1. Who We Are
DoctorReviews.in ("we", "us", "our") is a doctor and hospital review platform operated from India. This Privacy Policy explains how we handle your personal data in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and applicable rules.
2. Information We Collect
2.1 Information you provide
- Name & contact: When you submit a review or contact us
- Phone number (hashed only): Stored as a SHA-256 hash, never as plain text. Used solely to deduplicate reviews and prevent spam (max 3 reviews per number per 24 hours).
- Review content: Your written reviews, ratings, and uploaded photos
- Email address: If you subscribe to updates or contact support
2.2 Information collected automatically
- Device data: Browser type, operating system, screen size
- Usage data: Pages visited, time spent, search queries (no personal identifiers)
- IP address: Used only for fraud prevention and approximate location
- Cookies: See Section 7 below
2.3 Location data (optional)
If you use the "Near Me" feature for blood banks or doctors, we request your browser location only with your explicit permission. Location is used in real-time and not stored.
3. How We Use Your Data
- To publish your reviews (only the name and review text — never your phone)
- To deduplicate and rate-limit reviews via phone-number hash, and to verify the optional ✓ Verified Visit badge when a reviewer uploads a prescription or consultation bill (proof file is permanently deleted within 7 days)
- To prevent spam, fake reviews, and abuse
- To improve platform features and user experience
- To respond to your queries and grievances
- To comply with legal obligations
4. Doctor Information & NMC Verification
Doctor names, qualifications, registration numbers, and council affiliations displayed on our site are sourced from the National Medical Commission (NMC) Indian Medical Register, which is a publicly available database. We display this information for the public's right to verify medical practitioners.
If you are a doctor and wish to update or remove information about yourself, please write to doctors@doctorreviews.in with proof of identity.
5. Data Sharing
We do not sell your personal data. We share data only in these limited cases:
- Service providers: Hosting (Hostinger), database (MariaDB on Hostinger), analytics (Google Analytics 4), advertising (Google AdSense) — all bound by confidentiality / industry-standard data-processing terms
- Legal requirements: If compelled by valid legal process under Indian law
- Safety: To prevent fraud, abuse, or threats to user safety
- Aggregated analytics: Anonymous, non-identifiable statistics may be shared publicly
6. Your Rights Under DPDP Act 2023
As a Data Principal, you have the right to:
- Access: Request a copy of personal data we hold about you
- Correct: Update or fix inaccurate data
- Erase: Request deletion of your data (right to be forgotten)
- Withdraw consent: Stop processing of your data going forward
- Grievance redressal: File a complaint with our Grievance Officer (see Section 11)
- Nominate: Designate someone to exercise your rights in case of incapacity
To exercise any right, email privacy@doctorreviews.in. We will respond within 30 days.
7. Cookies & Tracking
We use:
- Essential cookies: For site functionality (cannot be disabled)
- Analytics cookies: Google Analytics 4 — anonymized, IP-masked
- localStorage: To save your review draft and remember recently-viewed doctors (stored on your device only, never sent to us)
- Third-party advertising cookies: see section 7A below.
You can disable cookies in your browser settings. Most site features will continue to work.
7A. Third-Party Advertising (Google AdSense)
DoctorReviews.in may serve display advertising via third-party ad networks, including but not limited to Google AdSense, to support free patient access to the platform.
- Google, as a third-party vendor, uses cookies to serve ads on this site, including the DoubleClick DART cookie, which enables Google and its partners to serve ads to users based on their visit to this and other sites.
- Google AdSense may collect non-personally identifiable information such as device type, browser, OS, approximate location, and visited pages, to serve more relevant ads.
- You may opt out of personalised advertising by visiting Google Ads Settings or, for EU/EEA visitors, by managing consent at YourOnlineChoices.com.
- For India (DPDP Act 2023) and global users: ads served are not based on sensitive personal data (health diagnosis, prescriptions, biometric, financial) collected by us. We do not pass any identifiable patient review content to ad networks.
- Third-party ad-cookie behaviour is governed by each vendor's privacy policy. Google's policy: policies.google.com/technologies/ads.
- If you do not want any third-party advertising cookies set, you may use private/incognito browsing mode, or browser extensions like uBlock Origin / Privacy Badger.
Ad labelling. Where we display third-party ads, they are visually distinct from editorial content. We do not allow ads inside individual patient reviews, inside doctor profile information panels, or in a manner that could be confused with our editorial recommendations.
8. Data Retention
- Reviews: Stored as long as the platform operates (reviews are public content)
- Phone-number hashes: Stored as SHA-256 hashes only (never plain text), retained for rate-limiting and deduplication. Raw phone numbers are never stored.
- Visit-proof files (prescription/bill uploads): Permanently deleted within 7 days of moderator review.
- Analytics data: 14 months (Google Analytics default)
- Ad-network cookies: Per the third-party vendor's retention policy (see Google's policy linked above).
9. Security
We implement reasonable security practices per Rule 8 of IT (Reasonable Security Practices) Rules, 2011:
- HTTPS encryption for all data in transit
- Database access restricted to authorized personnel
- Regular security audits and updates
- Phone-number hashing (SHA-256) for review-submission identity protection
However, no online platform is 100% secure. We cannot guarantee absolute security but commit to notifying users within 72 hours of any breach affecting their data.
10. Children's Privacy
Our platform is not intended for users under 18. We do not knowingly collect data from children. If you believe a child has submitted data, contact us for immediate deletion.
11. Grievance Officer (IT Rules 2021)
Grievance Officer: Manish Bhaparia
Email: grievance@doctorreviews.in
Response time: Within 24 hours
Resolution time: Within 15 days as mandated
12. Changes to This Policy
We may update this policy from time to time. Material changes will be notified via banner on the site for 30 days. The "Last updated" date at the top reflects the most recent change.
13. Governing Law
This policy is governed by Indian law. Disputes are subject to the exclusive jurisdiction of courts in Mumbai, Maharashtra, India.
14. Contact Us
For any privacy-related questions:
- General privacy queries: privacy@doctorreviews.in
- Grievances: grievance@doctorreviews.in
- Doctor profile concerns: doctors@doctorreviews.in