Privacy Policy
Last updated: 1 January 2026 · Effective date: 1 January 2026
1. Data Fiduciary
This Privacy Policy is issued by Quantum CorpHealth Pvt. Ltd. ("Company", "we", "us", "our"), a company incorporated under the Companies Act, 2013, with its registered office in Mumbai, Maharashtra, India.
We operate the Doctor911 LabGrow platform — a Software-as-a-Service (SaaS) CRM and patient engagement tool designed for Indian diagnostic laboratories.
We act as the Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 ("DPDP Act") with respect to laboratory staff and administrators. The diagnostic lab (our customer) is the Data Fiduciary with respect to their patients' data; we process patient data as a Data Processor on the lab's behalf.
2. What Personal Data We Collect
2.1 Laboratory Staff & Administrators (Users of LabGrow)
- Identity data: Full name, email address
- Authentication data: Password (stored as bcrypt hash — never in plain text)
- Account data: Lab name, lab address, NABL number, phone number
- Usage data: Login timestamps, campaign activity, audit logs
- Billing data: Plan details, coupon redemption records
- Technical data: IP address (logged per IT Act 2000 §43A), browser type, access timestamps
2.2 Patient Data (Processed on Behalf of Labs)
- Identity data: Full name, age, sex
- Contact data: Phone number (E.164 format)
- Health data: Last visit date, last test name, last test result, clinical notes
- Consent records: Per-channel consent flags (WhatsApp, phone call, SMS, email), timestamp of consent, staff IP address at time of consent recording
- Communication logs: WhatsApp message delivery status, template name used
2.3 Data We Do Not Collect
- We do not collect Aadhaar numbers, PAN, or any government-issued ID
- We do not store payment card details (billing is handled via third-party processors)
- We do not access or store actual pathology reports or medical images
3. Purpose of Processing & Legal Basis (DPDP Act 2023)
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Providing the LabGrow SaaS platform | User name, email, lab details | Contract (§4(1)(b)) |
| Authenticating users | Email, password hash, IP address | Contract + Legitimate interest |
| Sending WhatsApp recall messages to patients | Patient name, phone, health data | Explicit consent (§6) |
| Sending phone call, SMS, or email to patients | Patient phone / email | Explicit consent (§6) |
| Campaign analytics & reporting | Aggregated patient tags, send logs | Legitimate interest |
| Security & fraud prevention | IP address, access logs | Legal obligation (IT Act §43A) |
| Billing & subscriptions | Plan, coupon, payment reference | Contract |
| Legal compliance & grievance handling | Any data as required | Legal obligation |
4. Patient Consent (DPDP Act 2023 — §6)
Patient communication consent in LabGrow is collected by the diagnostic lab's staff at the point of patient registration or update. Each channel (WhatsApp, Phone Call, SMS, Email) has a separate, explicit consent checkbox.
- Explicit: Each consent channel is individually ticked — no bundled or pre-ticked boxes.
- Informed: The consent form clearly states the purpose of each channel (e.g., "WhatsApp recall reminders via Doctor911 number").
- Free: Consent is not a condition of receiving lab services.
- Specific: Separate consent for each communication purpose.
- Revocable: Patients may withdraw consent at any time by informing the lab; staff can uncheck the relevant channel in the patient record.
- Auditable: Consent timestamp and staff IP address are recorded per IT Act 2000.
WhatsApp campaigns via Interakt API are automatically restricted to patients with consentWhatsapp = true. Patients who have not given consent are never contacted via that channel.
5. How We Share Personal Data
We do not sell, rent, or trade personal data. We share data only as follows:
- Interakt (Meta Partner): Patient phone numbers and WhatsApp template variables are transmitted to Interakt's API to deliver pre-approved WhatsApp Business messages. Interakt is bound by Meta's data processing terms.
- AWS / Cloudflare R2: CSV uploads and static assets are stored on cloud infrastructure with encryption at rest.
- PostgreSQL (hosted on lab's or our server): All structured patient and lab data.
- Legal authorities: We disclose data when required by court order, law enforcement, or applicable Indian law.
6. Data Retention
- Patient data: Retained while the lab's account is active. Deleted within 30 days of account termination on written request.
- WhatsApp send logs: Retained for 12 months for audit and compliance, then purged.
- Audit / activity logs: Retained for 3 years per IT Act 2000 §67C.
- Consent records: Retained for the lifetime of the patient record + 1 year after deletion, as legal evidence of consent.
- Access logs (IP etc.): Retained for 3 years.
- Refresh tokens: Auto-expire per configured TTL (default 30 days).
7. Data Security (IT Act 2000 — §43A)
We implement reasonable security practices as required by the IT Act 2000 and IT (Reasonable Security Practices) Rules 2011:
- Passwords stored as bcrypt hashes (never in plain text)
- JWT access tokens expire in 15 minutes; refresh tokens in 30 days
- All API communication over HTTPS/TLS 1.2+
- Database access restricted to application layer (no public exposure)
- Multi-tenant isolation — each lab can only access its own data
- Staff IP addresses logged on all sensitive operations (consent recording, logins)
- Regular dependency security updates
8. Your Rights as a Data Principal (DPDP Act 2023 — §11–§14)
If you are a patient whose data is held by a lab using LabGrow, you have the following rights under the DPDP Act 2023:
- Right to information (§11): Know what personal data is processed and the purposes.
- Right to correction & erasure (§12): Request correction of inaccurate data or deletion.
- Right to grievance redressal (§13): Raise a complaint with the Data Fiduciary (the lab).
- Right to nominate (§14): Nominate another person to exercise rights in case of death or incapacity.
- Right to withdraw consent (§6(4)): Withdraw WhatsApp, SMS, call, or email consent at any time by contacting the lab.
To exercise these rights, contact your diagnostic lab directly, or write to our Grievance Officer (Section 10).
9. Cookies & Tracking
LabGrow uses a single first-party cookie (lg_auth) to maintain authenticated sessions. We do not use third-party tracking cookies, advertising pixels, or analytics fingerprinting.
10. Grievance Officer
Grievance Officer — Quantum CorpHealth Pvt. Ltd.
As mandated by the DPDP Act 2023 §13 and IT Act 2000 §43A Rule 5(9):
- Name: Grievance Officer, Quantum CorpHealth Pvt. Ltd.
- Email: info@doctor911.life
- Address: Quantum CorpHealth Pvt. Ltd., Mumbai, Maharashtra, India – 400001
- Response time: Within 30 days of receipt of complaint
If you are not satisfied with our response, you may approach the Data Protection Board of India as established under §18 of the DPDP Act 2023.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified to registered users via email or in-app notice at least 15 days before they take effect. Continued use of LabGrow after that date constitutes acceptance of the updated policy.
12. Governing Law
This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the Consumer Protection Act, 2019. Disputes shall be subject to the exclusive jurisdiction of courts in Mumbai, Maharashtra.