Privacy Policy

1. Overview

MediCRM is a healthcare CRM built for OPD clinics in India. The platform stores patient records, consultation notes, OPD queues, prescriptions, appointments, follow-ups, billing references, and operational data for the clinics that subscribe to it. We take privacy seriously because the data we handle is sensitive personal data and information (“SPDI”) under Indian law.

This policy describes our practices for the MediCRM web application, the administrative console used by Bhatti Medtech Private Limited, and our marketing pages. By using the platform, you confirm that you have read and understood this policy.

2. Who we are

Bhatti Medtech Private Limited (referred to as “we”, “us”, “MediCRM”, or “The MediCRM”) owns and operates the MediCRM platform and the website themedicrm.com. It is a company incorporated in India (CIN U62011PB2026PTC070041) with its registered office at 652, Sunny Enclave, Sector 124, Kharar, SAS Nagar, Punjab, India. Where this policy refers to a “Data Fiduciary”, “Data Processor”, or “Data Principal”, those terms carry the meaning given to them under the DPDP Act, 2023.

3. Our role: Fiduciary vs Processor

For the same piece of data, our role can change depending on who provided it:

3.1 Patient data inside a clinic’s workspace

When a doctor or clinic uses MediCRM to record patient information, the clinic is the Data Fiduciary and is responsible for the lawful collection and use of that data. MediCRM acts as a Data Processor on behalf of the clinic, processing patient data only on the clinic’s documented instructions and under the subscription agreement.

3.2 Account, billing, and marketing data

When you, as an individual doctor, staff member, or business owner, sign up for MediCRM, book a demo, or interact with our marketing pages, Bhatti Medtech Private Limited is the Data Fiduciary for that information.

4. Legal framework we follow

• Digital Personal Data Protection Act, 2023 — lawful basis, notice and consent, Data Principal rights, breach reporting, and obligations of Data Fiduciaries and Data Processors.
• Digital Personal Data Protection Rules, 2025 — operational rules for notices, consent managers, security safeguards, grievance redressal, retention, and Significant Data Fiduciary obligations.
• Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — ISO/IEC 27001-aligned security controls for SPDI such as health records, passwords, and financial information.
• Telemedicine Practice Guidelines, 2020 issued by the Board of Governors in supersession of the Medical Council of India (now under the National Medical Commission) — classification of teleconsultations, patient consent, prescription rules, and digital record-keeping for at least three years.
• Electronic Health Record (EHR) Standards for India, 2016 issued by the Ministry of Health & Family Welfare — clinical informatics, interoperability, data ownership, privacy, and security.
• Clinical Establishments (Registration and Regulation) Act, 2010 and applicable state rules — clinical record-keeping obligations.
• Drugs and Cosmetics Act, 1940 and the Pharmacy Act, 1948 — restrictions on prescribing and dispensing applicable to prescription data.
• Ayushman Bharat Digital Mission (ABDM) Health Data Management Policy — followed where MediCRM integrates with ABHA / ABDM building blocks.

5. Data we collect

5.1 Account & business data

• Business name, GSTIN, address, and registration metadata supplied during signup.
• User identity: full name, email, mobile number, role, registration / licence number for clinicians (where provided).
• Authentication data: hashed passwords, session identifiers, login IP, device fingerprint.
• Subscription, billing, and payment references (we do not store full card numbers; payments are processed by PCI-DSS compliant gateways).

5.2 Clinical & patient data (SPDI / health data)

• Patient demographics: name, age, sex, contact details, ABHA ID (if shared).
• Medical history, allergies, vitals, examination notes, diagnoses, ICD codes.
• Prescriptions, lab orders and reports, imaging references, vaccination records.
• OPD queue status, appointment timestamps, follow-up reminders.
• Consents recorded for teleconsultation and treatment.

5.3 Operational telemetry

• Application logs, error reports, performance metrics, and audit trails (who accessed what, when).
• Cookies and similar identifiers strictly necessary to run the application (see section 15).

