Privacy Policy

Chikitsa is run by Dhananjay Trivedi (Bhama) from Raebareli, Uttar Pradesh.

Patient records belong to the clinic. The doctor decides what to record about a patient and why. We store those records and show them to the clinic’s own staff, on the clinic’s behalf. For the account details of the clinic owner and staff, we are responsible ourselves.

• Owner and staff accounts: name, email, phone number, role in the clinic, and sign-in details. Passwords are handled by Google’s sign-in service. We never see or store them in readable form.
• The clinic: name, address, phone, specialty, timings and settings.
• Patient records the clinic enters: for example name, phone number, complaints, visit history, prescriptions and clinical notes.
• Payments: Razorpay takes your card, UPI or bank details on its own screen. We receive only the order and payment reference, the amount and whether it succeeded. We never see or store card numbers.
• Technical diagnostics: error reports and page-speed measurements, which do not contain patient names or details.

To run the service for your clinic, to bill you, to help you when you ask for support, to keep the service secure, and where the law requires. Nothing else.

• We do not sell patient or clinic data, and we do not show advertising.
• We do not use patient records for anything other than running that clinic’s own service. Nothing is sent to an AI service today. If we ever add AI features, they will be optional for the clinic, will use information with names and contact details removed, and we will tell you before they exist.
• This website does not use advertising or tracking cookies.

• Google (Firebase and Google Cloud): runs our database, sign-in, hosting and server functions.
• Razorpay: processes subscription payments.
• Telegram (optional, one clinic today): if a clinic asks for it, we can message the doctor on Telegram when a new patient is registered. That message contains the patient’s name and phone number and passes through Telegram. It is switched on for one clinic today. No other clinic’s patients are sent anywhere.
• WhatsApp: when a doctor shares a prescription, the clinic’s own phone opens WhatsApp with the message ready to send. The doctor taps send. The message then travels under WhatsApp’s own terms.

Records are stored in Google Cloud (Firebase), in a multi-region database located in the United States. Our server functions run in Mumbai, India. We tell you this plainly because some doctors want their data in India. If that matters to you, ask us before you sign up.

The owner chooses who can sign in and what role each person has. A compounder, for example, can see what to dispense but not the doctor’s clinical notes. Staff of one clinic can never see another clinic’s records. This is enforced by the database’s own rules, not only by the app. Our security page explains more.

For as long as the clinic’s account exists. If a plan ends, we keep your records so you can come back. When you ask us to delete your clinic, we delete it. Medical records have legal and professional retention expectations, so please ask for a copy before you ask for deletion.

You can ask us to show you, correct, export or delete the data we hold about your clinic or account. Write to dwejy80bhama@gmail.com from the email address on your account. We reply within 2 working days and will tell you how long the work will take.

If you are a patient, your records are held by your doctor’s clinic. Ask the clinic first. If you cannot reach them, write to us and we will pass your request on to them.

Write to Dhananjay Trivedi at dwejy80bhama@gmail.com or call +91 70072 24036. This is also the contact for any grievance about how we handle personal data.

When we change this policy we change the date at the top. If a change affects what we do with your clinic’s data, we will tell the clinic owner before it takes effect.