Zodact Health Private Limited ("Zodact", "we") makes software for clinics and the Zodact app for patients and doctors. This policy explains what personal data we handle, why, and the rights you have under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000.
1. Who is responsible for your data
When you visit a clinic that uses Zodact, the clinic decides what it records about your visit, and Zodact processes that data on the clinic's behalf. For your Zodact app account, reminders and video consultations, Zodact decides how the data is used. Either way, you can contact us and we will help, or pass your request to the clinic.
2. What we collect
- Identity and contact: phone number, name, age or date of birth, gender, and family members registered on the same phone number. Email, if you give it.
- Visits and health: appointments, queue status, prescriptions (diagnosis, medicines, advice, follow-up date), records you upload, and notes made by your doctor or clinic.
- Video consultations: when the call started and ended, and who joined. Calls are not recorded unless you agree before the call.
- Payments: amount, status and reference. Card and UPI details go directly to Razorpay; we never see or store them.
- Device and usage: push notification token, device type, app version and technical logs used to keep the service working and secure.
- Doctors: medical registration number, identity and degree documents, used to verify them before they consult.
- Clinic staff: name, work email and role.
3. How we use it
- To register visits, run clinic queues and keep your records in one place.
- To create prescriptions and deliver them to you in the app, and by WhatsApp or SMS where enabled.
- To send appointment and medicine reminders.
- To run video consultations and follow-ups, and to process payments.
- To verify doctors, provide support, prevent fraud and meet legal obligations.
We do not sell personal data, and we do not use health data for advertising.
4. AI features
Some features use AI models: drafting a prescription for a doctor, the symptom checker, and translating prescription advice into Telugu. We send only the text the feature needs; for a translation, that is the diagnosis, advice and warning lines, not your name or phone number. A doctor approves every AI-drafted prescription before it reaches you. The English page of a prescription is always the official record.
5. Who we share it with
- The clinics and doctors you visit or book with.
- Pharmacists who scan your prescription's QR code. The check page shows the doctor, clinic, date, your first name and a masked phone number, and never shows your diagnosis or medicines.
- Service providers who run parts of Zodact for us under contract: Supabase (database and file storage), Railway (servers), Vercel (websites), Google Firebase (sign-in codes and notifications), Daily.co (video), Razorpay (payments), OpenRouter and the AI model providers it uses (AI features), and Meta WhatsApp and MSG91 (messages). Some of them process data outside India, as the DPDP Act permits.
- Government or courts, when the law requires it.
6. Children
A person under 18 uses Zodact through a parent or guardian, who registers them as a family member on their own phone number and gives consent on their behalf.
7. How long we keep it
We keep your data while your account is active. Clinical records are kept for at least 3 years from the visit, as Indian medical regulations require, and then deleted or anonymised. If a clinic stops using Zodact, we give the clinic a copy of its records on request and then delete them from our systems, except where the law requires us to keep them.
8. How we protect it
Data is encrypted in transit, and sensitive health details are encrypted at rest. Each clinic can see only its own patients, and staff accounts are limited to their role. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.
9. Your rights
- See the personal data we hold about you, and correct or update it.
- Ask us to delete it, where we are not required to keep it.
- Withdraw your consent. Some features may stop working, but earlier processing stays lawful.
- Nominate someone to exercise these rights if you die or cannot act.
- Complain to our Grievance Officer, and then to the Data Protection Board of India.
Write to privacy@zodact.com from your registered phone number or email. We reply within 30 days.
10. Cookies
Our websites use only the cookies needed to sign in and run the site. We do not use advertising cookies.
11. Changes
We will post changes on this page and tell you in the app before a significant change takes effect.
12. Grievance Officer
Srinivasa Rao, Founder
Zodact Health Private Limited, Hyderabad, Telangana, India
Email: privacy@zodact.com