LEGAL

Privacy Policy

Version 1.0.0 · in force since 2026-09-13 · DPDP Act, 2023 · ABDM Health Data Management Policy

Two kinds of data

Account data is about the clinic and its staff — names, work email, phone, role, registration number, billing details. Patient data is entered by clinics into the platform, including by patients themselves through a clinic’s public booking page. For account data we are the data fiduciary. For patient data the clinic is the fiduciary and we are a data processor acting on its instructions.

What we collect and why

We collect only what the service needs:

Identity and contact details — to create accounts, authenticate users, raise invoices, and to match or register a patient when someone books through a clinic’s public page.

Clinical records entered by clinic staff — to provide the service you asked for: consultations, prescriptions, labs, IPD.

Dictation audio and its transcript — see Voice and dictation data below.

Payment and billing details — see Payment data below.

Device and log data — IP, device model, timestamps — for security, audit trails and abuse prevention. Access and audit logs are kept for up to two years; details of the cookies involved are in our Cookies Policy.

Product analytics on staff usage of the application only — patient content is excluded by design: on-screen text is masked, form fields are not captured, and the analytics provider processes this outside India.

Health data

Patient records — history, examination findings, diagnoses, prescriptions, lab results, admission and discharge notes — are health data, treated as sensitive under the DPDP Act, 2023. Access is limited to the roles a clinic grants (front desk, nursing, clinician, pharmacy, owner and similar), every read and write is logged against the user who made it, and the data is used only for the purpose the clinic collected it for: your care, billing for it, and the legal/clinical record-keeping a healthcare provider must maintain. We don’t repurpose health data for advertising, and we don’t combine it across clinics for anything beyond anonymised, aggregate product statistics.

Voice and dictation data

Dictation only records when a clinician actively starts it. The audio is held in memory while it is sent to our speech-to-text sub-processor for transcription — we do not write raw audio to disk or to logs on our own servers. Once transcribed, the audio is discarded from processing; only the resulting transcript, and the structured fields an AI model derives from it, are kept as part of the clinical record after a clinician reviews and signs. Audio and its transcript are used for exactly one purpose — producing that consultation’s draft note — and are never used for advertising, sold, or used to build a voiceprint or any profile of the speaker.

Uploaded documents

Clinics and patients can upload documents — lab reports, old prescriptions, referral letters — as PDFs or photographs. We read them so the clinician gets a short summary beside the file, and how we read one depends on what it is:

A PDF that already contains text — a laboratory’s own export, for example — is read entirely on our own servers. Nothing about it is sent anywhere to be read.

A photograph or a scan has no text to read, so optical character recognition runs on our servers to turn the picture into text. The picture itself is not sent to any AI provider for this.

In both cases it is only the resulting TEXT that goes to an AI sub-processor to be summarised, and identifying details are masked before it leaves — the same protection applied to dictation.

If a document cannot be read by either method — a very poor photograph, or handwriting — a clinic may choose to enable a last-resort step in which the IMAGE is sent to an AI sub-processor to be transcribed. This is off unless a clinic turns it on, because an image cannot be masked: a report usually has the patient’s name printed on it. When it is off, the document is simply flagged as unreadable and a clinician writes the summary themselves.

Every document we could not read, and every use of that last-resort step, is recorded so a clinic can see how often it happens.

The original file is always kept as uploaded. A summary never replaces the document, and a clinician reads the report itself before acting on it.

AI usage

AI is central to how Rappel Health works, so here is the fuller picture:

What AI does — turns dictated speech into text, maps that text into consultation fields (complaints, findings, diagnosis, plan) with a confidence score per field, and can draft documents such as prescriptions and discharge summaries from what was recorded during the visit.

What’s sent to AI providers — the audio or transcript text and the minimum structured context a feature needs to do its job; we don’t hand AI sub-processors more than that.

Where processing happens — your patient record is stored in India; our application servers are in Singapore and read it from there (see Where data lives). Some AI sub-processors run their models outside India; when that happens, the audio or text passes through them to be processed — turned into a transcript or structured fields — and the output is written back into your record in India. We contractually limit these sub-processors to processing, not indefinite storage, and bar them from training their models on your data, under safeguards consistent with the DPDP Act’s cross-border transfer rules.

