Privacy policy

1. Who decides how data is used

For patient records that a clinic keeps in LazzyDr, the clinic (or doctor) is the Data Fiduciary: it decides why and how patient data is processed. Freaky Innovators Private Limited processes that data only on the clinic's instructions, as its Data Processor.

For the accounts of doctors, clinic owners and staff, and for visitors to this website, Freaky Innovators Private Limited is the Data Fiduciary.

2. What we collect

• Account data: name, mobile number, role, clinic name, address, GSTIN and registration number you enter.
• Patient data entered by a clinic: identity and contact details, family links, visit notes, vitals, prescriptions, reports, images, bills and consent records.
• Billing data: plan, invoices and payment status. Card and UPI details are handled by our payment partner (Razorpay); we do not store them.
• Technical data: device and browser type, IP address, and error logs used to keep the service secure and working.

3. Health data and confidentiality

Health information is sensitive. We design LazzyDr so that it is seen only by the people who need it:

• Each clinic's data is kept separate from every other clinic's data, enforced in the database, not only in the screens.
• Visits and patients marked confidential can be opened only by the treating doctor and the clinic owner. Other staff see a neutral title such as "Consultation".
• Files such as X-rays and reports are stored privately and open through short-lived links.
• Messages to confidential patients use neutral wording with no diagnosis, medicine names or sensitive speciality words.
• Completed consultation notes are locked so they cannot be changed later; corrections to prescriptions are recorded as new versions.
• We never sell personal or health data, and we do not use patient data for advertising.

4. Why we use data

• To provide the service the clinic signed up for: appointments, consultations, prescriptions, billing, reminders and reports.
• To sign you in securely with one-time passwords sent to your mobile.
• To send messages the clinic chooses to send (for example appointment reminders on WhatsApp), only to patients who agreed to receive them.
• To bill subscriptions and meet tax and legal obligations.
• To keep the service secure, prevent misuse and fix problems.

5. AI features

When a doctor or owner uses an AI feature (for example voice-to-notes or prescription suggestions), only the text or audio needed for that request is sent to our AI service providers for processing. Results come back as suggestions; nothing is saved to the record until a person accepts or edits it. AI features are off unless the clinic subscribes to them.

6. Consent and your rights

Under the DPDP Act you can, subject to the law:

• Ask for a summary of your personal data and how it is processed.
• Ask us to correct, complete, update or erase it.
• Withdraw consent at any time; this does not affect processing already done.
• Nominate someone to exercise your rights if you are unable to.
• Raise a grievance with us, and if unresolved, with the Data Protection Board of India.

7. If you are a patient

Your clinic controls your medical records. To see, correct or delete records, please contact your clinic first; we will help the clinic respond. You can also write to us at support@drpanda.com and we will pass your request to the clinic.

Clinics must keep medical records for the periods required by medical regulations, so some records cannot be erased immediately.

8. Children

Records of children are created by their clinic with the consent of a parent or lawful guardian. We do not knowingly allow children to create accounts, and we do not track or advertise to children.

9. Who we share data with

• Service providers who host, secure and run LazzyDr (cloud hosting, SMS / OTP, WhatsApp messaging set up by the clinic, payments, AI processing), under contracts that require confidentiality and security.
• Authorities, when the law requires it.
• A buyer or successor if Freaky Innovators Private Limited's business is transferred, with the same protections.

10. Security, breaches and retention

We use reasonable security safeguards, including encryption in transit, role-based access, per-clinic isolation and audit of sensitive actions. If a personal data breach occurs, we will inform the Data Protection Board of India and affected people as the DPDP Act requires, and help clinics do the same.

We keep account and billing data while your account is active and as long as tax law requires afterwards. Clinic records are kept while the clinic's subscription is active; after it ends the clinic can export its data, and we delete it within a reasonable period unless the law requires us to keep it.

11. Grievances and contact

For any privacy question, request or grievance, write to our Grievance Officer at support@drpanda.com. We aim to acknowledge within 72 hours and resolve within 30 days.

12. Changes to this policy

We will post any changes here with a new date, and tell clinic owners in the app about important changes.