MyOPD Privacy Policy

Privacy Policy

Product: MyOPD • Version: [1.1] • Effective: 26/08/2026

MyOPD holds medical records. This policy explains what we do with them, and is written for two audiences: the clinics that use MyOPD, and the patients whose records are in it.

MyOPD is supplied by Caresoft Systems Private Limited ("Caresoft", "we"), Mumbai, India.

If you are a patient: your medical records belong to your clinic, not to us. We hold them on the clinic's instruction, in the same way a filing cabinet holds paper records. For anything about your own records — a copy, a correction, a question — contact your clinic. Section 17 explains what we can and cannot do directly.

Four commitments to every clinic and every patient:

1. Health data is stored and processed within India.
2. We never sell health data, share it between clinics, or use it for our own purposes.
3. We never use patient data to train artificial intelligence models.
4. Caresoft staff access patient records only for support the clinic requested or a security incident — and every access is logged with a reason the clinic can see.

1. Who is responsible for what

Data	Clinic	Caresoft
Patient records, prescriptions, clinical notes	Data Fiduciary / Controller	Data Processor
Appointments, tokens, billing records	Controller	Processor
Clinic staff accounts and audit logs	Controller	Processor
Clinic subscription, billing and support records	Counterparty	Controller
Website and enquiry data	—	Controller
System logs required by law	—	Controller

Processing terms are in the Data Processing Addendum, which prevails for clinics. The clinic decides what is collected, who sees it and how long it is kept — we provide the tools and follow the clinic's instructions.

2. What is held

2.1 Patient data

Name, age or date of birth, sex, contact number, address and email where provided, patient ID, and where the clinic enables it an ABHA number; appointment and visit history; consultation records — presenting complaint, history, examination findings, diagnosis, advice — as entered by the doctor; prescriptions issued; investigations advised and results recorded; and billing, receipts and payment records.

2.2 Clinic and user data

Clinic name, address, registration details, GSTIN; practitioner names, qualifications and registration numbers; staff accounts with names, work contact details and roles; credentials (passwords stored only as salted and peppered one-way hashes).

2.3 Activity data

Sign-ins, records viewed and changed, prescriptions issued, exports, configuration changes, device, browser and IP address. Clinical record access is logged immutably — this is what evidences who did what, and it is deliberately not editable.

3. Health data

Everything in a consultation record is health data. A diagnosis, a prescription, even the fact of an appointment at a particular clinic can reveal something a person would not choose to disclose.

It is treated as sensitive throughout — in access control, in messaging, in logging, and in what we will and will not do with it.

Clinics should collect only what they clinically need. A field that exists does not have to be filled.
Clinics should restrict which staff can open clinical records; front desk functions rarely require them.
Screen privacy matters. A reception monitor visible to the waiting room can disclose the previous patient's details. That is the clinic's responsibility to manage.

4. Children's data

Where a patient is a child, the record is created and accessed on the basis of the parent's or lawful guardian's involvement, and the clinic is responsible for verifiable consent where the Digital Personal Data Protection Act, 2023 requires it.
The Act prohibits tracking, behavioural monitoring and targeted advertising directed at children. MyOPD does none of these for any patient, of any age.
Records of a child patient generally must be retained well beyond the ordinary period, because the limitation period for a claim can run from majority. Clinics must not configure automatic deletion of paediatric records without advice.
Clinics should consider carefully who may access an adolescent patient's record, and take advice where a young person attends without a parent.

5. Who can see it

5.1 Within the clinic

Only users the clinic authorises, limited by the role assigned. The clinic provisions and revokes access. No other clinic can see your data — tenant isolation is enforced at the data layer, and there is no interface by which one clinic can reach another's records.

5.2 Between clinics

Records are not shared between clinics on the MyOPD platform. The only route by which a record leaves a clinic is ABDM, with the patient's consent (§11), or an export the clinic itself performs.

5.3 Nobody else

Not insurers, not employers, not pharmaceutical companies, not researchers, not marketers, not data brokers. If any third party asks us for patient data, the answer is no unless the clinic instructs us in writing or a court compels us.

6. Caresoft access

Caresoft personnel access patient records only where:

the clinic has raised a support request that requires it;
a security incident or suspected misuse is being investigated;
a patient-safety issue is being investigated; or
we are compelled by valid legal process.

Every such access is individually authenticated, requires multi-factor authentication, and is logged with the person, time, records accessed and stated reason. That log is available to the clinic on request. Production data is never copied into development, test, training or demonstration environments — those use synthetic data only.

7. Why it is processed

To run the clinic's appointments, consultations, prescriptions, billing and reporting.
To send appointment and reminder messages the clinic configures.
To maintain the audit trail of clinical record access and changes.
To provide support the clinic requests.
To secure the Platform and prevent misuse.
Where enabled, to exchange records under ABDM with the patient's consent.
To meet legal obligations, including mandatory log retention and incident reporting.

Product improvement uses aggregate operational metrics — how often a screen is used, where errors occur, how long a page takes — never the content of clinical records.

8. Lawful basis and consent

The clinic determines the lawful basis on which it processes patient data, and is responsible for the notice it gives patients and any consent it must obtain.
Caresoft processes on the clinic's documented instructions as its processor.
For the clinic's own account and billing data, we process on the basis of our contract and our legal obligations.
Clinics should display a patient privacy notice at reception explaining what is recorded and why. We can supply a template; the clinic is responsible for its accuracy and for displaying it.

9. What we never do

We do not:

• sell, rent, licence or trade patient data
• share records between clinics
• supply data to insurers, employers, pharmaceutical companies or data brokers
• use patient data for research or publication
• publish benchmarks in which a clinic or patient could be identified
• use patient data to train artificial intelligence models
• market to patients, or allow anyone else to
• profile or track patients

These are contractual commitments in the DPA. Any change to this section will be notified prominently and in advance.

