Zodact("we") makes software for clinics and the Zodact app for patients and doctors. This policy explains what personal data we handle, why, and the rights you have under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000.
1. Who is responsible for your data
When you visit a clinic that uses Zodact, the clinic decides what it records about your visit, and Zodact processes that data on the clinic's behalf. For your Zodact app account, reminders and video consultations, Zodact decides how the data is used. Either way, you can contact us and we will help, or pass your request to the clinic.
2. What we collect
- Identity and contact: phone number, name, age or date of birth, gender, and family members registered on the same phone number. Email, if you give it.
- Visits and health: appointments, queue status, prescriptions (diagnosis, medicines, advice, follow-up date), records you upload, and notes made by your doctor or clinic.
- Video consultations: when the call started and ended, and who joined. Calls are not recorded unless you agree before the call.
- Assistant chats: the questions you type to Zoa, the assistant in the app, its answers, and any photo or PDF you attach to a chat.
- Payments: amount, status and reference. Card and UPI details go directly to Razorpay; we never see or store them.
- Device and usage: push notification token, device type, app version and technical logs used to keep the service working and secure.
- Doctors: medical registration number, identity and degree documents, used to verify them before they consult.
- Clinic staff: name, work email and role.
3. How we use it
- To register visits, run clinic queues and keep your records in one place.
- To create prescriptions and deliver them to you in the app, and by WhatsApp or SMS where enabled.
- To send appointment and medicine reminders.
- To run video consultations and follow-ups, and to process payments.
- To verify doctors, provide support, prevent fraud and meet legal obligations.
We do not sell personal data, and we do not use health data for advertising.
4. AI features
Some features use AI models: drafting a prescription for a doctor, the symptom checker, and translating prescription advice into Telugu. We send only the text the feature needs; for a translation, that is the diagnosis, advice and warning lines, not your name or phone number. A doctor approves every AI-drafted prescription before it reaches you. The English page of a prescription is always the official record.
Zoa, the assistant in the app.Zoa answers questions from patients and doctors. It works only after you allow it in the app, and you can withdraw that permission at any time in the app's privacy settings. When you ask a question, we send the AI provider:
- what you typed, and up to the last 12 messages of that chat;
- a photo or PDF you attach to the chat (for a PDF, the text in it);
- the records needed to answer, and only when your question is about them. For a patient: your appointments, prescriptions, payments, and the title, type and date of your uploaded records. For a doctor: your own schedule, the patients you have seen, prescriptions you wrote, records a patient shared with you, follow-ups and earnings.
Phone numbers, email addresses and home addresses are removed before anything is sent, and people are named by first name only. Zoa can read records but cannot change them: booking or cancelling still needs your own tap. A doctor can ask only about their own patients. Zoa gives general information and does not diagnose or prescribe. We keep a log that an answer was given, without its content. You can delete a chat at any time, which removes its messages and the files you attached in it.
5. Who we share it with
- The clinics and doctors you visit or book with.
- Pharmacists who scan your prescription's QR code. The check page shows the doctor, clinic, date, your first name and a masked phone number, and never shows your diagnosis or medicines.
- Service providers who run parts of Zodact for us under contract: Supabase (database and file storage), Railway (servers), Vercel (websites), Google Firebase (sign-in codes and notifications), Daily.co (video), Razorpay (payments), Google (Gemini API, for the AI features and Zoa), Microsoft (Azure OpenAI, which answers Zoa when Gemini is busy), and Meta WhatsApp and MSG91 (messages). Some of them process data outside India, as the DPDP Act permits.
- Government or courts, when the law requires it.
6. Children
A person under 18 uses Zodact through a parent or guardian, who registers them as a family member on their own phone number and gives consent on their behalf.
7. How long we keep it
We keep your data while your account is active. Clinical records are kept for at least 3 years from the visit, as Indian medical regulations require, and then deleted or anonymised. If a clinic stops using Zodact, we give the clinic a copy of its records on request and then delete them from our systems, except where the law requires us to keep them.
8. How we protect it
Data is encrypted in transit, and sensitive health details are encrypted at rest. Each clinic can see only its own patients, and staff accounts are limited to their role. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.
9. Your rights
- See the personal data we hold about you, and correct or update it.
- Ask us to delete it, where we are not required to keep it.
- Withdraw your consent. Some features may stop working, but earlier processing stays lawful.
- Nominate someone to exercise these rights if you die or cannot act.
- Complain to our Grievance Officer, and then to the Data Protection Board of India.
Write to privacy@zodact.com from your registered phone number or email. We reply within 30 days.
Deleting your Zodact account.In the Zodact app, open Profile, tap Delete Account, type "delete my account" and confirm. Without the app, write to privacy@zodact.com from your registered phone number or email and we will delete it for you. The account is deactivated at once and signed out on every device; sign in within 30 days to undo. After 30 days your profile, addresses and records are deleted. Visit history that doctors must keep by law is anonymised, not deleted.
10. Cookies
Our websites use only the cookies needed to sign in and run the site. We do not use advertising cookies.
11. Changes
We will post changes on this page and tell you in the app before a significant change takes effect.
12. Grievance Officer
Srinivasa Rao, Founder
Zodact, Amaravati, Andhra Pradesh, India
Email: privacy@zodact.com