Legal
Privacy Policy
trueKin for Doctors, by TrueKin Technologies Private Limited
By using trueKin for Doctors, you agree to the practices described here.
1. Who We Are
TrueKin Technologies Private Limited is the data controller and operator of trueKin for Doctors, as well as the main trueKin consumer app. We are incorporated in India and subject to Indian data protection law.
Registered Address
TrueKin Technologies Private Limited, India
Governing Laws
This policy is made in compliance with the:
- Information Technology Act, 2000 (IT Act)
- IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules)
- Digital Personal Data Protection Act, 2023 (DPDP Act)
2. We Are a Platform, Not a Healthcare Provider
trueKin for Doctors is technology, not medicine.
TrueKin Technologies Private Limited is not a hospital, clinic, or healthcare provider. We do not practise medicine, and we do not employ, supervise, or take responsibility for the doctors who use this platform. We are not a party to the doctor–patient relationship. We simply give practitioners a secure way to view information their patients have chosen to share with them, and to keep their own clinical records.
This distinction matters for privacy: most of the sensitive health information visible in trueKin for Doctors is not “yours” in the way it would be in a typical clinical records system. It belongs to the patient, is controlled by the patient, and is shown to you only for as long as and to the extent the patient permits.
3. Grievance Officer
Under the IT Act 2000 and SPDI Rules 2011, we are required to appoint a Grievance Officer for privacy-related complaints. If you have any concern about how your data (or a patient's data) is handled, please contact:
Achyuth Jayagopal, Grievance Officer
grievance@truekin.co.in+91 94469 10814
34/812-H, Pynadath House, Amity Gardens, Beena Anjumana Road, Edappally, Ernakulam, Kerala 682024, India
We will acknowledge your complaint within 24 hours. General complaints are resolved within 15 days (IT Rules 2021). Requests relating to your statutory data rights under the DPDP Act (access, correction, or erasure) are resolved within 90 days (DPDP Rules 2025).
4. What Information We Collect
4.1 Your Account Information
- Email address (for OTP login and identity verification)
- Display name, avatar, and phone number (if provided)
- Medical specialty or specialties, clinic name
- Medical registration/licence number, where you provide it
- Details of any clinic or organisation you register or join on the platform
4.2 Patient Information You Access
Patient health data is shown to you only with the patient's consent
When a patient using the main trueKin app explicitly grants you access, you may view, depending on what they have permitted:
- Their profile and demographic details (name, date of birth, gender)
- Medications, dosages, and schedules
- Food and medicine allergies, and health conditions they manage
- Medical documents, lab reports, and vitals they or their care circle have recorded
This data is read live from the patient's own trueKin account for as long as their consent is active. See Section 6 for how this access works.
4.3 Clinical Records You Create
Information you enter yourself while using the platform, including:
- Consultation notes and prescriptions you issue
- Vitals you record during a visit
- Reports you upload, and reviews or annotations you add to a patient's reports
- Tasks, reminders, and other records you keep for your own practice
4.4 Information Collected Automatically
- Device type, operating system, app version
- Feature usage and screen activity, associated with your account, used to understand how the platform is used and improve it
- IP address (stored in irreversibly pseudonymised form; raw IP is never stored)
4.5 What We Do Not Collect
- Your GPS location or location history
- Your device contacts list
- Biometric identifiers (fingerprint, face scan)
- Payment or financial information
5. Why We Collect It (Purpose and Legal Basis)
| Purpose | Legal Basis Under DPDP Act 2023 |
|---|---|
| Account creation and OTP verification | Legitimate use (contract with you) |
| Displaying patient information you have been granted access to | Legitimate use, on the strength of the patient's own consent |
| Letting you record consultations, prescriptions and vitals | Legitimate use (contract with you) |
| Enabling clinics/organisations to share records among their own doctors | Legitimate use (contract with you and your organisation) |
| Improving platform reliability and performance | Legitimate interest (anonymised only) |
| Customer support and grievance resolution | Legal obligation / Legitimate interest |
| Complying with court orders or legal process | Legal obligation |
6. How Patient Data Reaches You: Consent-Gated Access
trueKin for Doctors never gives you open access to any patient's records. Every patient with a trueKin account controls, from their own app, exactly which doctors can see their information, what categories of data those doctors can see, and for how long.
- You can only view a patient's data after they have granted you access from their own account
- The scope of what you can see (e.g. medications only, or medications and documents) is set by the patient, not by you
- The patient may revoke your access at any time, without notice to you. The moment they do, you lose the ability to view their live data
- Every access to patient data is authorised and logged against the specific consent grant that permits it
Because of this, most patient data shown in trueKin for Doctors is not stored as a separate copy on our side. It is read directly, in real time, from the patient's own record each time you view it, for as long as their consent remains active.
7. Sensitive Personal Data: Special Protections
Because trueKin for Doctors handles health information, the following additional protections apply under SPDI Rules 2011, whether the data is yours or a patient's that you have been granted access to:
- Patient SPDI is shown to you only on the strength of that patient's free, informed, specific, and explicit consent, given on the main trueKin app
- We do not share your data or any patient's data with any third party beyond what is described in Section 9, except as required by law
- All SPDI is encrypted at rest using AES-256-GCM encryption. See Section 8
8. How We Protect Your Information
8.1 Encryption
All Sensitive Personal Data (your account details and any patient data you access) is encrypted before it is stored, using AES-256-GCM encryption with keys managed through Google Cloud KMS, hosted in Mumbai (India). Data in transit is protected with TLS 1.2 or higher.