10. Messaging and reminders

Where the clinic enables messaging, appointment and reminder messages are sent through third-party providers under their own terms. Delivery is not guaranteed — messages may be delayed, blocked or filtered.

A message reveals information to whoever holds that phone. Message content is kept minimal for this reason — clinics should not include diagnoses, medicines or department names in a reminder, and should confirm the number belongs to the patient.

The clinic is responsible for obtaining consent to contact patients, for template content, and for compliance with telecom and messaging regulations. Numbers change hands, so contact details should be verified at each visit.

11. ABDM and ABHA

Where the clinic enables ABDM, records are exchanged under the ABDM framework and Health Data Management Policy, using the patient's ABHA and ABDM's consent mechanism.
ABHA is voluntary. A clinic must not refuse or condition care on a patient creating or linking one.
Sharing happens only with the patient's consent through the ABDM flow, for the purpose and duration that consent specifies.
Once a record is shared to another facility, it is out of the clinic's control and ours. We cannot retrieve, correct or withdraw it. A patient wanting a record corrected at the receiving facility must approach that facility.
Patients may withdraw ABDM consent through their ABHA. Withdrawal stops future sharing; it does not recall what was already shared.

Hosting — within India.
Messaging — WhatsApp Business Solution Provider and SMS gateway, where the clinic enables them. They receive the number and the message content the clinic configured.
Transactional email — for account notices and clinic-configured emails.
Payment gateway — for the clinic's subscription, and for patient payments where enabled. Card details are held by the gateway, not by us.
ABDM ecosystem participants — only on the patient's consent (§11).
Authorities — where compelled by valid legal process. We assess each request, disclose the minimum required, and notify the clinic unless prohibited.

13. Where data is held

Patient records, backups and disaster recovery copies are stored and processed within India. Caresoft support and engineering access is from India.

14. How long it is kept

Medical records carry statutory retention obligations, and those override a deletion request — including a request from the patient.

Under professional conduct regulations, outpatient records must generally be kept for not less than three years from the last consultation, and longer where State rules, a court, a pending complaint, or a paediatric patient requires it.

Data	Retention
Patient records, prescriptions, clinical notes	As configured by the clinic, subject to its statutory minimum. The clinic sets this and is responsible for setting it lawfully
Billing and financial records	As required by tax law — up to 8 years
Clinical record access audit log	Life of the record — this is the evidence of who accessed what
Appointment and token records	As configured; default [24] months
Message delivery records	[12] months
Clinic and user accounts	Life of the account plus [90] days
Support correspondence	[24] months from closure
System logs required by law	Minimum 180 days, held in India
Backups	Rolling [35] days
After the clinic terminates	Export window [60] days, then deletion — see below

If a clinic leaves MyOPD, its statutory retention obligation does not leave with it. The clinic must export and retain its records. We delete our copy after the export window, and deleted data is not recoverable.

15. Security

Encryption in transit and at rest; passwords stored as salted and peppered one-way hashes; role-based access with multi-factor authentication for administrative accounts; tenant isolation at the data layer; immutable audit logging of clinical record access and changes; no production data in non-production environments; vulnerability scanning and periodic penetration testing; documented incident response.

Security is shared. The clinic is responsible for its premises, devices, network, screen privacy, and revoking access promptly when staff leave.

16. If something goes wrong

We notify the clinic of any personal data breach affecting its data without undue delay, and in any event within [6] hours of confirmation — the shortest window across our products, because this is health data.
We are required to report specified cyber incidents to CERT-In within 6 hours, and to retain system logs for a minimum of 180 days within India.
Evidence is preserved until the investigation closes.
The clinic notifies affected patients and the Data Protection Board of India as Data Fiduciary. We provide the information and support required.
We provide a written root cause analysis with corrective actions within [10] working days.

17. Rights — patients and clinics

17.1 If you are a patient

Contact your clinic, not us. Your clinic holds and controls your records; we cannot identify you, verify who you are, or act on your records without the clinic's instruction. Approaching us directly will only delay things.

Subject to law, you may ask your clinic for access to your records, correction of inaccurate information, a copy in a usable form, and erasure — although your clinic will usually be legally required to keep your records for a minimum period and cannot erase them on request (§14). You may also nominate someone to exercise your rights.

If a request reaches us directly, we will not act on it, will tell you to contact your clinic, and will inform the clinic within [2] working days.

17.2 If you are a clinic

You have direct access to your data in the product and can respond to patient requests yourself. Where you cannot, we will assist as your processor. For your own account data, write to [email protected]; we verify and respond within 30 days.

Patients dissatisfied with a clinic's response may complain to the Data Protection Board of India, and separately to the relevant medical council or consumer forum on clinical matters.

18. Cookies

Strictly necessary cookies for sign-in, session management and security; functional cookies for preferences; analytics only with consent. The clinical application uses no advertising or tracking cookies. Full detail in our Cookie Policy.

19. Contact and Grievance Officer

Support: [email protected]

Grievance Officer (Information Technology Act, 2000; Digital Personal Data Protection Act, 2023)
Name: Rajeev Pillai
Email: [email protected]
Address: 311, Mahesh Industrial Estate , Silver Park, Mira Road East , Thane -401107
Acknowledgement within 24 hours; resolution within 15 days.

Caresoft Systems Private Limited, 311, Mahesh Industrial Estate , Silver Park, Mira Road East , Thane -401107, CIN [U72900MH2022PTC387875].

20. Changes

We may update this policy. The version date will change. Material changes are notified at least [30] days in advance. Any change to §9 will be notified prominently and in advance — those commitments are the substance of the promise.