Vaiqu (“we”, “us”, “our”) is a web-based clinic operations platform for outpatient clinics in India. Clinics use Vaiqu to publish a clinic page, accept bookings, run the patient queue, record consultations and issue prescriptions. Where a clinic turns it on, Vaiqu can also send patients updates over WhatsApp. WhatsApp is optional and is never required to book, track or attend a visit.

This Privacy Policy explains what personal data we process, why we process it, how long we keep it, who we share it with, and the rights available to you.

This policy applies to three groups of people:

• Clinic users: clinic owners, doctors, assistants and other staff who hold a Vaiqu account.
• Patients: individuals who book or attend a visit at a clinic that uses Vaiqu, whether they book through the clinic’s web page or are registered by clinic staff.
• People who contact us about Vaiqu: anyone who asks us, through our website, to get in touch about using Vaiqu at their clinic.

Our role differs between these groups. Section 5 explains when we act on a clinic’s instructions and when we decide ourselves how data is used.

Vaiqu is currently operated by its founding team, based in India, ahead of the incorporation of a registered legal entity.

For any privacy question, request or complaint, including a grievance under the Digital Personal Data Protection Act, 2023:

• Email: support@vaiqu.in
• WhatsApp: +91 70123 01998

We aim to acknowledge every privacy request within 5 business days and to resolve it within the period required by applicable law.

3.1 Data about clinic users

When a clinic registers or its staff use Vaiqu, we collect:

Verification documents are visible only to Vaiqu’s verification team. They are never shown to the clinic, including the clinic owner. We do not currently collect payment information.

3.2 Data about patients

When a patient books a visit on a clinic’s Vaiqu page, or clinic staff register a visit on the patient’s behalf, we collect:

If a clinic has enabled WhatsApp and a patient opens a chat with the clinic’s WhatsApp number, we record the number used for that chat in order to confirm it and deliver updates to it.

We do not collect:

• Payment or insurance information from patients
• Location data, device identifiers or browsing history from patients

3.3 Clinical records created by the doctor

When a doctor records a consultation in Vaiqu, the following is stored against that patient’s visit:

This information is entered by the doctor, not collected from the patient. It forms part of the clinic’s medical record of the visit. Once the doctor finalises it, the patient can view and download the prescription from their visit page. Where the clinic has enabled WhatsApp and the patient has confirmed their WhatsApp number, the prescription may also be sent to them as a document over WhatsApp (see Section 7). A doctor’s private working notes, marked as such in the product, are never included in any document given to a patient or printed.

3.4 Data collected automatically

When anyone uses Vaiqu, we automatically collect limited technical data for security and error monitoring:

• Browser type and operating system
• IP address, which is not linked to patient records
• Error reports, from which patient-identifying information is removed before they are sent to our error monitoring provider (see Section 7)

3.5 Data about people who contact us about Vaiqu

When you ask us to get in touch about using Vaiqu at your clinic, we collect what you send us:

We use these details only to talk to you about Vaiqu. If you tell us you are not interested, we stop contacting you.

4.1 To provide the service

• Accepting bookings and assigning token numbers
• Showing patients their place in the queue and an estimated wait time
• Showing the live queue to clinic staff
• Recording consultations and issuing prescriptions on the doctor’s instruction
• Sending visit updates over WhatsApp, only where the clinic has enabled WhatsApp
• Preventing duplicate bookings for the same patient

4.2 To verify doctors and publish clinic pages

• Checking a doctor’s registration against the relevant medical register before the doctor is shown on a public clinic page
• Publishing the clinic’s page, including the names, specialisations, photos and schedules of its verified doctors, so that patients can find and book the clinic

4.3 To maintain and improve the platform

• Diagnosing errors and fixing faults
• Monitoring system health and availability
• Improving the medicine suggestions shown to a doctor, based on that doctor’s own prescribing

4.4 To communicate with clinic users

• Sending account messages such as invitations, email address confirmation and password resets
• Telling clinics about service changes and changes to this policy

4.5 We do not use personal data for:

• Selling or renting personal data to anyone
• Advertising or marketing to patients
• Profiling patients for commercial purposes
• Sharing one clinic’s patient data with another clinic. Each clinic’s data is kept separate

We process personal data in accordance with India’s Digital Personal Data Protection Act, 2023 and the rules made under it (together, the “DPDP Act”).

5.1 Patient data and clinical records

For patient data and clinical records, the clinic is the Data Fiduciary. The clinic decides why and how that data is processed, and is responsible for its medical records. Vaiqu is the clinic’s Data Processor. We process this data only on the clinic’s behalf, on its instructions, and to provide the service.

Patient data is processed on the basis of the patient’s consent, given when they submit the booking form on the clinic’s page. Where clinic staff register a visit on a patient’s behalf, the clinic is responsible for informing the patient and obtaining any consent the law requires.

5.2 Clinic user data and published clinic pages

For clinic user accounts, doctor verification data and the information shown on public clinic pages, Vaiqu is the Data Fiduciary. We process this data to perform our agreement with the clinic, to keep the platform secure, and to make sure that only verified doctors are presented to the public.

