Privacy policy

Who is responsible for what

• Patient records: the clinic. The clinic decides whose records are kept and why, so under the DPDP Act the clinic is the data fiduciary for its patients’ personal data. Neork is its data processor: it processes that data only on the clinic’s behalf and on its instructions, to run the service the clinic signed up for. If you are a patient, questions about your records go to your clinic first; Neork will help the clinic answer them.
• Clinic accounts: Neork. For the clinic’s own account, its staff accounts and its devices, Neork decides how that data is used (licensing, billing and support), so for that data Neork is the data fiduciary.

What is collected

• Patient records, entered by clinic staff or by the patient on the clinic’s QR page: name, mobile number, date of birth or age, gender, address, allergies and conditions, the reason for the visit, the doctor’s findings and notes, prescriptions, the next visit the doctor asks for, queue tokens, bills and payments.
• The patient’s consent: when it was given, how (at the desk, at the pharmacy counter, or on the QR page), who recorded it, which version of the notice was shown, and when it was withdrawn if it was.
• Clinic staff accounts: name, username, role, and a password stored only as a one-way hash — Neork never receives a password itself.
• The clinic: its name, code, address, phone number and the super admin’s email address, used for the licence, sign-up codes and support.
• Devices: an identifier for each computer or tablet, its operating system, app version and a device name, so the licence and pairing work and a problem can be traced to the device it happened on.
• An activity log of what each device did (for example “bill paid” or “patient registered”), used to support the clinic and to trace a security problem. It never contains a patient’s name, a diagnosis, a medicine or an amount.

The apps contain no advertising and no analytics or tracking SDKs. The Pharmacy app uses the camera only to scan the pairing QR code shown on the clinic’s computer; no image is stored or sent. Both apps use the network and Wi-Fi to reach the clinic’s own computer and Neork’s servers.

Notice and consent for patients

Every way of registering a patient — at the doctor’s desk, at the pharmacy counter, or on the clinic’s QR page — shows the patient a short notice of what is kept, why, their rights and how to complain, and asks for their consent before the record is created. On the QR page the patient ticks the box themselves; at the desk or counter, staff confirm the patient was told and agreed. The consent is recorded with the version of the notice shown (current version: 2026-10-21), so the clinic can show it was given.

For a child, the consent is given by the parent or guardian who brings them. The DPDP Rules allow a clinic to process a child’s data without separate verifiable parental consent to the extent needed to provide health services.

How it is used

Only to run the clinic: registering patients, the queue, consultations, prescriptions, dispensing and billing, reminding a patient of a next visit if the clinic has switched that on, keeping the clinic’s computers and tablets in step, backups, licensing, security and support. Patient data is never sold, never used for advertising, and never used to train AI models.

Where it is kept, and how it is protected

• On the clinic’s own devices, which keep working without the internet.
• On Neork’s servers in India (Oracle Cloud, Hyderabad), which keep the clinic’s devices in step and hold backups, so a lost or broken computer does not mean lost records.
• Everything travels over encrypted connections (TLS). Patient details, clinical notes and prescriptions are encrypted at rest with AES-256, using keys unique to each clinic.
• Neork holds the keys that make server backups and recovery possible, so Neork can technically decrypt a clinic’s records. Neork staff do not view patient records: the Neork console has no screen that shows them, and any backup download or restore is recorded against the person who did it.
• Access is limited to the people who need it: each staff member signs in with their own account, permissions are set by role, and every device’s activity is logged. Those logs are kept for at least one year, as the DPDP Rules require.

Who it is shared with

• Nobody, for their own use. Neork does not sell or share personal data.
• Service providers that run the service for Neork, under contract: Oracle Cloud (server hosting, India) and Google (Gmail, which delivers sign-up and security codes to the clinic’s email; it carries no patient data).
• WhatsApp (Meta), only if the clinic switches on WhatsApp messages and connects its own WhatsApp Business account. Then the patient’s name and mobile number, their token number, the doctor’s name, the prescription the pharmacist writes for them and the date of a next visit are sent to Meta to deliver the message to the patient. Meta may process this outside India; Meta’s own privacy policy applies to that delivery. A patient who withdraws consent is not messaged.
• Where the law requires it, for example a valid order from a court or authority.

How long it is kept

• Patient records are kept for as long as the clinic uses NeoCliniQ and as long as the law requires the clinic to keep medical records. The clinic decides when they are no longer needed.
• A clinic’s super admin can delete the clinic and all of its data from Neork’s servers at any time (Settings → Delete this clinic), and Neork’s own backups of it go with it. No copy is kept anywhere unless Neork has agreed, for that clinic, to let it save a complete encrypted copy on its own computer first. Neork keeps only the record of what the clinic paid, as accounting law requires.
• Neork’s nightly backups of a clinic’s records are kept for a limited period and then removed. The activity log is kept on Neork’s servers for one year and then deleted.

Deleting your account or data

Google Play links here as the place to ask for deletion.

• A whole clinic — its account, every patient record, and every staff account: the clinic’s super admin opens NeoCliniQ Doctor → Settings → Delete this clinic, confirms with the code emailed to the clinic, and everything is removed from Neork’s servers at once. Or email neorkai@neork.com from the clinic’s registered address and Neork will do it within 7 days.
• A staff account: the clinic’s administrator disables it in Settings → Users. It keeps its name on the records it signed, as medical records must; ask the clinic, or Neork, to remove the name as well.
• A patient’s records: ask the clinic that holds them. Neork will help the clinic if it asks.

What Neork keeps after a clinic is deleted: only the record of what the clinic paid Neork, which accounting law requires.

Your rights

Under the DPDP Act you have the right to:

• Access: a summary of your personal data and how it is processed, and who it has been shared with.
• Correction and erasure: to have your data corrected, completed or updated, and erased once it is no longer needed — except medical records the law requires a clinic to keep.
• Withdraw consent, as easily as you gave it: tell the clinic, which records the withdrawal in the app. From then on your data is not used for anything that needs your consent, and WhatsApp messages stop. Withdrawing does not undo what was lawfully done before it.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Grievance redressal: to have a complaint answered (below).

Patients: make the request to your clinic, which can act on it in the app; Neork helps the clinic if needed. Clinic staff and owners, or a patient who cannot reach their clinic: write to neorkai@neork.com. If a request about a clinic’s patients reaches Neork, Neork passes it to that clinic and helps it respond. Requests are answered within 30 days.

Grievance Officer and complaints

Grievance Officer, Neork — neorkai@neork.com. Write with your name, the clinic concerned (if any) and what you are asking for. We acknowledge a complaint within 7 days and resolve it within 30 days.

If you are not satisfied with the answer, you may complain to the Data Protection Board of India.

If something goes wrong

If a personal data breach happens, Neork will tell the clinics affected without delay, and for the data it is responsible for, will inform the people affected and the Data Protection Board of India without delay and send the Board a detailed report within 72 hours, as the DPDP Rules require. Neork helps each clinic meet the same duty for its patients.

Children

The apps are for clinic staff, not for children. A clinic may keep records of patients who are children; those records are entered and looked after by the clinic, with the consent of the parent or guardian, and only for the child’s health care.

Changes and contact

When this policy changes, the date at the top changes with it, and clinics are told of any change of substance. Questions or complaints about privacy: neorkai@neork.com.