal data only with the following, and only as far as each needs it:

• The clinic you book with — the details of your booking and the person it is for.
• An SMS provider, to send your one-time codes and booking messages.
• Razorpay, our payment provider, when you pay online.
• Hosting, database and storage providers, who run the service on our instructions.
• Professional advisers or a public authority, where the law or legal process requires disclosure.

Each provider is bound by contract to process personal data only on our instructions and to protect it.

10.Transfers outside India

Some of these providers — principally hosting — may store or process data on infrastructure outside India. Such transfers are made in accordance with Section 16 of the DPDP Act, 2023, which permits transfer other than to countries restricted by notification of the Central Government.

11.How long we keep it

• Your account and bookings — while your account is active. If you ask us to delete it, we delete it, except records the law requires us to keep, such as payment records for tax.
• Server logs — 90 days.
• Records at your clinic — kept by the clinic for as long as the law and its practice require.

12.How we protect it

• Encryption in transit — this site and the Qlini service are reached only over HTTPS.
• Encryption at rest for our database, file storage and backups.
• Each clinic’s data kept separate from every other clinic’s, and access inside a clinic set by role.
• One-time codes and rate limits on sign-in, so nobody can get into your account by guessing.

No system is perfectly secure, and we do not claim otherwise. What we commit to is that a failure will be handled as set out below, not concealed.

13.Your rights

Under the DPDP Act, 2023 you have the right to:

• Access — a summary of the personal data we hold about you and how we process it.
• Correction and completion — of inaccurate, incomplete or outdated data.
• Erasure — unless the law requires us to keep it.
• Withdraw consent — at any time, as easily as you gave it.
• Grievance redressal — to complain to us and receive a response.
• Nominate — someone to exercise these rights for you in the event of your death or incapacity.

Exercising any of these is free.

14.How to exercise your rights

Write to our Grievance Officer at [email protected], or by post at 2/1149/I 100, Hilite Business Park, Tower 2, Iringallur, Kozhikode, Kerala 673014, India, and tell us which right you want to exercise. We may ask you to confirm your mobile number with a one-time code first, so that we never disclose your data to someone else.

We respond within 30 days. The statutory outer limit for grievances is 90 days; ours is shorter and is the one we hold ourselves to.

15.Complaining to the Data Protection Board

If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India. Raising it with us first is ordinarily expected, but does not limit your right to approach the Board.

16.Children and family members

Accounts are for adults. A parent or guardian can add a child as a family member and book for them; by doing so they confirm they are the child’s parent or lawful guardian and consent on the child’s behalf. When you add another adult, you confirm they have agreed to you booking for them. We never track, profile or advertise to children.

17.If there is a data breach

If a personal data breach affects your data, we will inform the Data Protection Board without delay and tell you directly — what happened, what data was involved, what we are doing, and what you can do — with a fuller report to the Board within 72 hours, as the Rules require.

18.Changes to this policy

When this policy changes we will update the effective date at the top of this page and, for any material change, tell you before it applies. See also our Terms of Service.

19.Contact

The Grievance Officer
Qlinio Private Limited
2/1149/I 100, Hilite Business Park, Tower 2, Iringallur, Kozhikode, Kerala 673014, India
[email protected]