Privacy Policy

1. About Us and Scope

Queue Token Patient App is operated by Codetown Technologies & Bliss Technologies (“Company”, “we”, “us”, “our”). The Patient App is a free mobile application that allows patients to find registered clinics, book appointments, receive real-time queue tokens, and track estimated visit times. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Patient App.

This Policy complies with the IT Act, 2000; SPDI Rules, 2011; the DPDP Act, 2023; and the DPDP Rules, 2025.

2. Personal Data We Collect

2.1 Registration Data

Full name
Mobile number (used for OTP-based authentication — primary identifier)
Email address (optional)
Full address, city, state, and country

2.2 Appointment and Health Data

Appointment booking details: chosen doctor, clinic, date, and time slot
Appointment type: new consultation or free follow-up
Medical symptoms and problem description voluntarily submitted by you during booking
Appointment history (past and upcoming)
Token number and estimated appointment time per booking
Cancellation and rescheduling history

2.3 Payment and Transaction Data

Payment method preference selected (cash or online, as configured by the Doctor User)
Consultation fee amount (set by the Doctor User, displayed to you for information only)

Note: The Company does not collect, process, hold, or store any payment card data, UPI credentials, or bank details from Patient Users. Payments are made directly between you and the Doctor User.

2.4 Location Data

Approximate location derived from your IP address
Precise GPS location — only if you grant permission — used solely to display clinic directions via map integration

You can revoke location permission at any time through your device settings.

2.5 Technical and Device Data

Device type, operating system, and device identifier
App version, usage logs, and crash reports
IP address and session timestamps

SENSITIVE HEALTH DATA: The medical symptoms or problem description you submit during appointment booking is sensitive personal data under applicable Indian law. We treat this information with the highest protection. It is shared only with the specific Doctor User with whom you book an appointment. We do not use it for marketing, research, insurance, or any commercial purpose under any circumstances.

3. Legal Basis for Processing

Consent: By registering and using the Patient App, you provide express, informed consent to the processing described herein.
Contractual Necessity: Processing is necessary to provide appointment booking, queue token assignment, and location services.
Legal Obligation: Compliance with IT Act, DPDP Act, and applicable law.
Legitimate Interests: Platform security, fraud prevention, and service improvement using only anonymised data.

4. How We Use Your Data

To create and maintain your Patient User account
To enable you to find and book appointments with registered Doctor Users
To assign your real-time queue token number and communicate estimated appointment time
To share your name, phone number, appointment details, and health description with the specific Doctor User you book with — for the sole purpose of that consultation
To send push notifications about booking confirmations, token updates, reminders, and cancellations
To display your clinic's location and enable navigation
To maintain your appointment history
To provide customer support
To detect and prevent fraud and abuse
To comply with legal obligations
To improve the Patient App using only anonymised, aggregated data

YOUR HEALTH DATA IS NOT FOR SALE. We will never sell, rent, or share your medical information with insurance companies, pharmaceutical companies, advertisers, data brokers, or any third party for commercial purposes.

When you book an appointment, your name, mobile number, appointment details, and voluntarily submitted health description are shared with the specific Doctor User you are booking with. This sharing is limited to the consultation context only. The Doctor User receives this data as an independent data controller and is bound by medical ethics and patient confidentiality obligations under Indian law.

We do NOT share your health data with any other Doctor User, clinic, hospital, or healthcare provider.

We use cloud hosting, OTP gateway, notification, and map integration service providers who process data strictly on our instructions and under confidentiality obligations.

We may disclose your data to law enforcement or courts when required by applicable Indian law, including the IT Act.

6. Data Retention

Account and profile data: Retained during your active account and for 2 years after the last appointment or account deletion, whichever is later.
Appointment history and health descriptions: Retained for 2 years from the date of the appointment to support follow-up care tracking.
Technical logs: Retained for 90 days.

You may request deletion of your account at any time. Deletion is subject to minimum legal retention periods. After deletion, your data will not be accessible within the app, though it may be retained in encrypted backup storage for up to 90 days before permanent deletion.

7. Security

TLS/SSL encryption for all data in transit
Encryption of sensitive health data at rest
OTP two-factor authentication
Access controls — health data accessible only to authorised personnel and the specific booking Doctor User
Breach notification within 72 hours of discovery, in accordance with the DPDP Act

You are responsible for keeping your device and login credentials secure. Do not share your OTP with anyone. The Company will never call or message you asking for your OTP.

8. App Permissions

Camera:Required to scan the clinic's QR code for booking (you control when to use this)
Location:Optional — used only to display map directions to the clinic if you choose
Notifications: Required to receive appointment confirmations, token updates, and reminders

You may revoke any permission through your device settings at any time.

9. Children's Privacy

The Patient App is not directed at children under 18 without verifiable parental/guardian consent. A parent or guardian may create an account and book on behalf of a minor patient. If you believe a minor has registered without consent, contact us at queuetoken@gmail.com and we will delete such data promptly.

10. Your Rights

Access: Request a copy of your personal data we hold
Correction: Request correction of inaccurate data
Erasure: Request deletion of your account and data, subject to retention requirements
Withdrawal of Consent: Withdraw consent at any time (affects Service availability)
Grievance Redressal: Complaints addressed within 30 days
Nomination: Nominate another to exercise your rights under the DPDP Act

Exercise any right by contacting: queuetoken@gmail.com

11. Changes to This Policy

Material changes will be notified via in-app notification at least 15 days before taking effect. Continued use after the effective date constitutes acceptance.

12. Grievance Officer

Company:Codetown Technologies & Bliss Technologies
Email: queuetoken@gmail.com
Phone: +91 95096 47637
Response Time: Acknowledgement within 24 hours; resolution within 30 days
Jurisdiction: Udaipur, Rajasthan India

13. Governing Law

This Policy is governed by the laws of India. Disputes subject to courts at Udaipur, Rajasthan.