This policy explains what MyCare (Storm Code) collects, why, who sees it and your choices. We follow the Digital Personal Data Protection Act, 2023.
What we collect
- Account: name, mobile number, email, date of birth, and your family members you add.
- Visits: bookings, tokens, visit status and history, follow-up dates and reminders.
- Medical records that a clinic uploads or writes for your visits, such as prescriptions and reports. Notes a clinic keeps for itself (such as BP and sugar readings) are seen only by that clinic.
- Payments: amounts, status, refunds and the gateway's payment references. Card and bank details are handled by Razorpay; we do not store them.
- Clinics: clinic details, team members, and the payout bank account, PAN and address (stored encrypted).
- Security and device: the devices you are logged in on, IP address and browser, and a record of changes made in the app.
Why we use it
- To run bookings, reminders, records and payments.
- To keep accounts secure and investigate misuse.
- To meet legal and accounting duties.
- We do not sell your data and do not use it for advertising. Clinic messages reach you only from clinics you are linked to, and you can turn them off.
Who sees it
- You see everything on your account. Each clinic sees only what belongs to it: your details, your visits there and its own records. Clinics do not see each other's records.
- Inside a clinic, its doctors see its patients and records; staff see only what the doctor allows.
- Our service providers, only as needed to run the service: Supabase (database and file storage, Mumbai region), Render (servers), Cloudflare (website), Razorpay (payments), Resend (email) and your browser's push service (notifications).
- Authorities, when the law requires it.
How we protect it
- Data is stored in India. Medical files are private and opened only by signed links.
- PINs and passwords are stored only as secure hashes; payment secrets are encrypted.
- Access is checked on our server for every request.
How long we keep it
- Account, visit and record data: while your account exists.
- The record of changes made in the app (activity and audit): 90 days.
- Payment records: as long as tax and accounting laws require.
Your choices and rights
- See and correct your details in the app, or ask us.
- Ask for your account to be deleted. Payment records that the law requires us to keep stay.
- Turn notifications off, and log out any device, from the app.
- Family members are added and managed by the account holder, who agrees on behalf of children in their care.
Cookies
We use one cookie to keep you logged in, and your browser's storage for settings such as the last clinic you used. No tracking or advertising cookies.
Grievance officer
[To be filled: name of the grievance officer], Storm Code, Tilkamanjhi, Bhagalpur, Bihar, India. Email mycare@stormcode.in.
Contact
Storm Code, Tilkamanjhi, Bhagalpur, Bihar, India. Email mycare@stormcode.in. We answer within 2 working days.