Security and privacy
How we protect Clinic and patient data, in plain terms
A Clinic's trust rests on keeping patient information safe. Here is what RevisitMD actually does to protect it, described plainly, not as a certification we hold.
Our practices
Per-clinic data isolation
Every request in our backend is scoped to the Clinic that owns the data. One Clinic's patients, visits, and messages are never visible to another Clinic.
Encryption in transit
All traffic to and from RevisitMD runs over HTTPS, so data moving between your browser and our servers is encrypted on the wire.
A database that's not on the public internet
Patient records live in a database that only our own backend can reach. It is not exposed directly to the internet.
Official WhatsApp integration
Patient messages are sent through Meta's own WhatsApp Cloud API, the official channel WhatsApp provides to businesses, not a scraped or unofficial integration.
Password protection
Account passwords are stored using industry-standard hashing. We never store or can see a password in plain text.
Regular backups
Patient data is backed up nightly to separate cloud storage, so a problem with our server doesn't mean losing a Clinic's records.
The Clinic owns its patient records
Patient records belong to the Clinic that created them, not to RevisitMD. We process that data on the Clinic's behalf, as described in our Terms.
Built with DPDP Act principles in mind
Purpose-limited collection, data handled on the Clinic's behalf, and a process for honouring access, correction, and erasure requests under India's DPDP Act, 2023.
Healthcare Data & Privacy at RevisitMD
Patient health information needs a different standard of care than ordinary account data. Here's how we handle the parts specific to healthcare, in the same plain terms as above.
DPDP Act
RevisitMD is built around India's Digital Personal Data Protection Act, 2023, not a foreign standard like HIPAA. That means purpose-limited collection, a named Grievance Officer, and a working process for access, correction, and erasure requests.
Patient consent
Before a patient goes into RevisitMD at all, the Clinic has to explicitly confirm that patient (or their guardian) has consented to WhatsApp contact and to their health information being processed on the Clinic's behalf. This is captured per patient, with a timestamp, and enforced at the point of entry, not a one-time terms checkbox.
WhatsApp messaging
Messages are sent through RevisitMD's own verified WhatsApp Business Cloud API integration, Meta's official channel, not an unofficial or scraped one. Each message states the sending Clinic and doctor's name clearly, so a patient always knows which clinic is messaging them.
Data retention
Patient and Clinic data is kept for as long as a Clinic's account stays active, plus a reasonable period afterward in case of reactivation or an export request. It isn't held indefinitely by default.
Data deletion
A Clinic, or a patient through their Clinic, can request deletion of specific patient records at any time, subject to any legal minimum retention period a Clinic must follow for medical records. Requests can be made directly through our data rights request form.
The full details
This page is a plain-language overview. For exactly what we collect, how long we keep it, who we share it with, and your rights under the DPDP Act, read our Privacy Policy.