5.4 Marketing & demo enquiries

• Contact details and clinic context submitted through the demo form.
• Email correspondence and meeting notes when you engage our sales or support teams.

6. Purposes & lawful basis

We process personal data only for the purposes listed below and only for as long as those purposes require. Lawful basis under the DPDP Act is either consent or a recognised legitimate use.

• Service delivery — running the MediCRM application, storing records on behalf of clinics, sending appointment reminders, and generating reports. Basis: contract / consent.
• Clinical record-keeping — supporting clinicians in meeting their legal record-keeping obligations. Basis: legitimate use (compliance with law).
• Security & fraud prevention — detecting unauthorised access, abuse, or breaches. Basis: legitimate use (security of the platform).
• Billing & tax — invoicing, GST compliance, and payment reconciliation. Basis: compliance with law.
• Product analytics — aggregated, de-identified usage statistics to improve the product. Basis: legitimate use.
• Marketing & demos — responding to your demo or sales enquiry. Basis: consent (you can withdraw at any time).

We do not sell personal data. We do not use patient clinical data for advertising or model training.

7. Notice, consent & withdrawal

Where consent is the lawful basis, we obtain it through clear affirmative action and keep an auditable record. Consent is free, specific, informed, unconditional, and limited to a stated purpose, as required by section 6 of the DPDP Act.

You may withdraw consent at any time by writing to the contact in section 19 or by using the in-product controls. Withdrawal does not affect the lawfulness of processing already carried out. Where withdrawal makes it impossible for us to deliver the service, we will tell you and stop processing in line with section 6(6) of the DPDP Act.

For clinics: you are responsible for obtaining your patients’ informed consent for the collection of clinical data and for teleconsultation in line with the Telemedicine Practice Guidelines, 2020. MediCRM provides the technical means to record that consent, but the duty to obtain it lies with the clinician.

8. Sharing & disclosure

We share personal data only as described below.

• Authorised users of your clinic. Records are visible only inside your clinic’s workspace and only to users your administrators grant access to, based on role-based permissions.
• Sub-processors we engage to run the platform — hosting and managed database (Supabase / PostgreSQL), session store (Upstash Redis), WhatsApp messaging (MSG91, delivered through Meta’s WhatsApp Business Platform), email delivery, error monitoring, and payment gateways. Each sub-processor is bound by contract to confidentiality, security, and DPDP-aligned processing terms. A current list is available on request.
• Legal disclosures. We may disclose data when required by a valid order of a court, tribunal, regulator, or law-enforcement authority in India, or to protect rights and safety as permitted by section 7 of the DPDP Act.
• Business transfers. If Bhatti Medtech Private Limited is involved in a merger, acquisition, or asset transfer, personal data may be transferred subject to this policy and applicable law; we will give prior notice where required.

9. WhatsApp communications and data processing

We provide automated messaging services to healthcare providers through the WhatsApp Business Platform. When you book an appointment with a participating clinic using The MediCRM (a product of Bhatti Medtech Private Limited) and agree to receive WhatsApp messages, your phone number and the appointment details in the message (your first name, the clinic’s name, and the appointment date, time and token number) are shared with our messaging provider MSG91 (Walkover Web Solutions Pvt. Ltd.) and with Meta Platforms, Inc., strictly to deliver appointment confirmations, cancellations and reminders. No health information is shared with them.

The MediCRM acts as a data processor on behalf of your healthcare provider, who remains the data controller. We do not use your personal information for marketing purposes without your explicit, separate consent. You may opt out of these notifications at any time by replying STOP to any message or by contacting your clinic directly. Messages come from a WhatsApp number shared by clinics that use The MediCRM, so replying STOP stops messages from all of them.

10. Cross-border transfers

MediCRM’s primary data hosting is in India. Some sub-processors may store limited operational data (such as logs or transactional message metadata) outside India. We transfer personal data outside India only to jurisdictions not restricted by the Central Government under section 16 of the DPDP Act, and only with contractual safeguards that maintain a comparable level of protection.

