Privacy information

Information you share

Account registration collects contact and login details. Treatment requests, medical reports, support messages and travel information are used to coordinate your case. Doctor applications collect professional credentials for review. Share only information needed for your request.

Contributor proposals

Contributor proposals collect your name, professional email, role, qualifications, organization, professional profile, proposed topic, summary and reference or draft links. Doctatoc uses these details to verify expertise, review the proposal and respond to you. A proposal remains in the private editorial queue unless an article is separately approved for publication.

Private care coordination

Website account sessions use HTTP-only cookies. Medical documents are stored through a cloud document service and accessed through authorized portal requests. Access to medical documents is logged with the authenticated account, time, IP address and approximate network location. Records are displayed in an authorized viewer without download controls. Authorized viewers can still capture what they see. Use the patient portal to share reports and discuss your personal case with the care team.

Security access and language

We record website page visits and authorized document views, including the IP address, approximate country/region/city, time and account identity when signed in. IP lookup takes place locally; it is not precise GPS location. These records are accessible only to the super admin for security and access investigation. When public website translation is enabled, public page text is processed by Google Cloud Translation. Private dashboards, patient records, messages and form entries are excluded. Your browser language and approximate country suggest a language; you can choose another or return to English.

Website assistant

The public website assistant answers questions about Doctatoc information. When AI is enabled, your question and selected public website facts are sent to OpenAI to match the question with relevant information. The assistant does not receive your portal records or private messages. Do not enter medical reports, passwords, passport details or other sensitive information. The conversation is kept in this page memory and can be cleared; reloading the page clears it. OpenAI's data processing policies also apply.

Service providers and messages

Hosting, database, document-storage and configured communication providers support delivery of the service. Account-recovery, email-verification and case-support messages may use the email address or phone number linked to your account when those delivery channels are configured.

Mobile app and account controls

The Doctatoc mobile app uses protected operating-system credential storage for native sign-in sessions rather than website cookies. Browser-preview sessions and unsent consultation/message drafts stay in memory. Private report files use encrypted private storage on the hosting service and authenticated access. Older records may remain with the previous Cloudinary provider; public doctor photos can use Cloudinary. Selected reports, messages, consent records and appointment details support your care coordination. The current mobile app has no advertising or analytics integration and does not request camera, microphone, contacts or precise-location access. Zoom opens separately and may request its own permissions.

A patient account deletion request signs you out, invalidates existing sessions and withdraws future consultation sharing. Your account and linked care records remain recoverable for 30 days. Completing a verified sign-in before the deadline cancels deletion and restores your access. Requesting a code or resetting a password alone does not cancel deletion. Previously withdrawn sharing stays withdrawn. A later deletion request starts a new 30-day period from that request. After the deadline, recovery is closed and automatic removal of the account and linked records begins. See the account and data deletion page.

Optional Google sign-in

You can choose Google to sign in or create an account. Google verifies your identity and provides an account identifier, name and email address; Doctatoc does not receive your Google password or request access to Gmail, Drive or your medical records. Linking an existing Doctatoc account requires an email code the first time. Google sign-in does not bypass doctor credential review or record-access permissions. Email sign-in remains available separately.

Optional Google Analytics

Optional website analytics loads only after you allow it. If you allow website analytics, Google may receive usage information such as the page visited, device and browser details, approximate location derived from the network address, and identifiers created by the analytics service. With analytics permission, we measure generic sign-in attempts, successful sign-ins, account creation and request completion. These events contain no contact details, form answers, medical information or account identifiers; private page URLs are replaced with the website homepage. Private dashboard activity, report uploads and contributor submissions are excluded. Necessary account cookies work separately from this choice. You can withdraw your analytics choice here at any time.

When enabled, Cloudflare Turnstile checks public sign-in, registration, password-recovery and enquiry submissions for automated abuse. The check loads when you submit one of these forms. Cloudflare may process your network address, browser/device information and security signals. Our verification request sends the challenge token, not your form answers or medical records. This security check is separate from optional analytics. Cloudflare’s Privacy Policy and Terms of Service apply.

If Cloudflare website protection is enabled, Cloudflare acts as a delivery and security intermediary for traffic routed through it and may process request content, connection information and security logs to provide those services. We do not intentionally cache private patient records in a public content-delivery cache.

Questions, corrections and deletion requests

Privacy contact: info@doctatoc.com. Describe the request without attaching medical records, passwords or full identity numbers to public messages.

Signed-in patients can use Care profile & privacy requests for access, correction, erasure, grievances and nomination requests. Each account covers one care recipient. For child care, we first request only the adult account holder’s birth date and relationship declaration, alongside their existing account details, to arrange reliable identity and age verification. After approval, the verified adult records separate consent before the child’s name or birth date can be entered. A further review confirms authority for that child before medical features open. A declaration alone does not complete verification. Guardian consent can be withdrawn from the same controls; required evidence or records may remain preserved pending applicable retention review.

Call the Doctatoc team on +91 8956502267 or use your private support messages to ask about your information, request a correction or discuss deletion. You can also email our privacy contact at info@doctatoc.com.

Start with your account email and the type of request; do not send passwords, OTPs or medical reports through public channels. We must verify account ownership before changing or disclosing personal information. The 30-day patient recovery period applies to the account and linked records in Doctatoc's active systems, including linked medical reports and messages. Required security evidence is held separately with restricted access; legal holds and unresolved rights requests can delay erasure. Removal runs automatically after the deadline; service or storage failures require retry and may delay completion, but do not reopen recovery. Copies already held by hospitals, email recipients or external providers are governed by their own practices. Backup copies require a separate backup-retention and restoration process; do not assume they are erased by the active-system deletion job. Contact us about records not linked to your account, professional accounts or backup-related questions.

For the steps available now, including requests without signing in, see the account and data deletion instructions.

Optional Zoom consultations

When video consultations are enabled, booking records include the assigned doctor, patient account, appointment time, consent version and joining agreement. A Doctatoc coordinator hosts the call. Zoom processes the audio, video and connection information needed to provide its service under its privacy statement. A Doctatoc coordinator manually creates the meeting in the company Zoom account using an appointment reference and schedule; medical reports and contact details should not be included in the meeting invitation. Participants may see the display name you choose in Zoom. Doctatoc requests recording to be off; participants must not record or take screenshots without explicit consent and authorization. Appointment emails direct you to the signed-in dashboard. Joining agreement and access events are recorded for review.