For the details people send us when they ask us to get in touch about Vaiqu, Vaiqu is also the Data Fiduciary. We use them for the purpose they were given for, and stop when asked.

5.3 Transfers outside India

Our main database is hosted in India. Some of our service providers process limited data outside India, as listed in Section 7. Any such transfer is made only as permitted under the DPDP Act.

6.1 Medical records

Doctors in India are required by law to keep patients’ medical records for a minimum period. Under the regulations of the National Medical Commission, this is currently three years from the date of the patient’s last contact, and other laws may require longer. Because Vaiqu holds these records on the clinic’s behalf, we do not delete a patient’s visit records, clinical records or prescriptions on a fixed schedule of our own. We keep them for as long as the clinic uses Vaiqu, and delete them only on the clinic’s instruction or when the clinic closes its account, as described in Section 6.3.

6.2 Other data

6.3 When a clinic stops using Vaiqu

A clinic may close its account or ask us to delete its data at any time by contacting us at the address in Section 2. When it does:

1. We take the clinic’s page offline and stop accepting bookings.
2. On request, we provide the clinic with a copy of its patient, visit and prescription records, so that it can meet its own legal obligation to keep them.
3. We then delete the clinic’s data, or return it to the clinic, as the clinic instructs. We may keep data for longer only where the law requires us to.

The clinic remains responsible for keeping its medical records for the period the law requires. We may ask the clinic to confirm in writing that it has kept a copy before we delete them.

We use the following service providers to operate Vaiqu. Each receives only the data it needs to perform its service for us.

We do not sell, rent or trade personal data. We may disclose personal data where required by law, by a court order, or by a government authority acting within its legal powers.

We use reasonable security safeguards to protect personal data, including:

• Clinic separation: each clinic’s data is separated at the database level. One clinic cannot access another clinic’s patient data.
• Access control: only signed-in staff who belong to a clinic can access that clinic’s data, and each role sees only what it needs.
• Automatic sign-out: staff sessions end after a period of inactivity (30 minutes for assistants, 60 minutes for doctors).
• Protected patient documents: a patient’s visit documents can be opened only with details that the patient holds.
• Verification documents: stored privately, available only to Vaiqu’s verification team, and every access is logged.
• Encryption: data is encrypted in transit using TLS and encrypted at rest by our database provider.
• Removal from error reports: patient names, phone numbers, ages, genders and health information are removed from error reports before they leave our systems.

No system is completely secure. If a personal data breach occurs, we will notify the affected clinics, the Data Protection Board of India and, where required, affected individuals, in the manner and within the time required by the DPDP Act.

9.1 Patients

The clinic is responsible for your data and is your first point of contact. You may ask the clinic to:

• Access: tell you what personal data it holds about you in Vaiqu.
• Correction: correct your name, phone number or other details. For your protection, only clinic staff can change the phone number on a visit.
• Erasure: delete your personal data. Your medical records may need to be kept for the period the law requires (see Section 6.1), and the clinic will tell you if that applies.
• Withdraw consent: you may stop using Vaiqu at any time. To stop WhatsApp updates only, reply STOP to any message from the clinic’s WhatsApp number. Withdrawing consent does not affect processing that took place before it, or records the clinic must keep by law.
• Nominate: name another person to exercise these rights on your behalf in the event of your death or incapacity.

We will help the clinic respond to your request. If you contact us directly, we will pass your request to the clinic and assist it.

9.2 Clinic users

You may ask us for access to, correction of or erasure of your own account data, or nominate another person to exercise these rights on your behalf, by contacting us at the address in Section 2.

9.3 Grievances

If you believe your personal data has been handled incorrectly, please contact the clinic, or us at the address in Section 2. If your grievance is not resolved, you may complain to the Data Protection Board of India in accordance with the DPDP Act.

By using Vaiqu, the clinic agrees to:

• Inform patients that Vaiqu is used to manage their visits, and obtain any consent the law requires, including for patients the clinic registers on their behalf.
• Collect and use patient data only for providing care and running the clinic.
• Keep its patients’ medical records for the period the law requires, including by obtaining a copy before closing its Vaiqu account.
• Respond to patients’ requests to exercise their rights.
• Give Vaiqu access only to staff it has authorised to handle patient data, and remove access promptly when someone leaves.
• Tell Vaiqu promptly about any suspected unauthorised access to its account.

Clinics treat children, and a parent or guardian may book a visit on a child’s behalf. A child’s data is processed only to provide health services at the clinic. It is not used for tracking, behavioural monitoring or advertising, and it is protected in the same way as all other patient data.

Clinic users must be at least 18 years of age.

We may update this policy from time to time. When we do:

• The “Last updated” date at the top of this policy will change.
• If a change is material, such as a new type of data, a new service provider or a change to how long data is kept, we will notify clinic users by email before it takes effect.
• Where the law requires fresh consent for a change, we will ask for it rather than rely on continued use.

By registering a clinic on Vaiqu and using the dashboard, you confirm that:

1. You have read and understood this Privacy Policy.
2. You accept it on behalf of yourself and your clinic, and you have the authority to do so.
3. You will inform your clinic staff and your patients about the use of Vaiqu and the data it processes, as described in Section 10.