ShifaLink Privacy Policy
At ShifaLink Healthcare Technologies (a product of AQOOI), we are dedicated to protecting your personal, clinical, and financial information. This Privacy Policy details how we collect, store, encrypt, process, and safeguard your data across the ShifaLink mobile application and web ecosystem.
ShifaLink Connects Patients With Medical Experts — We Do Not Provide Medical Services
Platform Disclaimer: ShifaLink is a technology platform connecting users with independent licensed medical experts, accredited hospitals, clinics, and certified home healthcare professionals. ShifaLink is not a healthcare provider and does not provide medical advice, diagnosis, treatment, or clinical care directly. All clinical services and medical decisions are provided solely by independent third-party licensed practitioners. In the event of a medical emergency, please call your local emergency service (102 / 108 / 112) immediately. Online payments are securely processed via Razorpay (PCI-DSS Level 1 compliant).
ShifaLink provides technology infrastructure to connect patients with independent licensed medical specialists, registered hospitals, clinics, and certified home healthcare providers. The data you share through ShifaLink is used solely to facilitate your consultations, appointment tokens, and homecare visits with your chosen healthcare provider.
Zero Sale of Health Data
We never sell, monetize, rent, or trade patient health records, diagnostic information, or personal data to third-party data brokers or advertisers under any circumstances.
End-to-End Encryption
All data in transit is protected using bank-grade TLS 1.3 protocol. Medical records and stored credentials are encrypted at rest using industry-standard AES-256 encryption.
Right to Account Deletion
In compliance with Google Play user data mandates, users have an instant in-app option or simple web request to permanently delete their account and personal information.
1. Information We Collect
We collect only the minimum necessary information required to facilitate secure clinical appointments, live queue updates, and home healthcare dispatch:
- Account & Identification Data: Patient full name, phone number, email address, date of birth, gender, and encrypted authentication tokens.
- Healthcare Appointment & Queue Data: Medical specialty chosen, hospital/clinic selected, attending physician, symptoms entered during booking, scheduled appointment date/time, and real-time OPD token number.
- Digital Prescriptions & Health Records: Prescription PDFs and digital medication records created by attending physicians for patient archival and reference.
- Healthcare Provider Verification Data: For doctors, nurses, and homecare attendants onboarding to ShifaLink: Medical Council Registration certificates, photo ID proofs (Aadhaar / Passport), degrees, and clinic accreditation papers to ensure patient safety.
- Home Healthcare Delivery Address: Physical street address and landmark for deploying home nurses and physiotherapists to the patient's home.
- Payment & Billing Data: Transaction amount, order ID, payment status, and timestamp. All card, netbanking, and UPI details are securely tokenized and processed by our RBI-authorized partner, Razorpay. ShifaLink never sees, stores, or captures card numbers or CVVs.
- Device & Telemetry Data: IP address, device model, operating system version, and Firebase Cloud Messaging (FCM) device tokens for reliable queue calling push notifications.
2. Android App Permissions & Explicit Justification
In compliance with Google Play Developer Policies on Health and Sensitive Permissions, we declare all permissions requested by the ShifaLink mobile application and their exact purpose:
Critical to notify patients in real-time when their OPD queue token number is called by the doctor, preventing missed appointments.
Used strictly when a user or healthcare provider explicitly snaps a photo of a physical prescription, Medical Council Certificate, or ID proof for verification.
Allows users to select and attach existing PDF medical records, lab reports, or identity proof documents from device storage.
Requested with runtime consent to show nearby hospitals and clinics and calculate home healthcare provider proximity. We never track location in the background.
3. Payment Gateway, Financial Data Security & Razorpay Compliance
To provide safe, seamless, and encrypted online transactions for OPD consultation fees and home healthcare bookings, ShifaLink partners with Razorpay Software Private Limited ("Razorpay"), an authorized Payment Aggregator regulated by the Reserve Bank of India (RBI).
