Privacy policy

Ematrix ClinicQ (“ClinicQ”) is an appointment and queue service provided by Ematrix Institute of Information Technology (“Ematrix”, “we”) to clinics. This policy explains what personal data is processed when you book an appointment at a clinic that uses ClinicQ, or when you use ClinicQ as clinic staff.

Who is responsible for your data

The clinic you book with decides why and how your appointment data is used and is the data fiduciary under India’s Digital Personal Data Protection Act, 2023. Ematrix processes that data on the clinic’s behalf as its data processor. Each clinic’s data is kept separate and is visible only to that clinic’s authorised staff.

What we process

• Patients: name, mobile number, age, gender, optional e-mail and optional reason for visit, the appointment, token, visit status and payment status.
• Clinic staff: name, e-mail, mobile number, role, sign-in and activity records.
• Technical data needed to keep the service secure, such as IP address, device type and request logs. Logs do not contain patient names, phone numbers or reasons for visit.

ClinicQ is not a medical record system: we do not collect diagnoses, prescriptions or test results.

Why we process it

• To book your appointment, issue your token and show your live place in the queue.
• To send appointment messages by SMS or WhatsApp (confirmation, reminder, “your turn is near”), when the clinic has enabled them.
• To let the clinic manage visits, follow-ups, payments and receipts.
• To secure the service, prevent abuse and meet legal obligations.

We do not sell personal data and do not use it for advertising.

Consent

When you book online you confirm that the clinic may use your details for the appointment and contact you about it. You can withdraw consent by contacting the clinic; this does not affect processing already carried out, and the clinic may need to keep visit records for legal reasons.

Who can see it

• The clinic’s authorised staff (doctors see only their own patients’ visits).
• The waiting-room screen shows only your token number and, if the clinic chooses, your initials or a masked name — never your phone number, reason for visit or payment details.
• Service providers that help us run ClinicQ, such as hosting, SMS and WhatsApp delivery, bound to use the data only for that purpose.
• Authorities, when required by law.

How long we keep it

Appointment and visit records are kept for as long as the clinic uses ClinicQ and as required by law, then deleted or returned to the clinic. Your personal tracking link stops working 30 days after the visit. Security logs are kept for a limited period.

Security

Data is encrypted in transit (HTTPS). Access is limited by role, every change is recorded in an audit log, passwords are stored as strong one-way hashes, and each clinic’s data is isolated from other clinics.

Your rights

You may ask the clinic to access, correct or erase your personal data, or to nominate another person to act for you, and you may raise a grievance with the clinic or with us. If a grievance is not resolved, you may approach the Data Protection Board of India.

Changes

We will update this page when the way we process data changes.