DocKit Care Logo

DocKit Care

Privacy Policy

Your Privacy Matters to Us

At DocKit Care, we are committed to protecting the privacy of healthcare providers, their staff, and their patients. This policy outlines how we handle B2B data securely.

Last updated: October 17, 2026

Table of Contents

1. Information We Collect

As a Hospital Management Software (SaaS) provider, DocKit Care collects information necessary to provide services to our hospital clients (B2B).

Account & Hospital Information

  • Hospital name, registration details, and administrative contact information.
  • Admin names, emails, and phone numbers.
  • Billing and subscription payment information.

Patient Data (Processed on Behalf of Hospitals)

  • Medical records, appointments, prescriptions, and billing info entered by the hospital staff.
  • We act solely as a data processor for patient information. The hospital remains the data controller.

2. How We Use Your Information

  • To provision and manage your SaaS workspace and multi-tenant environment.
  • To process subscription billing and issue invoices.
  • To provide technical support, maintenance, and platform updates.
  • To monitor infrastructure performance and prevent fraud.
  • We never use patient health data for marketing or analytics purposes.

3. How We Share Your Information

We strictly limit data sharing. We only share information with:

  • Cloud Infrastructure Partners: E.g., AWS, for secure hosting of the SaaS platform.
  • Payment Gateways: To process your SaaS subscription payments securely.
  • Legal Requirements: When compelled by law, regulation, or legal process.

4. Data Security

Security is our top priority. We implement enterprise-grade protections for all healthcare data.

  • AES-256 encryption for data at rest and TLS for data in transit.
  • Strict role-based access control (RBAC) and data isolation between hospital tenants.
  • Append-only audit logging of access to clinical records.
  • Automated daily backups, with all data stored on servers located in India.
  • Data processing agreements available for clinics and hospitals that require one.

5. Data Retention

  • Hospital account data is retained as long as the subscription is active.
  • If a subscription is canceled, patient data can be exported by the hospital. All data is then securely permanently deleted within 90 days.

6. Compliance with Indian Law

DocKit Care is operated from India and is built to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and rules made under it.

  • Data residency: all patient and clinical data is stored on servers located in India. We do not transfer health data outside India.
  • Role under the DPDP Act: the hospital or clinic is the Data Fiduciary for patient data; DocKit Care acts as a Data Processor on its documented instructions.
  • Consent: personal data is processed for the stated purpose only, and consent can be withdrawn at any time.
  • Payments: card, UPI and net-banking details are handled entirely by RBI-authorised, PCI-DSS compliant payment gateways. DocKit Care never stores full card numbers, CVV or UPI credentials on its servers.
  • ABDM / ABHA: handling of ABHA identifiers is described separately in our ABDM & ABHA Data Policy.

7. Your Rights

  • Access the personal data we hold about you and ask how it is processed.
  • Ask for correction of inaccurate or incomplete data.
  • Ask for erasure, subject to medical record retention rules that require a clinic to keep treatment records.
  • Withdraw consent for processing that is based on consent.
  • Nominate another person to exercise these rights on your behalf.
  • Raise a grievance and receive a response within 15 days.

8. Contact & Grievance Officer

For questions about this policy, to exercise any right listed above, or to execute a data processing agreement, contact us. Grievances are acknowledged within 48 hours and resolved within 15 days.