Privacy Policy for RMedQ

Welcome to RMedQ (“we”, “our”, or “us”), a specialized outpatient department (OPD) queue intelligence and digital consultation pass service developed by Rashuv Technologies under the RashuvMed healthcare technology vertical. This Privacy Policy describes how personal data is collected, handled, stored, and protected when you interact with our web platform (rmedq.rashuv.com), mobile application, reception desks, and waiting hall displays.

1. Sovereign Legal Framework & Regulatory Roles

Our data practices strictly comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules):

• Data Fiduciary: The registered Clinic, Hospital, or Consulting Doctor is the Data Fiduciary who determines the clinical purpose and necessity for outpatient scheduling.
• Data Processor: Rashuv Technologies (RMedQ) acts strictly as the Data Processor, maintaining queue infrastructure and dispatching notifications solely on behalf and under the lawful instructions of the Clinic.

2. Information We Collect & Strict Purpose Minimization

We adhere to strict data minimization. We collect only what is strictly necessary to assign, estimate, and communicate an outpatient queue position:

• Patient Identifiers: Patient Full Name (used to call the patient at clinic doors), Age & Gender (for clinical queue routing such as pediatric or senior citizen assistance), and Assigned Unique Health Identifier (UHID) if maintained by the clinic.
• Contact Information: Patient Mobile Phone Number (used exclusively for one-time SMS verification and live token progression alerts).
• Queue Telemetry: Sequential Token Number (e.g. #A-15), assigned consultation room, counter check-in timestamp, and Estimated Time of Consultation (ETC).
• Clinic & Doctor Profile Data: Clinic trade name, doctor name, Medical Council Registration Number (MCI/NMC), clinic contact address, authorized email address, and subscription status.
• Device Registration & Push Tokens: Firebase Cloud Messaging (FCM) device push tokens used solely to transmit live queue alerts (e.g., “3 patients ahead of you”) to the Android mobile app.
• Email Dispatch Data: Where clinics or patients opt in for email notifications, transactional system emails (onboarding passes, PIN reset verifications, approval notices) are dispatched via our verified infrastructure ([email protected]).

3. Children's Data & Pediatric Queue Registrations

In accordance with Section 9 of the DPDP Act 2023, token bookings for pediatric patients (individuals under 18 years of age) may only be registered by a parent or legal guardian. By generating a token for a minor child, the parent/guardian explicitly consents to the temporary processing of the child's name and age solely for outpatient queue management.

4. Waiting Hall Public TV Display Privacy Hygiene

To preserve complete patient dignity and confidentiality in crowded outpatient waiting rooms:

• Public TV waiting screens display only the Token Number (e.g. “#A-15”), consultation room number, and optional first name where customary for clinic clarity.
• Mobile phone numbers, full residential addresses, consultation fees, and medical specialties are never broadcast on waiting hall displays or public speaker chimes.

5. Ephemeral Queue Lifecycle & Daily Auto-Archival

Outpatient operations operate on discrete daily cycles. Accordingly, RMedQ enforces an ephemeral data retention cycle:

• Active waiting tokens and queue positions expire automatically at the conclusion of each day's clinic session.
• Historical token passes are archived and cleared from the live look-up stream at midnight.
• Public token tracking links from expired passes show the consultation as concluded and cannot be used by third parties to monitor subsequent days.

6. Zero Sale or Commercial Profiling

We maintain an absolute, non-negotiable policy: We do not sell, rent, monetize, or trade patient personal information or contact numbers to advertisers, pharmaceutical companies, health insurance brokers, or data brokers. We never send unsolicited commercial marketing to patient phone numbers.

7. Multi-Tenant Cryptographic Isolation & Security

• Sovereign Data Residency in India: All production databases, authentication stores, and telemetry logs are hosted exclusively within Indian borders on Google Cloud Platform Asia-South1 datacenters (Mumbai and Delhi).
• Encryption Standards: Data in transit is protected with TLS 1.3 / HTTPS encryption, and data at rest is secured using AES-256 cloud encryption.
• Role-Based Access Control (RBAC): Clinic receptionists access only check-in queues for their facility; consulting doctors access only patients booked for their assigned consultation.

8. Patient Rights Under the DPDP Act 2023

Patients and users possess full statutory rights under Indian data protection law:

• Right to Access & Summary: You may request a summary of personal queue tokens processed under your registered phone number.
• Right to Correction & Erasure: You may request the deletion of your account and historical consultation tokens by contacting clinic reception or our privacy team.
• Right of Grievance Redressal: You may file privacy inquiries or redressal grievances directly with our designated officer below.

9. Data Protection & Grievance Redressal Officer

In compliance with the Information Technology Act, 2000 and the DPDP Act, 2023, the contact details of our appointed Grievance Redressal Officer are as follows: