Privacy Policy

3.1 Personal Identification Information

• Full name, date of birth, gender, contact number, and email address
• Government-issued ID details (Aadhaar number, PAN, or passport) for identity verification - collected only with your explicit consent and used solely for verification purposes
• Address details for medicine delivery (e-Pharmacy) or diagnostic sample collection (e-Diagnostics)
• Photograph, if provided for profile identification

3.2 Health & Medical Information (Sensitive Personal Data - SPDI)

• Medical history, pre-existing conditions, symptoms, diagnoses, and treatment plans
• Prescriptions uploaded or generated through the e-Pharmacy module
• Diagnostic test results, pathology reports, imaging data (X-rays, MRIs, scans), and laboratory reports
• Electronic Health Records (EHR) created, accessed, and managed on the vcdoc platform
• Consultation notes, clinical summaries, and follow-up care information
• Vaccination records and immunisation history
• Mental health and psychological assessment information (treated with the strictest confidentiality)
• Biometric data, where applicable (e.g. for patient identification - only with explicit consent)

3.3 Technical & Usage Information

• IP address, device type, browser type, and operating system
• Log files, session data, cookies, and platform usage activity
• Payment transaction metadata - we do not store full card or banking details; payments are processed through PCI-DSS compliant third-party gateways
• Appointment booking history and platform interaction logs

3.4 Information from Healthcare Partners

• Referral data from affiliated hospitals, clinics, and healthcare institutions
• Test reports and imaging results shared by partner diagnostic laboratories
• Discharge summaries or clinical data from partner hospitals (shared for continuity of care, with consent)

3.5 Data Collected for Telemedicine (Telemedicine Practice Guidelines, 2020)

For online consultations conducted on the vcdoc platform, in compliance with the Telemedicine Practice Guidelines 2020 (issued by the Board of Governors in supersession of the Medical Council of India):

• Patient identity is verified before consultation
• Consultation mode (audio, video, or text) is recorded
• Registered Medical Practitioners (RMPs) on the platform are identified, and their registration details are retained
• Consent for teleconsultation is recorded explicitly
• Prescription details are maintained as part of the consultation record

5.1 Nature of Consent

• • Consent is free, informed, specific, and unambiguous.
• • For SPDI (health and medical data), consent must be explicit and in writing (including electronic form).
• • For teleconsultations, consent to the telemedicine mode of service and any sharing of records with other practitioners involved in your care is sought at the start of each consultation.
• • Consent for ABDM / Ayushman Bharat Health Account (ABHA) integration is sought separately and is entirely optional.

6.1 With Healthcare Providers (Need-to-Know Basis)

Your health data is shared with the doctors, specialists, hospitals, diagnostic centres, and pharmacies directly involved in your care through the vcdoc platform. This sharing is necessary to deliver connected, coordinated healthcare services and is governed by medical confidentiality obligations under the National Medical Commission (NMC) Code of Ethics.

6.2 With Technology and Service Partners

vcdoc engages third-party vendors for cloud hosting, payment processing, SMS/email communication, and logistics. Such partners:

• • Are bound by confidentiality and data processing agreements.
• • Are prohibited from using your data for any purpose other than the contracted service.
• • Are required to implement security standards equivalent to those maintained by vcdoc.
• • Are permitted to process data only within India, unless cross-border transfer is specifically authorised (see Section 9).

6.3 Legal and Regulatory Compliance

We may disclose your information when required by:

• • Indian courts, tribunals, or law enforcement agencies under lawful order.
• • The Data Protection Board of India (under DPDPA 2023).
• • The Ministry of Health & Family Welfare or National Health Authority.
• • State medical councils or the National Medical Commission (NMC).
• • Regulatory bodies under the Drugs and Cosmetics Act, 1940 (for e-Pharmacy compliance)
• • Any competent authority under the Clinical Establishments Act, 2010.

6.4 Ayushman Bharat Digital Mission (ABDM)

If you choose to link your vcdoc account with your Ayushman Bharat Health Account (ABHA), your health records may be shared with the National Digital Health Ecosystem in accordance with the ABDM Health Data Management Policy. This integration is entirely optional and requires your separate, explicit consent.

6.5 With Your Explicit Consent

For any sharing not described above, we will obtain your prior, explicit, written consent before disclosing your data.

Where any processing involves transfer of personal (non-health) data to service providers located outside India (e.g., cloud infrastructure providers), such transfers are conducted only:

• • To countries or territories notified by the Central Government as providing adequate protection for personal data; or
• • Under contractual terms that ensure the recipient provides a level of protection equivalent to Indian law; or
• • With your explicit, informed consent for the specific transfer.

Health data (SPDI) is not transferred outside India without explicit written consent and compliance with applicable Indian healthcare regulations.

vcdoc may collect and process health information for patients under 18 years of age (minors) when such information is submitted by a verified parent or legal guardian. The following safeguards apply:

• • Minors under 18 are not permitted to independently register, create accounts, or consent to data processing on the platform.
• • Parental or guardian consent, which must be verifiable, is required before any minor's health data is collected or processed.
• • Minor patient records are subject to extended retention periods (until the patient reaches 21 years of age plus 3 years, or as required by applicable medical regulations).
• • Parental or guardian access to a minor's health records is provided in accordance with applicable medical ethics guidelines.

If you believe a minor's data has been collected on vcdoc without appropriate guardian consent, please contact our Grievance Officer immediately at harshavardhan@vcdoc.in. We will investigate and take immediate remedial action.

Pages on vcdoc.in may include embedded content such as videos, health information resources, maps, or social media posts. Embedded content from other websites behaves in the same way as if you had visited those websites directly. Third-party embedded content providers may:

• • Collect data about you and your device.
• • Set their own cookies and tracking technologies.
• • Monitor your interaction with the embedded content.
• • Track your activity if you are logged into their platforms.

We do not embed third-party content on pages containing health data or within clinical/consultation areas of the platform. We encourage you to review the privacy policies of any third-party platforms whose content appears on vcdoc.in. We are not responsible for third-party data practices.

15.1 Doctor-Patient Confidentiality

All Registered Medical Practitioners (RMPs) on the vcdoc platform are bound by medical confidentiality obligations under the NMC Code of Professional Conduct. Patient information disclosed during consultations may not be shared by the RMP with any third party without patient consent, except as required by law.

15.2 Consultation Record Keeping

Records of all telemedicine consultations, including mode of consultation, patient identity, chief complaints, clinical notes, and any prescriptions issued, are maintained as part of the patient's EHR in accordance with the Telemedicine Practice Guidelines 2020 and MoHFW EHR Standards 2016.

15.3 Prescription Privacy

Digital prescriptions generated through the vcdoc platform are stored securely as part of the patient's health record and are shared only with the patient and the dispensing pharmacy. Prescriptions for Schedule H, H1, and X drugs are handled with additional controls in compliance with the Drugs and Cosmetics Act, 1940.

We may update this Privacy Policy periodically to reflect changes in our services, technology, or applicable legal and regulatory requirements. When material changes are made:

• • The "Last Updated" date at the end of this page will be revised
• • Registered users will be notified via email and/or a prominent notice on the platform.
• • Where the change affects how SPDI or health data is processed, we will seek fresh explicit consent before applying the change to your data.

We encourage you to review this policy periodically. Continued use of the platform after the effective date of changes constitutes acceptance of those changes.