Privacy Policy
Last updated: 17 October 2026 · Applies to doxab.ai, the Doxab.AI doctor app and the Doxab.AI patient app.
This Privacy Policy explains how Vegavaan Info Solutions Pvt. Ltd. ("Doxab.AI", "we") collects, uses and protects personal data in the Doxab.AI website and apps, in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. For patient records, the clinic is the data fiduciary and Doxab.AI processes the data on the clinic's behalf.
1. Data we collect
- Doctors: name, mobile number, optional email, qualification, specialisation, registration number, clinic name, address, phone, GSTIN, logo.
- Patients (entered by the clinic): name, mobile number, age or date of birth, gender, optional address, emergency / guardian contact, allergies, and the visit records the doctor writes (complaints, vitals, diagnoses, prescriptions, advice, voice notes).
- Payments: plan, amount, GST details, Cashfree order and payment reference and the payment method type. Card, UPI and bank details are collected by Cashfree, never by us.
- Technical: sign-in events, IP address, device name of signed-in apps, and audit logs of who opened or changed a record.
2. Why we use it
To provide the Service: keep clinic records, create prescriptions, track follow-ups, let patients see records their clinic shared, process payments and issue GST invoices, prevent fraud and abuse, provide support, and meet legal obligations. We do not sell personal data and do not use patient data for advertising.
3. AI processing
When a doctor asks for AI suggestions, the clinical details of that visit - age, gender, weight, allergies, symptoms, findings, vitals, diagnoses and the diagnoses / medicines of recent visits - are sent to our AI provider (DeepSeek) to generate the suggestions. The patient's name, mobile number, address and Patient ID are never sent. The AI provider may process this de-identified data outside India. We log only the time, the doctor and the size of each request - not its content.
4. Service providers
- Cloud hosting and database for the Service.
- Google Firebase - to send and verify sign-in OTPs to the mobile number.
- Cashfree Payments - to process payments and refunds.
- DeepSeek - AI suggestions (de-identified data, see section 3).
They process data only to provide their service to us, under their own security and privacy terms.
5. Who can see patient records
Only the clinic that created them. A patient sees only records claimed with their own mobile number and Patient ID, and only visits the doctor shared. Doxab.AI staff do not read medical records; administrative access is limited, need-based and logged.
6. Consent
The clinic records the patient's consent for digital records and portal access. Patients can withdraw portal access at any time from their account; withdrawal does not affect records the clinic must keep.
7. Retention
Records are kept while the clinic's account exists and for as long as the law requires medical records to be kept. Payment and invoice records are kept for 8 years for tax purposes. Expired OTPs are deleted within a day; share links expire automatically.
8. Security
HTTPS everywhere, OTP sign-in, separation of each clinic's data, hashed tokens and codes, expiring share links that need the mobile's last 4 digits, access logs and regular backups.
9. Your rights
You can ask for access to, correction of, or erasure of your personal data, withdraw consent, and nominate another person, by contacting us or (for patient records) your clinic. Patients can request corrections to their records from the patient portal.
10. Cookies
We use only essential cookies: sign-in, security (anti-forgery) and your language / theme choice. No advertising or tracking cookies.
11. Grievance officer
Grievance Officer, Vegavaan Info Solutions Pvt. Ltd., Faridabad, Haryana, India. Email: support@doxab.ai. We acknowledge grievances within 48 hours and resolve them within 30 days.
12. Changes
We will post any change on this page and, for important changes, notify signed-in users in the app.