Contents
1 Who We Are
Dr Dia Homecare Private Limited ("Dr. Dia", "we", "us", or "our") is a healthcare technology startup incorporated in India, registered at Hyderabad, Telangana — 500067. We operate the Dr. Dia Home digital platform ("Platform") for patient onboarding, home-based sample collection, care coordination, and workflow management for diabetes care at home.
Dr. Dia acts as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") — meaning we determine the purposes and means by which your personal data is processed.
2 Data We Collect
We collect only what is necessary to provide our services to you. The categories of data we collect are:
| Category | Examples | When Collected |
|---|---|---|
| Identity & Contact | Full name, phone number, email address, date of birth, gender | Registration & onboarding |
| Address & Location | Residential address, pin code, city; real-time location (phlebo tracking & address auto-fill) | Onboarding; booking home visits |
| Health & Medical Data | Vitals, glucose readings, diagnostic reports, prescriptions, care notes, treatment history, medication logs, teleconsultation records | Throughout care journey |
| Biometric Specimens | Blood, urine, or other samples collected by our phlebotomists for laboratory analysis | Home sample collection visits |
| Family Member Data | Name, age, relationship, health data of family members added to your account by you | When you add a family profile |
| Payment Information | Transaction records, order IDs, payment status. We do not store card or bank account details — these are handled by our payment processor (Razorpay) | At checkout |
| Device & Usage Data | Device type, OS version, push notification token, app session events, crash logs | Automatically, while using the app |
| Communications | Messages exchanged with care coordinators, doctors, or pharmacy staff through the in-app messaging system | When you send or receive messages |
We collect location data only when you grant permission. You can revoke location access at any time from your device settings; this may affect address auto-fill and home visit scheduling.
3 How We Use Your Data
We process your data for the following purposes, each grounded in your consent or our legitimate interest in delivering safe, effective care coordination:
- Patient onboarding & account management — registering you, verifying your identity, and managing your care profile
- Home sample collection — dispatching phlebotomists, tracking collection visits, and delivering results
- Care coordination — scheduling consultations, sending appointment reminders, managing follow-ups, and coordinating between you and your clinical partners
- Teleconsultation facilitation — enabling video and audio consultations with registered medical practitioners via the Platform
- Digital health records — storing and making available your lab reports, prescriptions, care notes, and visit history
- Medication management & reminders — tracking your medication schedule and sending reminders as configured by you or your care coordinator
- Payments & billing — processing payments, generating invoices, and managing refunds
- Safety & escalation — alerting you and your clinical partner if monitored health data indicates potential risk
- Platform improvement — anonymised analytics to improve app performance, care pathways, and user experience
- Legal & regulatory compliance — meeting obligations under the DPDP Act 2023, IT Act 2000, and applicable health regulations
4 Who We Share Data With
We share your data only as necessary to deliver our services, and only with parties bound by equivalent data protection obligations:
Empanelled Clinical Partners
Registered doctors, specialist clinics, hospitals, and diagnostic laboratories empanelled with Dr. Dia receive your relevant health data solely to provide clinical services to you. You are informed of which clinical partner receives your data at the time of booking. Sharing occurs only with your explicit consent.
Phlebotomists & Field Staff
Our trained phlebotomists receive your name, address, and appointment details to carry out home sample collections. They do not have access to your full health record.
Diagnostic Laboratories
Where samples must be routed to a specialist third-party laboratory (e.g., for tests not available at the primary partner lab), your sample identifiers and relevant test requisition details are shared. You will be informed of such routing.
Payment Processor
Payments are processed by Razorpay. We share your transaction details (order amount, order ID) with Razorpay for payment processing. Dr. Dia does not store your card or bank account details. Razorpay's privacy policy governs their data handling.
Technology Vendors
We use vetted third-party technology vendors for cloud infrastructure, push notifications (Firebase), video calls (Agora), and analytics. These vendors act as Data Processors on our behalf and are contractually prohibited from using your data for any purpose other than providing the contracted service.
Legal & Regulatory Authorities
We may disclose your data if required by applicable law, court order, or regulatory authority, or to protect the rights, safety, or property of Dr. Dia, our users, or the public.
5 Data Ownership
Home-generated health data
Health data generated through the Dr. Dia Platform — including vitals, glucose readings, adherence logs, and monitoring data collected during your care journey on our Platform — is owned by Dr Dia Homecare Private Limited and is used to facilitate your care and improve our services in anonymised form.