A. PCI-DSS Level 1 Certified Infrastructure
All payment transactions are encrypted through the Payment Card Industry Data Security Standard (PCI-DSS). Your purchase transaction data is stored by Razorpay only as long as is necessary to complete your transaction. After completion, your transaction information is not retained beyond statutory audit limits. All direct payment gateways adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council (a joint effort of brands like Visa, MasterCard, American Express, and Discover).
B. Non-Retention of Sensitive Cardholder & Banking Credentials
ShifaLink does NOT collect, capture, store, or have access to:
- Full 16-digit Credit or Debit Card numbers
- Card Expiration Dates
- Card Verification Values (CVV / CVC security codes)
- ATM or Debit Card PINs
- Net Banking User IDs or Passwords
- Unified Payments Interface (UPI) MPINs
When entering card or UPI details, your inputs are submitted directly into Razorpay's PCI-DSS Level 1 encrypted payment iFrame. ShifaLink only receives a secure, irreversible transaction token, the payment status (Success, Failed, or Pending), the timestamp, and the unique Razorpay Payment ID (pay_xxx).
C. RBI Card-on-File Tokenization (CoFT)
In full compliance with RBI circulars on Card-on-File Tokenization (CoFT), neither ShifaLink nor Razorpay stores your actual card details for recurring or saved card transactions. Any card saving feature uses network-level tokens issued by Visa, Mastercard, or RuPay, with your explicit authorization.
D. Information Disclosed to Razorpay
When you initiate an online payment on ShifaLink, the following minimum details are shared with Razorpay solely to execute and reconcile the payment:
- Customer Profile: Full name, verified mobile number, and email address (for payment confirmation receipts).
- Transaction Metadata: Order ID, consultation or homecare booking reference, billing amount, currency (INR), and IP address for fraud detection.
- Service Address: For home healthcare services, address details are used for billing invoices and tax calculations.
E. Fraud Prevention & Risk Monitoring
Razorpay employs proprietary machine learning risk assessment tools that analyze transactional patterns (such as velocity checks, geographic anomalies, and device fingerprints) to prevent payment fraud, unauthorized charges, and identity theft.
F. Razorpay Privacy Policy Reference
For more information regarding how Razorpay collects, stores, and processes your payment transaction data, please review the official Razorpay Privacy Policy at https://razorpay.com/privacy/.
4. Sharing and Disclosure of Information
We share your data strictly on a need-to-know basis with:
- Attending Doctors & Hospital Staff: Your registered name, age, gender, symptoms, and queue token are shared with the medical clinic you book with so they can conduct your consultation.
- Home Care Personnel: Your contact number and address are provided to the designated nurse or attendant so they can navigate to your residence.
- Infrastructure Partners: Secure cloud hosting (AWS / DigitalOcean / Redis) and notification routing (Google Firebase) bound by rigorous confidentiality agreements.
- Legal Compliance: Only when mandated by a lawful subpoena, court warrant, or applicable public health authority order under Indian law.
5. Data Retention, Account Deletion & User Rights
In compliance with the Google Play Store Account Deletion Policy, users have total autonomy to permanently erase their account and all personal information:
Method 1 (Mobile App): Open ShifaLink > Tap Profile > Tap Settings > Tap "Delete Account & Data" > Confirm deletion.
Method 2 (Online Request): You can submit an online request directly at our dedicated Account & Data Deletion Portal or email our Data Protection Officer at privacy@shifalink.health with your registered phone number.
Timeline: Your account profile, authentication credentials, and active session tokens are permanently wiped within 30 days. Anonymized transaction records and statutory medical audit logs may be retained only as mandated by the Indian National Medical Commission (NMC) regulations.
6. Grievance Officer & Privacy Contact
In accordance with the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023, the details of our Grievance Officer are:
Designation: Data Protection & Grievance Redressal Officer
Company: ShifaLink Healthcare Technologies (A Product of AQOOI)
Address: Kashmir Healthcare Operations Centre, Srinagar, Jammu & Kashmir 190001, India
Email: privacy@shifalink.health / grievance@shifalink.health
Helpline: +91 (0194) 240-SHIFA (Mon–Sat, 9:00 AM – 7:00 PM IST)