Privacy Policy

1. Introduction

Prescribe AI ("we", "our", "us") is an AI-powered prescription documentation tool designed for licensed medical practitioners in India, operated by NILSA Enterprises, a sole proprietorship based in New Delhi, India. This Privacy Policy explains how we collect, use, store, and protect information when you use our mobile application and related services (collectively, the "Service").

2. Information We Collect

2.1 Doctor Information (Account Holder)

• Registration data: Name, email address, phone number, medical registration number, clinic/hospital name and address
• Professional credentials: Qualification, specialisation, years of experience
• Uploaded assets (both optional): Clinic letterhead image, signature image. If neither is uploaded, the app uses a default letterhead and the prescription PDF is generated without a signature.
• Payment data: Subscription plan, transaction history (payment processing is handled by Razorpay; we do not store card/UPI details)

2.2 Patient Information (Entered by Doctor)

• Demographics: Name, age, gender, phone number, email (if provided by doctor)
• Clinical data: Chief complaint, diagnosis, vitals (blood pressure, pulse, temperature, SpO2), allergies, weight
• Prescription data: Medications, dosages, frequencies, duration, instructions
• Treatment plans: Exercises, dietary advice, lifestyle recommendations, follow-up notes

2.3 Audio Data

• Voice recordings of doctor dictation during consultations
• Audio is processed for transcription and immediately discarded after extraction is complete
• We do not retain audio recordings after processing

2.4 Automatically Collected Data

• IP address — captured transiently by the web server's access log for security and abuse prevention. Not stored against doctor accounts in the database, not shared with third parties, and not used for advertising.
• Razorpay webhook IPs — logged for payment-fraud detection so we can confirm webhook events truly originated from Razorpay.

We do not use any advertising trackers, behavioural analytics, or persistent device identifiers (no Google Analytics, no Mixpanel, no advertising IDs, no AAID/IMEI/MAC collection). The app does not send any custom telemetry or marketing metrics with API requests. We do use a third-party error monitoring service to detect and fix application bugs — it receives only a pseudonymous account UUID, stack traces, and basic device metadata (OS version, app version), with no personally identifiable information transmitted. Your name, email, phone, and patient data are scrubbed before any data leaves our infrastructure.

3. How We Use Information

Purpose	Data Used
Generate structured prescriptions from voice dictation	Audio, clinical data
Create prescription PDFs	Doctor + patient data
Email a prescription PDF to a patient (when the doctor uses the optional "email patient" action)	Patient email address
Generate a time-limited shareable PDF link that the doctor sends to the patient from their own device using their own WhatsApp, SMS, or any other messaging app of their choice	Patient phone number (entered by the doctor for record-keeping; the app itself does not send SMS or WhatsApp messages to patients)
Manage doctor accounts and subscriptions	Doctor registration data
Process payments	Subscription/top-up details (via Razorpay)
OTP-based authentication of the doctor	Doctor's phone number or email
Improve transcription and extraction accuracy	Aggregated, anonymised usage patterns
Provide customer support	Account information, consultation history

4. Data Storage, Retention, and Deletion

• Database: All structured data is stored in encrypted databases hosted in India (Mumbai region).
• Prescription PDFs: Stored securely and available for download for 72 hours via time-limited links. After 72 hours, PDFs are automatically and permanently deleted from our servers.
• Audio recordings: Processed in real-time and not retained. Recorded audio is written to an ephemeral temporary file only for the duration of a single transcription call and is deleted immediately afterwards (including if the call fails).
• Doctor accounts and consultation records: Retained while the account is active. The doctor can delete their account at any time from the app (Profile → Danger Zone → Delete Account) by confirming with an OTP.

4.1 Account Deletion Process

When a doctor deletes their account from the app (or by emailing india.prescribe@gmail.com if the app has been uninstalled):

• The account is marked deleted immediately: it is deactivated, all sessions on every device are revoked, and the doctor is logged out.
• A 15-day recovery grace period begins. During this window, the doctor can email india.prescribe@gmail.com to restore the account.
• After 15 days, a nightly automated job permanently hard-deletes the account and all related data: patients, consultations, prescriptions, credit transactions, payment orders, subscriptions, refresh tokens, feedback, and all uploaded files (letterhead, signature, prescription PDFs).
• After hard-deletion, restoration is no longer possible. Payment records retained by our payment processor (Razorpay) for statutory/regulatory compliance (typically 7+ years per RBI rules) remain with them, not with us.

5. Third-Party Services

We use the following third-party services to operate the platform. Each processes data only as necessary for their function. We do not sell, rent, or trade any personal or clinical data to third parties for advertising or marketing purposes.

5.1 AI and Data Processing Services

Content processing — speech-to-text, language correction, and structured extraction — uses third-party service providers. Each provider processes only the data necessary for its specific function.

