Privacy policy
Last updated 12-10-2026
Who we are
MyDoctor (mydoctor.social) is operated by MODERNUS HEALTH TECHNOLOGIES PRIVATE LIMITED ("MyDoctor", "we"), registered office: B/32, Part-1, Ashapuri Society, Near Avakar Hall, Ghodasar, Ahmedabad, Gujarat 380050, India; office: Bangalore, Karnataka, India. Brand: MODERN US HEALTH. Contact: support [at] mydoctor.social.
Two roles
When a clinic, practice or hospital uses the MyDoctor software, that organisation decides what patient information is recorded; MyDoctor processes it on their behalf (a "data processor" in India and a "business associate" under HIPAA in the United States). When you contact us directly, use our care programmes or the Medical Tourism Concierge of MyDoctor, MyDoctor is responsible for your information.
What we collect
Contact details you give us (name, email, phone, country); account and sign-in information; health information that you or your healthcare provider record (visits, prescriptions, lab results, files); payment records (we do not store full card numbers, payments are handled by Razorpay or Stripe); and technical data needed for security (IP address, device and browser, sign-in times). For ABHA (India) we never store your Aadhaar number.
Why we use it
To provide care and the services you ask for; to run the software for healthcare providers; to send appointment, billing and care messages; to keep accounts secure and prevent fraud; to meet legal duties (tax, medical records, audits); and, only with your consent, to send news and offers. We do not sell personal data, and we do not use health information for advertising.
Consent and your choices
We ask for your consent separately for each purpose (health reminders, sharing with the doctors and family you choose, MyDoctor AI on your records, de-identified research, news and offers). You can switch each one on or off at any time in My data & privacy (https://mydoctor.social/app/index.php?r=mydata); withdrawing is as easy as giving, and every change is recorded. Withdrawing does not affect what was done before. You can stop WhatsApp messages by replying STOP.
Who we share with
Your healthcare providers and the people you authorise (for example family caretakers); service providers that help us run MyDoctor under contracts that protect your data (hosting, email, WhatsApp and SMS delivery, payment gateways, AI providers covered by a data protection or business associate agreement); insurers or TPAs only when you or your provider submit a claim; and authorities when the law requires it.
Where data is stored
Your data is stored securely, encrypted, on MyDoctor servers in the United States. MyDoctor AI answers are processed in India (Mumbai) for people in India and the rest of the world, and in the United States for people and practices in the United States. A clinic or hospital that needs its data kept in India can ask for it. We transfer data only as needed to provide the service, with the safeguards described here.
How long we keep it
Medical records are kept for as long as the law and the treating organisation require (in India commonly at least 3 years for outpatient records and longer for hospitals and children; in the United States as required by state law). Invoices are kept 8 years for tax law. Security and access logs are kept 3 years (never less than one year, as the DPDP Rules require). Website visit records are deleted after about 13 months, and enquiries that do not become a service after 3 years. When a purpose is over and no law needs the data, we erase it.
Security and breaches
Encryption in transit and for stored files, two-step sign-in, role-based access, a log of every access to a patient record, automatic sign-out and encrypted backups. No system is perfectly secure. If a personal data breach affects you, we will tell you without delay what happened, what it means for you and what to do; we report it to CERT-In within 6 hours and to the Data Protection Board of India within 72 hours, and for United States patients as HIPAA requires.
Your rights
You may get a summary and a copy of your personal data, correct, update or erase it, nominate a person to act for you if you die or cannot act (India), withdraw consent, and complain. Signed in, use My data & privacy (https://mydoctor.social/app/index.php?r=mydata): the copy downloads at once, and other requests get a reference and a date. We acknowledge within 48 hours and complete requests within 30 days. Patients of a clinic or hospital that uses MyDoctor software should usually ask that organisation first; we will help. In the United States, HIPAA rights over records held by your provider are described in that provider's Notice of Privacy Practices.
Children
Anyone under 18 is added by a parent or lawful guardian. Before we keep a child's details we check that the parent is an adult we can identify (a verified MyDoctor profile and a code sent to their email, or documents checked by our staff). Until then reminders for that child are paused. We never track children's behaviour or show them targeted advertising.
Electronic signatures
When you sign a document on MyDoctor we keep your name, title, email, IP address, the times, and your signature image if you add one, with the document, its fingerprint and an audit trail, to prove the signature. We keep them for the agreement's term plus 8 years, as contract and tax law require; a clinic's own signed documents follow its medical-record rules. With Aadhaar eSign, signing happens on a licensed eSign provider's page: MyDoctor never sees your Aadhaar number or the one-time code.
Checking a signed document
Every signed document has a verification code and QR code. Anyone holding the code can open MyDoctor's verify page and see the document title, the signer's name and organisation and the dates; it never shows patient details. A file uploaded there to check it is compared and not stored.
Payments
Payments are processed by Razorpay or made by bank transfer. Card, UPI and bank details go to Razorpay and your bank, not to MyDoctor. We keep the payment ID, amount, method, date and payer email, and Razorpay's settlement and chargeback records, for 8 years as tax law requires. Payments are final: MyDoctor does not refund.
After you ask us to erase your data
We erase your account and personal data within the time stated below. We keep only what the law requires us to keep (invoices, payment and tax records, signed contracts and the sealed security log) for the legal period, seen only by authorised MyDoctor staff. Before erasing, we may keep a de-identified copy of scores for research and statistics: numbers only, with a 10-year age band, sex, state and month, and no name, contact details, exact dates or anything else that could identify you.
Files you upload
When you upload a file, we record a fingerprint of it (SHA-256), its hidden data (for example the camera, the program that made it, and its dates), the time, your IP address and the type of device and browser you used. We use this to keep files safe, to check that documents are genuine and to investigate misuse. Photos and scans of CVs, ID and documents are turned into a smaller PDF and the original file is then deleted; the fingerprint and hidden data are kept with the PDF. Patient records such as reports, X-rays and scans are never reduced in quality: they are stored exactly as uploaded, compressed without loss and encrypted. Digitally signed documents are kept byte for byte. Location saved inside a photo is removed from every copy anyone else sees and is kept, encrypted, only for ID and verification files.
Your location
On ID and verification forms you may choose to share your device location to help us check your documents. It is optional: your phone or browser asks you first, and you can say no and still send your documents. We use it only for verification and fraud prevention, and only the verification and compliance teams can see it.
MyDoctor Viewer
PDFs you open from your own device in the MyDoctor Viewer stay on your device; they are not uploaded to us. When you open a MyDoctor document in the Viewer, we record that you opened it, and patient documents show your name and the time on every page.
Data Protection Officer
Dr. Ambed Mishra, Data Protection Officer (Founder, Group CEO and Chief Medical Officer), email: support [at] mydoctor.social. You may contact the Data Protection Officer about anything in this policy. If you are not satisfied with our answer you may complain to the Data Protection Board of India.
Grievances
The Grievance Officer, support [at] mydoctor.social. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. In India you may also approach the Data Protection Board of India.
Changes
We will post changes on this page and tell account holders about important changes.