Vaiqu (“we”, “us”, “our”) is a web-first clinic queue management platform that helps small clinics manage patient queues digitally. Clinics use Vaiqu to assign tokens, track queue positions, and, where WhatsApp is turned on, notify patients over WhatsApp, replacing the physical register and manual queue management.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it.

This policy applies to two groups of people:

• Clinic users: doctors, assistants, and receptionists who register and use the Vaiqu dashboard.
• Patients: individuals who book a queue slot at a clinic through Vaiqu’s web page, and who may optionally receive updates over WhatsApp.

By registering a clinic on Vaiqu or using the dashboard, you (“the clinic”) agree to this policy and confirm that you have appropriate authority to accept it on behalf of your clinic.

Vaiqu is currently operated by its founding team, based in India, ahead of formal incorporation of a registered legal entity.

For any privacy-related questions, requests, or concerns:

• Email: support@vaiqu.in
• WhatsApp: +91 70123 01998

We aim to respond to all privacy-related queries within 5 business days.

3.1 Data collected from clinic users (doctors, assistants)

When a clinic registers or uses the dashboard, we collect:

We do not collect payment card details directly. Payment is handled by a third-party payment processor (see Section 7).

3.2 Data collected from patients when booking a visit

When a patient books a visit on a clinic’s Vaiqu web page, we collect:

If a clinic has WhatsApp enabled, the phone number above is also used to send queue and visit updates over WhatsApp, and if a patient opens a chat with the clinic’s WhatsApp number, the phone number linked to that chat is recorded to verify it and deliver those updates. WhatsApp is never required to book or track a visit.

We do not collect or store:

• Payment or insurance information from patients
• Location data, device identifiers, or browsing data from patients
• Any data from patients under 18 without it being provided by the patient themselves during the booking flow

3.3 Clinical documentation recorded by the doctor

When a doctor documents a consultation using Vaiqu’s Visit Documentation feature, the following is recorded against that patient’s visit:

This is entered directly by the doctor, not collected from the patient via WhatsApp. It is used to generate the visit’s digital prescription, which the patient can access via the clinic’s web page. Once the patient has explicitly opted in and verified their WhatsApp number, they can also receive it directly as a document over WhatsApp (see Section 7 for what this means for data shared with Meta). A doctor’s private working notes (marked as such in the product) are excluded and never leave the clinic’s own dashboard.

3.4 Data we collect automatically

When clinic users access the dashboard, we automatically collect limited technical data for security and error monitoring purposes:

• Browser type and operating system
• IP address (not linked to patient records)
• Error events and stack traces (scrubbed of patient-identifying information before transmission, see Section 7)

4.1 To operate the queue management service

• Assigning token numbers to patients
• Sending queue status updates, “get ready” alerts, and “your turn” notifications to patients via WhatsApp
• Computing estimated wait times based on average consultation duration
• Displaying the live queue to clinic staff on the dashboard
• Preventing duplicate bookings by the same patient within a session

4.2 To maintain and improve the platform

• Diagnosing errors and fixing bugs using anonymised error reports
• Monitoring system health and uptime

4.3 To communicate with clinic users

• Sending account-related emails (password reset, email confirmation)
• Communicating service updates, changes to this policy, or billing matters

4.4 We do not use your data for:

• Selling or renting personal data to any third party
• Advertising or marketing to patients
• Profiling patients for commercial purposes
• Sharing data across clinics (each clinic’s data is strictly isolated)

Vaiqu operates under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

For clinic users: Processing is based on the contract formed when the clinic registers on Vaiqu. We process clinic user data to perform the service they signed up for.

For patients: Processing is based on the patient’s consent, given when they submit the booking form on the clinic’s Vaiqu web page. The booking form makes it clear that their name, age, gender, and chief complaint are being collected to assign them a queue slot.

Role clarification under the DPDP Act:

• The clinic is the Data Fiduciary: they determine why patient data is collected (to manage their queue).
• Vaiqu is the Data Processor: we process patient data on behalf of the clinic, under the clinic’s instruction, solely to provide the queue management service.

