Privacy Notice
What personal data we collect, why, where it is stored (India), who we share it with, and your rights under the Digital Personal Data Protection Act, 2023.
1. Data Fiduciary
DawaStation is operated by N.A.I.R. Solutions, a proprietorship of Pravin R Nair, Bhilai, Durg, Chhattisgarh (GSTIN 22DMOPP2753L1ZL, UDYAM-CG-05-0062143). For personal data collected through DawaStation for our own purposes, N.A.I.R. Solutions is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
When a clinic or pharmacy (Partner) uses our software to keep records of its own patients or customers, the Partner is the Data Fiduciary for that data and we process it only on the Partner's instructions (see the Partner Agreement).
2. What we collect
- Account data: name, mobile number, email (if given), role, login codes (temporary, deleted after use), PIN (stored only as a one-way hash).
- Profile data you add: age, gender, blood group (only if you join the blood-donor network), address or area.
- Location: approximate or GPS location, only when you allow it, to show nearby services. Cached on your device for 30 minutes.
- Activity: searches, pages viewed, "I'm Coming" requests, appointments, tokens, reviews, messages and support requests.
- Device and log data: IP address, browser, device type, time of request (kept for security and as required by CERT-In rules).
- Partners: business name, licence and registration details, documents uploaded for verification, payout/UPI details for invoices.
- We do not collect Aadhaar numbers, government portal passwords or OTPs for ABDM registration. Those are entered by the doctor directly on the government portal.
3. Why we use it (purpose)
- To create and secure your account and log you in.
- To show nearby medicines, doctors and services, and to pass your requests (appointment, token, "I'm Coming", delivery) to the Partner you chose.
- To send service messages by WhatsApp, SMS or email (codes, booking updates). Promotional messages only with your separate consent; you can opt out any time.
- To verify Partners, issue invoices and comply with tax law.
- To keep the platform safe, prevent fraud and meet legal obligations, including CERT-In log retention.
- To improve DawaStation using aggregated statistics that do not identify you.
4. Legal basis
We process personal data on the basis of your consent, given when you sign up or when you choose a feature, and for legitimate uses permitted by Section 7 of the DPDP Act (for example, a service you requested, legal obligations and emergencies). You may withdraw consent at any time; withdrawal does not affect processing already done, and some services will stop working without the data they need.
5. Sharing
- With the Partner you contact or book (only what is needed for that request).
- With our service providers, under contract and only for our purposes: Amazon Web Services and Supabase (hosting and database, Mumbai, India), Vercel (website delivery), Meta (WhatsApp messages), Resend (email).
- With authorities when required by law or a valid order.
- We do not sell personal data and do not share it with advertisers.
6. Where data is stored
Our database, files and API servers are located in India (AWS Mumbai region). Website pages are delivered through a global network but do not store your account data. If any transfer outside India becomes necessary, it will follow the DPDP Act and any restrictions notified by the Government.
7. How long we keep it
- Account data: while your account is active, and deleted or anonymised within 30 days after you delete it, except where law requires longer.
- Login codes: deleted after use or within 10 minutes. Security logs: at least 180 days (CERT-In).
- Invoices and payment records: 8 years (tax law).
- Partner patient records kept in our software: as instructed by the Partner, who is responsible for medical-record retention rules.
8. Security
Encryption in transit (HTTPS) and at rest, access only for authorised staff, hashed PINs, rate limits, monitored servers and daily backups. No system is perfectly secure; if a personal data breach happens we will inform affected users and the Data Protection Board of India as required by the DPDP Act and Rules, and report cyber incidents to CERT-In within 6 hours.
9. Your rights
- Get a summary of your personal data we process and who we shared it with.
- Correct, complete or update your data; delete your account (Profile → Delete account, or write to us).
- Withdraw consent, and opt out of promotional messages.
- Nominate a person to exercise your rights in case of death or incapacity.
- Raise a grievance with us, and if not resolved, complain to the Data Protection Board of India.
10. Children
DawaStation is not meant for persons under 18 without a parent or lawful guardian. We do not knowingly process a child's data without verifiable consent of the parent or guardian, and we do not track or target advertising at children.
11. Cookies and analytics
We use essential browser storage to keep you logged in and remember your location and language. We record anonymous usage events (pages, searches, device type) on our own servers to improve the service. We do not use advertising cookies.
12. Grievance Officer
Pravin R Nair, dawastation.cg@gmail.com, +91 98275 63406, Bhilai, Durg, Chhattisgarh. We acknowledge within 48 hours and respond within the time required by the DPDP Rules.
13. Changes
We will update this notice when our practices change and show the new version and date above. For material changes we will notify you on the platform and, where needed, ask for fresh consent.