8.2 Access Controls
Patient data is accessible only to doctors holding an active, patient-granted consent for that specific patient, and only within the scope of that grant. Our team cannot read clinical records in the normal course of operations. Access to production infrastructure is limited and logged.
8.3 Session Security
Each login is secured with a one-time password (OTP) sent to your registered email. Session tokens are stored as one-way hashes; the raw token is never stored. Logging out immediately invalidates your session.
8.4 Pseudonymisation of Analytics and Logs
We do not link platform usage analytics to your name, email, or clinical data. IP addresses in logs are irreversibly pseudonymised using a cryptographic HMAC.
8.5 Data Breach Notification
Despite our safeguards, in the unlikely event that personal data is compromised in a security incident, TrueKin Technologies is legally bound under Rule 7 of the DPDP Rules, 2025 to act with transparency and speed:
- We will notify the Data Protection Board of India (DPBI) and inform affected users, without delay, in clear and plain language
- A detailed report will be submitted to the DPBI within 72 hours of our becoming aware of it
- Where the incident qualifies as a cybersecurity incident, it will also be reported to CERT-In within 6 hours of detection, as required under Section 70B(6) of the IT Act, 2000
9. Where Your Data Is Stored
trueKin for Doctors runs on Google Cloud Platform, hosted in Mumbai (India). Your account details and any clinical records you personally create (consultation notes, prescriptions, vitals you record) are stored in our own database there.
Patient information you view under an active consent grant is not duplicated into a separate store. It is read live from trueKin's own database, also hosted in India, each time you open it.
10. Who We Share Data With
| Recipient | What Is Shared | Why |
|---|---|---|
| Colleagues in your registered clinic/organisation | Clinical records, according to the access level you configure | Coordinated care within your own team |
| trueKin's own database (India) | Live read access to patient records under an active consent grant | Displaying patient information you've been authorised to see |
| Google Cloud KMS (India, Mumbai) | Encryption keys (not your data itself) | Managing encryption keys for data at rest |
| Google Cloud SQL (India, Mumbai) | Encrypted data at rest | Hosting your account and clinical records |
| Brevo (France/EU) | Email address | Sending OTP and transactional emails |
| Law enforcement / courts | As required by law | Legal obligation only |
11. Data Retention
We keep your account data for as long as your account exists. Once you delete your account:
| Data Type | Retention After Deletion |
|---|---|
| Account profile | Deleted within 30 days |
| Clinical records you created (notes, prescriptions, vitals you recorded) | Deleted within 30 days, subject to any statutory medical-records retention period that applies to you |
| Session logs | Deleted within 90 days of session end |
| Anonymised usage analytics | Retained up to 2 years (no personal identifiers) |
| Account deletion record | Retained 5 years (pseudonymised, no clinical data, no name) |
Patient data you viewed under a consent grant is never stored separately by us on your behalf. There is nothing to retain or delete on that side beyond the clinical records you yourself entered.
12. Your Rights
Under the DPDP Act 2023 and SPDI Rules 2011, you have the following rights over your own account data:
Right to Access
Request a full copy of the account and clinical-record data we hold about you.
Right to Correction
Update your profile, specialty, and clinic details at any time from your account settings.
Right to Erasure
Permanently delete your account and the clinical records you created. Deletion is irreversible.
Right to Grievance Redressal
Contact our Grievance Officer at grievance@truekin.co.in. We acknowledge complaints within 24 hours; general complaints are resolved within 15 days, and requests relating to your data rights within 90 days.
Patients' rights over their own data
trueKin for Doctors is not the controller of patient health data; TrueKin Technologies is, through the main trueKin app. A patient wishing to access, correct, or erase their own data, or to review or revoke a doctor's access, does so from their trueKin account, not through this platform.
13. Who Can Use This Platform
We do not knowingly allow anyone who is not a licensed healthcare professional to register as a doctor on the platform. If we become aware that an account does not meet this requirement, we will suspend or delete it.
14. Cookies and Analytics
The trueKin for Doctors web application itself does not rely on browser cookies for core functionality.
We use pseudonymised analytics (no name, no clinical data) to understand how features are used and improve the platform. Where the website uses cookies for basic functionality or analytics, you can manage your preferences through the banner shown on first visit or through your browser settings.
15. Changes to This Policy
- We will notify you in the app before the change takes effect
- Changes that affect how patient data is handled will require your acknowledgement
- The version number and effective date at the top of this page will be updated
- We will maintain the previous version for 12 months on request
Continued use of trueKin for Doctors after the effective date of changes constitutes acceptance of the updated policy.
16. Contact
Privacy complaints or data requests
Grievance Officer
grievance@truekin.co.inAcknowledged in 24 hours · resolved in 15–90 days depending on request type
Registered office
TrueKin Technologies Private Limited, India
This Privacy Policy is governed by the laws of India. Any disputes are subject to the jurisdiction of courts in India.
Applicable laws: Information Technology Act 2000 · IT (SPDI) Rules 2011 · Digital Personal Data Protection Act 2023
Questions? Contact our Grievance Officer: grievance@truekin.co.in
Acknowledged in 24 hours · resolved in 15–90 days depending on request type.