Clinical records
Clinical records generated by Empanelled Clinical Partners (prescriptions, diagnostic reports, consultation notes) remain the records of the respective clinical partner. Dr. Dia holds a perpetual, royalty-free licence to access such records for the sole purpose of facilitating your ongoing care coordination.
Documents you upload
Any documents, images, or files you upload to the Platform (e.g., existing lab reports, ID documents) remain your property. You grant Dr. Dia a limited licence to store and process them for the purposes described in this policy.
6 Your Rights
Under the DPDP Act 2023 and applicable Indian law, you have the following rights regarding your personal data:
Right to Access
Request a summary of the personal data we hold about you and how it is being used.
Right to Correction
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your account and associated personal data, subject to legal retention obligations.
Withdraw Consent
Withdraw consent for data processing at any time. Withdrawal may affect your ability to use some services.
Data Portability
Request a machine-readable export of your personal data held by Dr. Dia.
Nomination
Nominate a person to exercise your data rights on your behalf in the event of your death or incapacity (DPDP Act right).
Right to Grieve
Lodge a complaint with our Grievance Officer. Unresolved complaints may be escalated to the Data Protection Board of India.
Opt-out of Notifications
Manage your notification preferences (push, WhatsApp, SMS) from the app's Profile > Notifications settings.
To exercise any of the above rights, write to us at drdiahome@gmail.com with the subject line "Data Rights Request". We will acknowledge within 24 hours and respond within 30 days.
You may also request account deletion directly from within the Dr. Dia Home app via Profile → Delete My Account.
7 Data Retention
We retain your personal data for as long as your account is active and for a period thereafter as required by law or legitimate business need:
| Data Type | Retention Period |
|---|---|
| Account & identity data | Duration of account + 3 years after deletion |
| Health & clinical records | Minimum 7 years (as required by health regulations) from last service date |
| Financial / transaction records | 8 years from transaction date (as required by Indian tax law) |
| Consent records | Duration of account + 3 years |
| Anonymised analytics data | Indefinitely (non-identifiable) |
| Deleted account data | 30-day grace period, then anonymised or purged within 90 days |
After the applicable retention period, data is securely anonymised or deleted.
8 Security
We implement industry-standard technical and organisational measures to protect your personal and health data:
- Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
- Encryption at rest: Health and personal data stored in our databases is encrypted at rest.
- Access controls: Role-based access controls ensure that only authorised personnel access patient data, strictly limited to their function (e.g., a phlebotomist sees only their assigned appointments, not full patient records).
- Authentication: OTP-based verification for patient accounts; bcrypt-hashed passwords with complexity requirements for staff accounts.
- Audit logging: All access to sensitive records is logged with actor, timestamp, and action for accountability.
- Incident response: We maintain a data breach notification procedure. In the event of a breach affecting your data, we will notify you and the relevant regulatory authority within the timelines required by the DPDP Act.
9 Children's Privacy
The Platform is intended for individuals aged 18 and above. Minors may be registered as family members under a parent or legal guardian's account. The parent or guardian is responsible for providing valid, verifiable consent for the minor's data under the DPDP Act, 2023, and assumes full responsibility for the minor's use of the Platform.
We do not knowingly collect personal data directly from minors without parental or guardian consent. If you believe a minor's data has been collected without appropriate consent, please contact us immediately at drdiahome@gmail.com.
10 Third-Party Services
Our Platform uses the following third-party services. Each is governed by its own privacy policy:
| Service | Provider | Purpose |
|---|---|---|
| Payment processing | Razorpay | Secure payment gateway for bookings and subscriptions |
| Push notifications | Firebase (Google) | Sending appointment reminders and care alerts to your device |
| Video consultations | Agora | Real-time audio/video for teleconsultations |
| WhatsApp messaging | Interakt / Meta | Sending OTPs and care updates via WhatsApp |
| Analytics | PostHog | Anonymised app usage analytics to improve the Platform |
Dr. Dia does not control third-party services and is not responsible for their data practices. We recommend reviewing their respective privacy policies.
11 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal obligations. Material changes will be notified to you via the Platform or your registered contact details at least 7 days before they take effect.
Your continued use of the Platform after the effective date of any changes constitutes acceptance of the updated policy. The version number and effective date at the top of this page always reflects the current version.