Category	Purpose
Speech-to-text providers	Converting voice dictation to text
AI language model providers	Language correction and structured medical extraction from transcripts
Vision processing providers	One-time letterhead OCR during initial doctor setup

Our AI processing is powered by enterprise-grade services from globally trusted providers such as OpenAI, Google, Anthropic (Claude), etc., with all data transmitted over encrypted HTTPS/TLS connections.

These providers may be located within or outside India and are contractually obligated to process data only on our instructions and to protect it with reasonable security practices. The list of specific providers may change over time as we improve service quality and reliability. Doctors and patients may request the current list by contacting us at the address in Section 12.

Doctor signature images are optional. When uploaded, they are stored on our servers and embedded into prescription PDFs locally; they are never shared with any third-party provider. Doctors can delete their signature at any time from within the app — the file is removed from our servers immediately.

5.2 Communications and Payments

Service	Purpose	Data Shared
Razorpay	Payment processing (subscriptions and top-ups)	Payment amount, doctor email/phone. Card / UPI details go directly from the app to Razorpay; we never see or store them.
Firebase (Google)	OTP SMS delivery to the doctor's phone for registration, login, and account deletion	Doctor's phone number, OTP code
Gmail SMTP (Google)	(1) OTP email delivery to the doctor for email-based login. (2) Sending prescription PDFs to patients as email attachments when the doctor uses the "email patient" option.	Doctor's email address + OTP code; patient's email address + prescription PDF

5.3 Hosting Infrastructure

Infrastructure	What is stored	Location
Cloud application hosting	Application server, API endpoints	Mumbai, India
Managed database	Doctor accounts, patient records, consultation history	Mumbai, India
Encrypted file object storage	Prescription PDFs (auto-deleted after 72 hours per Section 4); optional doctor signature and letterhead images (deletable any time by the doctor)	Asia-Pacific (APAC) region
Content delivery, DNS, TLS	Domain resolution, encrypted content delivery, SSL termination — no files stored at this layer	Globally distributed
Error monitoring	Pseudonymous account UUIDs, application stack traces, device metadata (no personal data) — used to detect and fix bugs	European Union

By using Prescribe AI, you consent to your data being processed and stored outside India, including in Asia-Pacific and European Union regions.

6. Data Security

• Encryption: All traffic uses HTTPS/TLS encryption. Stored data is encrypted at rest by our cloud provider.
• Authentication and access: Login is OTP-based; no passwords are stored. Every API request requires a short-lived authentication token and is scoped to the authenticated doctor, so one doctor cannot access another doctor's data. OTP requests are rate-limited to prevent abuse.
• Time-limited share links: Prescription PDFs are shared via time-limited links (72-hour expiry).
• Network protection: Our infrastructure sits behind DDoS protection and a Web Application Firewall.
• Account deletion: When a doctor deletes their account, all active sessions are revoked immediately and full data deletion follows the process described in §4.1.
• Breach notification: In the event of a personal data breach, we will notify affected users and the Data Protection Board of India as required by the Digital Personal Data Protection Act, 2023.

While we apply industry-standard safeguards, no system is wholly secure. We cannot guarantee absolute security and disclaim liability for breaches arising from causes beyond our reasonable control.

7. Doctor's Responsibilities

As the data controller for patient information entered into the system, the doctor is responsible for:

• Obtaining appropriate consent from patients before entering their data
• Ensuring accuracy of patient information entered
• Complying with applicable medical record-keeping regulations
• Safeguarding their login credentials and not sharing access

8. Patient Rights

• Access: Request a copy of their prescription and consultation data through their treating doctor
• Correction: Request correction of inaccurate data through their treating doctor
• Deletion: Request deletion of their data by contacting us or through their treating doctor
• Portability: Receive their prescription data in PDF format

9. Children's Privacy

Prescribe AI is intended for licensed medical practitioners aged 18 or above. We do not knowingly collect personal data directly from children. Where a doctor enters paediatric patient data as part of clinical workflow, the doctor warrants that they have obtained verifiable parental or guardian consent before entering such data. We do not use children's data for tracking, behavioural monitoring, or targeted advertising.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered doctors of significant changes via email or in-app notification. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000, the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023, each as amended. Any disputes shall be subject to the exclusive jurisdiction of the courts in New Delhi, India.

12. Contact Us

For application support, account queries, or general questions:

• Support email: support@prescribedose.com
• Website: https://prescribedose.com

For privacy concerns, data access requests, complaints, or grievances:

• Grievance Officer: Neelam
• Grievance email: grievance@prescribedose.com
• Address: NILSA Enterprises (Prescribe AI™), Kishan Ganj, Delhi - 110007, India

We acknowledge grievances within 48 hours of receipt and resolve them within 15 days, in accordance with the IT Rules, 2021.