Human review, always — AI output is a draft. Nothing an AI model produces is submitted, printed, messaged, billed or filed as part of a patient’s record until a clinician reviews it and signs; low-confidence output is flagged rather than silently accepted.

No training on your data — patient records, transcripts and dictation audio are never used to train our AI providers’ models, ours, or anyone else’s.

Payment data

For subscription billing, and for patient payments made through a clinic’s public page, card and bank account details are collected and stored by our payment gateway, not by us — we only ever see and keep what’s needed for invoicing and reconciliation (amount, status, a masked payment reference). Patient payments settle directly to the clinic through the gateway; we don’t hold or route that money ourselves. See our Refund & Cancellation Policy and Terms of Service for how subscription and patient payments are each handled.

We do not sell data

We never sell, rent or share patient data for advertising. Our sub-processors — including the speech-to-text and AI providers we use to turn a dictation into consultation fields — are contractually barred from using patient data to train their own models. Anonymised, aggregate statistics may be used to improve the product.

Sub-processors

We use a small number of specialist providers, each bound by a data processing agreement: database hosting and backups in India; application hosting in Singapore; payment processing; speech-to-text transcription; AI models that structure a transcript into consultation fields and draft documents; SMS, WhatsApp and email delivery; product analytics on staff usage; and error monitoring. Our application servers, and several of the AI, analytics and messaging providers, process data outside India and return the result — the patient record itself is stored in India. See Where data lives below. We don’t publish exact vendor names on this page because they change; the current list, and where each one sits, is available on request, and material changes are notified 30 days ahead.

Where data lives and how long

Your patient record — the data at rest — is stored in India, and backups are kept in India. The servers that run the application are in Singapore, because our hosting provider withdrew its Indian region; they read from and write to the Indian database, and we deliberately did not move the database to follow them. So your record lives in India while the processing of it happens in Singapore. Two things about that are worth stating plainly. First, our job queue — which briefly holds items such as a reminder's recipient, name and appointment time, and payment confirmations from the gateway — runs on those Singapore servers and is stored there until the job completes. Second, some AI sub-processors run elsewhere again, under agreements limiting them to processing rather than indefinite storage, with the result written back into your record in India. All of this is cross-border transfer under section 16 of the DPDP Act, 2023, and is permitted: the Act allows transfer except to countries the Government restricts, and none has been restricted. Patient records are retained while your account is active and for the statutory period your clinic must observe; account and billing data for eight years as required by Indian tax law. We back up regularly and periodically test that we can restore from those backups.

Communications and AI processing

Operational messages — appointment activity, security, billing, service status — go with the account or booking they belong to, because they are how the service works. Marketing is a separate, optional agreement, asked for on its own and withdrawable at any time as easily as it was given, with no effect on your account, your price or your care. AI processing is likewise not a condition of holding an account: a clinic can leave dictation and AI drafting switched off and the rest of the product works unchanged. Where AI runs on patient data, the clinic is the data fiduciary and is responsible for the notice and consent its patients are owed; we act on the clinic’s instructions. Full detail is in our Terms of Service (Part A §5 and §6 for clinics and staff, Part B §16 for patients).

Public users and website visitors

If you book through a clinic’s public page, we collect only what that flow asks for — your name, mobile number and, optionally, email — to match or create your record with the clinic and to send you booking confirmations. Browsing rappel.health itself doesn’t require giving us anything; the only data involved is described in our Cookies Policy.

Your rights

You may request access, correction, erasure, a copy of your data or nomination of a representative. Patients should approach their clinic first, as the clinic holds the record; we support clinics in fulfilling those requests. Write to privacy@rappel.health — we respond within 30 days.

Breach notification

If a personal data breach affects you, we notify the Data Protection Board and affected clinics without undue delay, with what happened, what data was involved and the steps we are taking.

ABDM and ABHA

The platform lets a clinic record a patient’s ABHA ID against their chart. Broader exchange under the ABDM Health Data Management Policy — Health Information Provider registration and Consent Manager integration — is on our roadmap and not yet built; nothing on our site should be read as saying otherwise, and we will update this policy as it ships.

Privacy requests: privacy@rappel.health

Version history: 1.0.0 (current)