1.Who we are
This policy explains how OPflow (“OPflow”, “we”, “us”) handles personal data. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described in this policy.
OPflow is a technology platform that helps patients book outpatient (OPD) consultation windows with independent doctors, clinics and hospitals (“Healthcare Providers”) and follow the live queue. We are not a healthcare provider.
2.What this policy covers
This policy applies to the OPflow mobile app (patient portal and doctor & clinic portal), this website and any related services, notifications and support channels. It does not cover the practices of Healthcare Providers, who handle your consultation and medical records under their own obligations, or of third-party services you reach through links (for example, map apps).
3.Personal data we collect
From patients
- Account data: mobile number (verified by OTP), name, and optionally email.
- Booking data: the patient's name, age, sex and relationship to you (for example, a child or parent you book for), the doctor, hospital, date, window, token and booking status.
- Queue data: arrival, called, completed, no-show and cancellation events recorded by the clinic for your booking.
- Payment data: amount, status, order and transaction references. Card, UPI and bank details are entered directly with our payment gateway (Cashfree Payments) and are not stored by OPflow.
- Search data: specialties, symptoms or hospitals you search for. Symptom search is used only to suggest a type of doctor.
- Location: only if you allow it: your area, from your phone's location, to show doctors and hospitals near you and distances, and to find doctors near you for a doctor suggestion.
- Doctor suggestions: when you ask for one, the type of doctor, your area, your agreement to the terms of the suggestion, the payment and the doctors suggested to you.
- Visit feedback: if you rate a finished visit, the rating (1 to 5) and your optional note. Only OPflow sees it; we use it to choose the doctors we suggest. It is never shown to the doctor or to other patients.
- Support data: messages and call records when you contact us or a clinic through OPflow.
From doctors, clinic staff and hospitals
- Name, photograph, specialty, qualifications, medical registration number and council, languages.
- Verification documents you submit, which are used only to verify your profile.
- Hospital or clinic details, OPD schedules, capacity, fees, delays and availability you publish.
- Bank or settlement details, if you receive payouts through OPflow.
Collected automatically
- Device type, operating system, app version, IP address, crash reports and basic usage events.
- Push notification tokens, so we can send booking, delay and queue updates.
We follow data minimisation. OPflow V1 does not collect prescriptions, diagnoses, test reports or medical records. Please don't send them to us through support channels.
4.How we use personal data
- To create and secure your account, including OTP login.
- To show doctors, hospitals, OPD schedules and open windows, and to make and manage bookings.
- To share your booking with the Healthcare Provider you chose, so they can see and serve you.
- To calculate queue positions, wait estimates and delays, and to notify you about them.
- To process payments, cancellations and refunds and to prevent duplicate or fraudulent payments.
- To verify doctors before their profiles become public.
- To provide support, resolve complaints and grievances, and send service messages.
- To keep the service secure, detect misuse and meet legal, tax and accounting obligations.
- To improve OPflow, for example queue-time predictions, using aggregated or de-identified data wherever possible.
5.Consent and legal basis
We process personal data on the basis of your consent, given when you sign up, book, allow location or enable notifications, and for certain legitimate uses permitted by the DPDP Act, such as complying with law, responding to medical emergencies involving a threat to life, and processing that you have voluntarily provided data for.
You can withdraw consent at any time from the app settings or by writing to us. Withdrawal does not affect processing already done, and some services (such as an active booking) may not be available without the data they need.
7.How we protect data
- Encryption in transit (HTTPS/TLS) and encryption at rest for our databases.
- Role-based access: a patient sees only their own bookings; a doctor or clinic sees only their own patients.
- Payment verification on our servers before any booking is confirmed.
- Access logs and audit trails for staff and admin actions on sensitive records.
- Regular backups and a recovery process.
- If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as required by law.
8.How long we keep data
We keep personal data only as long as needed for the purposes above:
| Data | Kept for |
|---|---|
| Account data | While your account is active, then deleted or anonymised within 90 days of closure. |
| Bookings, payments and refunds | Up to 8 years, as required for tax and accounting records. |
| Doctor verification documents | While the profile is active and up to 3 years after, for audit. |
| Logs and crash reports | Up to 180 days, unless needed to investigate an incident. |
9.Your rights
Under the DPDP Act you can:
- Get a summary of the personal data we process about you and who we share it with.
- Ask us to correct, complete, update or erase your personal data.
- Withdraw consent you have given.
- Nominate another person to exercise your rights in case of death or incapacity.
- Have your complaints addressed by us (write to info@opflow.in), and then by the Data Protection Board of India.
To exercise these rights, use the app settings or write to info@opflow.in. We may need to verify your identity first.
10.Children
Accounts are for people aged 18 and above. Parents or lawful guardians can book for a child from their own account; by doing so they give consent on the child's behalf. We do not track, profile or send targeted advertising to children.
12.Changes to this policy
We may update this policy as OPflow changes or the law requires. We will change the date at the top and, for significant changes, notify you in the app or by email before they take effect.
13.Complaints and contact
In line with the Information Technology Act, 2000, the rules made under it and the DPDP Act, send any complaint about your personal data or our service to info@opflow.in, with “Grievance” in the subject.
We acknowledge grievances within 24 hours and aim to resolve them within 15 days. For anything else, contact info@opflow.in or see our Contact page.