Privacy policy

Who is responsible for which data

• Your account data (the physiotherapist): PhysioBook decides how it is used and is its data fiduciary.
• Your patients' data (names, phone numbers, conditions, visits, payments): you decide what to record and why, so you are its data fiduciary and PhysioBook processes it on your behalf. See the data processing terms.

What we collect

• Account: mobile number (for sign-in codes), your name, practice name, qualification, address, UPI ID and logo, if you add them.
• Practice records you enter: patients, rates, visits, payments, adjustments, reminder rules and the reminders sent.
• Billing: your plan, subscription status and payment references from Razorpay. We never see or store card or bank details.
• Technical: device identifier for keeping you signed in, app version, error reports and basic usage events, so we can fix problems.

Why we use it

• To run the service: sign you in, store and sync your records, calculate dues and send the reminders you set up.
• To bill you for paid plans and keep tax records.
• To keep the service secure, prevent abuse and fix errors.
• To tell you about changes to the service. We do not sell personal data or use patient data for advertising.

Who we share it with

Only service providers that help us run PhysioBook, under contracts that limit their use of the data:

• Hosting and storage providers (servers and backups).
• SMS provider, to send sign-in codes.
• WhatsApp Business messaging provider, to send the automatic reminders you turn on.
• Razorpay, to take subscription payments.
• Error-reporting and product-analytics providers.

We disclose data to authorities only where Indian law requires it.

How long we keep it

We keep your records while your account is open. When you delete your account, we delete your practice and patient data within 30 days, except billing records we must keep under tax law. Backups are overwritten within a further 30 days. See how to delete your account.

Your rights

You can ask to access, correct or erase your personal data, withdraw consent, and nominate someone to act for you. Patients who want to exercise their rights should contact their physiotherapist, who controls their records; we will help the physiotherapist respond.

Security

Data is encrypted in transit, each practice's records are isolated from every other practice at the database level, and staff access is limited, logged and reviewed.

Contact and grievances

Write to privacy@physiobook.in. Our Grievance Officer, PhysioBook replies within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.