Clinics using Vaiqu are responsible for ensuring they have appropriate grounds to collect and process their patients’ personal data, and for informing patients that a digital queue management system is in use.

Clinics may request deletion of all their clinic’s data at any time by contacting us at the address in Section 2. We will process such requests within 30 days.

We use the following third-party services to operate Vaiqu. Data is shared with them only to the extent necessary to provide the service.

We do not sell, rent, or trade personal data with any other third party. We do not use patient data for advertising.

All third-party providers are bound by their own privacy policies and data processing agreements. We select providers who maintain appropriate security standards.

We take the following measures to protect personal data:

• Clinic isolation: Each clinic’s data is strictly separated at the database level using Row Level Security (RLS). One clinic cannot access another clinic’s patient data.
• Authentication: Dashboard access requires email and password authentication via Supabase Auth. Sessions are protected and expire after a period of inactivity (30 minutes for assistants, 60 minutes for doctors).
• Encryption in transit: All data transmitted between your browser, our servers, and third-party services is encrypted using TLS.
• Encryption at rest: Data stored in Supabase is encrypted at rest by the provider.
• PII scrubbing: Before any error event is sent to our error monitoring service (Sentry), patient phone numbers, names, ages, genders, and chief complaints are automatically redacted from the event payload.
• Access control: Only authenticated clinic staff with a verified membership in that clinic can access or modify that clinic’s queue data.

No system is perfectly secure. In the event of a data breach that poses a risk to individuals, we will notify affected parties and relevant authorities in accordance with the DPDP Act.

Patients whose data is held by Vaiqu (via their clinic’s use of the platform) have the following rights:

Right to know: You can ask the clinic what data Vaiqu holds about you. The clinic is the data fiduciary and is your primary point of contact for this.

Right to correction: If your name, phone number, or other details are incorrect, you or the clinic can correct them.

Right to erasure: You can request deletion of your data by contacting the clinic directly. The clinic can delete your records from their Vaiqu account, or contact us to do so on their behalf.

Right to withdraw consent: If you no longer wish to use Vaiqu, you can simply stop booking through the clinic’s web page. If you only want to stop WhatsApp updates, reply STOP to any message from the clinic’s WhatsApp number. Your existing data will be retained for the period described in Section 6 and then deleted.

Right to grievance redressal: If you believe your data has been handled incorrectly, you may contact us at the address in Section 2. You also have the right to file a complaint with India’s Data Protection Board once it is constituted under the DPDP Act.

By using Vaiqu, the clinic agrees to:

• Inform patients that a digital queue management system is in use and that their name, phone number, and basic health information (age, gender, chief complaint) will be collected to manage the queue.
• Not use Vaiqu to collect data beyond what is required for queue management.
• Not attempt to export, copy, or misuse patient data collected through Vaiqu for purposes outside the scope of queue management.
• Ensure that any staff member given dashboard access (assistant or doctor role) is authorised by the clinic to handle patient queue data.
• Contact Vaiqu promptly if they become aware of any unauthorised access to their dashboard account.

Vaiqu does not knowingly collect data about patients under the age of 18 through a separate mechanism. When a parent or guardian books a queue slot on behalf of a child, the data entered (name, age, gender, chief complaint) belongs to the child. Such data is handled with the same protections as adult patient data and is not used for any purpose beyond queue management.

Clinic users (dashboard accounts) must be at least 18 years of age.

We may update this policy from time to time. When we do:

• The “Last updated” date at the top of this document will change.
• If the changes are material (e.g. new types of data collected, new third parties, changes to retention periods), we will notify active clinic accounts by email before the changes take effect.
• Continued use of Vaiqu after the effective date of an updated policy constitutes acceptance of the revised policy.

By registering a clinic on Vaiqu and using the dashboard, you confirm that:

1. You have read and understood this Privacy Policy.
2. You accept the terms of this policy on behalf of yourself and your clinic.
3. You have the authority to bind your clinic to these terms.
4. You will inform your clinic staff and, where required, your patients, about the use of Vaiqu and the data it processes.