11. Retention

• Patient and clinical records — retained for as long as the clinic subscribes to MediCRM and for the period required by the Clinical Establishments Act and the Telemedicine Practice Guidelines (which require digital records to be kept for at least three years, longer where state rules or the nature of the treatment require it).
• Account and audit data — retained for the duration of the subscription plus up to 3 years for audit and dispute-resolution purposes.
• Billing and tax records — retained for 8 years to meet the CGST Act’s record-keeping requirements.
• Demo / marketing enquiries — retained for up to 24 months from your last interaction, unless you ask us to delete them sooner.
• Backups — encrypted backups are rotated on a defined schedule (typically 30 days), after which the corresponding data is irrecoverably purged.

When a clinic terminates its subscription, we provide a reasonable export window and then delete or anonymise the workspace data, subject to legal retention obligations.

12. Security safeguards

We implement reasonable security practices aligned with ISO/IEC 27001 and the standard expected under Rule 8 of the IT (Reasonable Security Practices) Rules, 2011 and Rule 6 of the DPDP Rules, 2025.

• Encryption in transit (TLS 1.2+) and at rest for databases, backups, and object storage.
• Role-based access control, least-privilege defaults, and per-workspace data isolation.
• Audit logging of access to clinical records, with tamper-evident storage.
• Hashed and salted passwords; short-lived session cookies stored httpOnly with sameSite=strict.
• Rate limiting, mutation guards, CSP with per-request nonces, HSTS, and other hardened HTTP security headers.
• Vulnerability scanning, dependency monitoring, and a documented incident response plan.
• Periodic backup verification and tested disaster-recovery procedures.
• Staff access on a need-to-know basis, governed by confidentiality undertakings and offboarding controls.

No security control is perfect. If you believe an account has been compromised, contact us immediately at the address in section 19.

13. Your rights as a Data Principal

Subject to the DPDP Act and DPDP Rules, every Data Principal (the individual the data relates to) has the following rights:

• Right to information & access — request a summary of the personal data we hold about you, the processing carried out, and the identities of any third parties with whom data has been shared.
• Right to correction, completion, and updating of inaccurate or incomplete data.
• Right to erasure of data no longer necessary for the purpose for which it was collected, subject to legal retention obligations.
• Right to grievance redressal through the channels set out in section 17.
• Right to nominate an individual to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent at any time, with the same ease with which it was given.

We acknowledge all rights requests promptly and respond within 90 days, as required by the DPDP Rules. Where MediCRM acts only as a Data Processor for your clinic, we will route your request to the clinic (the Data Fiduciary) and assist them in fulfilling it.

14. Children’s data

MediCRM is not directed at children. A “child” means a person under eighteen years of age under section 2(f) of the DPDP Act. We process a child’s personal data only when a clinician is treating a paediatric patient and the verifiable consent of a parent or lawful guardian has been obtained. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

15. Cookies & analytics

We use strictly-necessary cookies to authenticate sessions (crm_session, superadmin_session) and to protect against cross-site request forgery. These cookies are httpOnly, sameSite=strict, and expire on a short cycle. We do not set advertising cookies. Any product analytics we operate are aggregated and de-identified.

16. Breach notification

If we become aware of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals without undue delay and within the timelines prescribed by Rule 7 of the DPDP Rules. Where MediCRM is a Data Processor, we will notify the affected clinic so it can meet its own notification obligations as Data Fiduciary.

17. Grievance redressal

If you have a privacy concern, you may contact our Grievance Officer / Data Protection contact. We will acknowledge your complaint within 7 business days and aim to resolve it within 30 days, in line with the DPDP Rules and Rule 5(9) of the IT (Reasonable Security Practices) Rules, 2011.

18. Updates to this policy

We review this policy at least annually and whenever our data practices materially change. The “Last updated” date at the top of this page always reflects the latest revision. We will give reasonable advance notice of material changes through the application or by email.

19. Contact

For any question about this policy or about how we handle your personal data, write to connect@themedicrm.com.