Privacy Policy

Last updated: 22 June 2026 · Compliant with the Digital Personal Data Protection Act, 2023 (DPDPA)

What we collect

Your name, email, phone number, and city — only what you give us when reserving access or signing up. Once you start using DocSetu, we also store your appointments, prescriptions, and any lab reports you choose to upload. We treat your health data as sensitive personal data and store only what is necessary for the booking, records, and follow-up purposes you consent to.

Who can see your records

You. And any doctor or clinic you explicitly share a record with — for as long as you choose. We never make your medical history available to advertisers, insurers, or pharmacies. Every time a doctor or clinic staff member opens one of your records, we log it and surface it to you on your Records page under “Who accessed this record”.

How we store data

Records are encrypted at rest and in transit. Servers are in India. We follow the Digital Personal Data Protection Act 2023 (DPDPA) and apply reasonable security safeguards proportionate to the sensitivity of health data.

Your DPDPA rights

Under §11–§14 of the DPDP Act 2023, you (the “Data Principal”) have the following rights with respect to your data:

  1. Right to access— see a summary of personal data we hold and how it's being used. Request access.
  2. Right to correction — ask us to correct inaccurate or incomplete data. Update profile.
  3. Right to erasure — ask us to delete your data once the purpose is served. Delete account.
  4. Right to withdraw consent — withdraw any specific consent at any time, as easily as it was given. Manage consents.
  5. Right of grievance redressal — escalate a complaint to our Grievance Officer (see below). If unresolved within 30 days, you may approach the Data Protection Board of India.

Data Protection Officer (DPO)

Name: To be appointed by 31 December 2026 (interim contact below).
Email: dpo@krakelabsindia.com
Postal: KrakelabsIndia, Mumbai, India.

The DPO is responsible for ensuring DocSetu's compliance with the DPDPA and is your first point of contact for any data-protection question.

Grievance Officer

Name: To be appointed by 31 December 2026 (interim contact below).
Email: grievance@krakelabsindia.com
Response SLA: within 30 days of receipt, as required by §13(3) of the DPDPA.

How to file a complaint

  1. Email our Grievance Officer at grievance@krakelabsindia.com with the subject line “DPDPA grievance — <your issue>”.
  2. If unresolved within 30 days, escalate to the Data Protection Board of India. The DPB is being constituted under §18 of the Act; until it is operational, escalations can be sent to the Ministry of Electronics & IT (MeitY) at meity.gov.in.

Consent

We ask for consent per-purpose at signup. You may grant or refuse each one independently. You can withdraw any optional consent at any time on your Privacy & Consents page. Withdrawal of essential consents (storing your profile to enable bookings) will end your account, but you can still book as a guest.

We log every consent action (grant, withdrawal, change) with timestamp and the version of the consent text shown to you, so you have an auditable record.

Contact

General privacy enquiries: privacy@docsetu.in