Privacy Policy

Last updated: 30 September 2026

This policy covers only the WhatsApp clinic follow-up service on this page. VaidyaSpot's separate doctor–patient booking platform has its own Privacy Policy, since it collects different data for a different purpose.

1. Who We Are

This service is operated by Ranjith Marketing, registered at 1/5 Micheal Sarani, Subhas Pally, Benachity, Durgapur, West Bengal 713213, India (MSME/Udyam Registration No. UDYAM-WB-23-0083793). For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), Ranjith Marketing is the Data Fiduciary for personal data collected through this service.

2. What This Service Does

On behalf of a subscribing clinic, we send each patient one WhatsApp message 48 hours after their visit, asking how they're feeling. A patient who reports an issue is routed back to that clinic's receptionist to be called back; a patient who replies is also sent a one-tap link to the clinic's own Google review page.

3. What Data We Collect

From a subscribing clinic:

the clinic's own name and contact details, and the daily patient list it shares with us — patient name, phone number, visit date, and treating doctor — for patients the clinic has confirmed have agreed to be contacted.

We receive patient details only from the clinic's own reception, as part of their daily patient list. The receptionist confirms the patient's consent to receive a follow-up message at the time of the visit, before including them on that list. This daily list is emailed to us by the clinic — it is the only source of patient data we use, and no patient data is collected directly by VaidyaSpot through any other channel.

From a patient's reply:

whether they're feeling better or facing an issue, and, if they choose to leave one, their Google review.

We do not ask about, and never record, a diagnosis, medicine, or the reason for a visit — our messages and records are deliberately limited to "how are you feeling?"

4. How We Use This Data

• To send the one WhatsApp follow-up message per visit, 48 hours after it happened.
• To route a patient's "I'm facing an issue" reply to that clinic's receptionist, with the patient's name and number, so the clinic can call them back.
• To send a patient who replies a link to their clinic's own Google review page.
• To give the clinic a monthly summary of how many patients were checked on, how many replied, and how many came back.

We do not sell this data, and do not use it for advertising or for anything beyond the clinic follow-up described above.

5. Who We Share It With

• WhatsApp (Meta Platforms, Inc.) — as the messaging channel these check-ins are sent and received through.
• The specific clinic a patient visited — and only that clinic. A patient's details are never shared with any other clinic or doctor.
• Google — only in that a patient who replies is given a link to their clinic's own public Google review page. We don't send any patient data to Google ourselves.

We do not share personal data with any other third party except where required by law.

6. Consent

• Where a clinic shares its own patient list with us, that clinic is responsible for confirming its patients have already agreed to be contacted — this is a condition of the clinic using this service, not something we independently verify patient-by-patient.
• We receive patient details only from the clinic's own reception, as part of their daily patient list. The receptionist confirms the patient's consent to receive a follow-up message at the time of the visit, before including them on that list. This daily list is emailed to us by the clinic — it is the only source of patient data we use, and no patient data is collected directly by VaidyaSpot through any other channel.
• Every message we send lets a patient reply STOP to opt out permanently.

7. How Long We Keep Data

We retain a patient's contact details and follow-up reply history for 12 months from the date of their clinic visit. After 12 months, this data is automatically and permanently deleted from our systems. We do not keep indefinite records of patient contact information or conversations.

8. Your Rights

Subject to the DPDP Act's phased rollout (its formal right-to-erasure provisions become fully enforceable from May 2027; we intend to honor the rights below now, ahead of that), you have the right to access the personal data we hold about you, correct inaccurate data, request its erasure, and raise a grievance with our Grievance Officer below — and, once the relevant provisions take effect, with the Data Protection Board of India.

9. Grievance Officer

10. Security

We take reasonable security practices and procedures in line with Section 43A of the Information Technology Act, 2000 and the associated Sensitive Personal Data or Information (SPDI) Rules, 2011. No system is perfectly secure; please report any suspected security issue to our Grievance Officer above immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time as this service develops.