Privacy Policy

1. The data we collect

Patients

• Account: your name, mobile number, email address and password. We store your password only in a scrambled (hashed) form that no one at Longlyf can read.
• Consent: when you accepted our Terms and this Policy, which version, and the IP address used.
• Bookings: the patient's name, age, gender and mobile number (you or a family member), the doctor, clinic, date, token number and what happened to the booking (seen, cancelled, missed).
• Family members you save for quicker booking.
• Location: the district you choose, and your device's location only if you allow it, to show nearby clinics (this stays on your phone). If you also switch on "Use my approximate location" (Profile → Notifications), your phone sends us an approximate area of about 1 km, never your exact place, so we can tell you about doctors and offers near you. Switch it off at any time and we delete it.

Clinic owners, clinic staff and doctors

• Clinic details: name, address, district, GPS location, phone, email, photos, registration or licence details and the owner's name.
• Doctor details provided by the clinic owner: name, qualification, specialty, medical council registration number, experience, gender, phone, fees and schedules.
• Partner Agreement records: who signed, their designation, when, from which IP address, and the version signed.

Longlyf field executives and admins: name, work contact details, role and the actions taken in the Service.

Everyone: technical data such as app version, device type, IP address, and sign-in and security logs. The website uses no advertising or tracking cookies.

Phone notifications: if you allow notifications, a notification address for your phone and your district, so we can tell you about your bookings and about new doctors near you. It is removed when you sign out or delete your account. For offers and notices shown in the app, we count whether you saw, tapped or closed them, to know how many people they reached.

Health information. A booking can show that someone visited a particular kind of doctor, so we treat booking data as sensitive. We do not collect diagnoses, prescriptions, test reports or other medical records; the clinic keeps its own records.

2. Why we use it

• To create and secure accounts, and verify that sign-ins are genuine.
• To show clinics and doctors, make, change and cancel bookings, and give the clinic the details it needs to see the patient.
• To tell you about your bookings, for example when a doctor becomes unavailable; about new doctors in your district; and, only if you agreed, health tips and offers. You can change the last two in Profile → Notifications.
• To onboard and approve clinics, and to keep a record of the Partner Agreement each clinic signs.
• To prevent fraud and misuse, keep the Service secure, and investigate complaints.
• To understand, using combined statistics that do not identify you, how the Service is used and improve it.
• To comply with the law, court orders and lawful requests from authorities.

We process personal data on the basis of your consent, which you give when you sign up or book, and for the legitimate uses the DPDP Act allows, such as meeting legal obligations, responding to medical emergencies, and for purposes you have voluntarily shared the data for. We send promotional messages only if you opt in.

3. Who we share it with

• The clinic and doctor you book with. They receive the patient details for that booking. Each clinic is responsible, as a separate Data Fiduciary, for how it uses and keeps the data it receives and its own medical records.
• Our service providers (Data Processors) who host our servers and send our emails and messages, only to run the Service, under written confidentiality and security obligations. Phone notifications are delivered through Google's Firebase Cloud Messaging, so the short notification text passes through Google's servers, which may be outside India. Notifications about your own bookings never name a specialty or a health problem. When a clinic pays for an offer shown in the app, it is marked "Sponsored", and the clinic gets only totals (how many people saw it, tapped it or booked), never your name or contact details.
• Authorities, when required by law, for example in response to a court order or a lawful request under the Information Technology Act, 2000.
• A buyer or successor, if Longlyf's business is merged or sold, who must protect your data under this Policy.

We do not sell personal data, and we do not use it for third-party advertising.

4. Where your data is stored

Your data is stored on servers located in India. If we ever need to transfer data outside India, we will do so only as permitted by the DPDP Act and the rules made under it.

5. How long we keep it

• Account data: while your account is active.
• When you delete your account (Profile → Delete account): we remove your name, email and mobile number from your account and cancel your upcoming bookings, normally straight away and in any case within 30 days. Records of past visits that clinics must keep under law may remain with the clinic.
• Security logs: for 180 days, as directed by CERT-In, and then deleted.
• Partner Agreement and approval records: for as long as the clinic is on Longlyf and for the period the law requires afterwards (generally up to 8 years for legal and tax purposes).

We may keep data for longer if the law requires it or it is needed to resolve a dispute.

6. How we protect it

We use reasonable security practices, including encrypted connections (HTTPS) for all data in transit, hashed passwords, access limited by role and district, two-step sign-in for staff, and an audit log of every admin action. No system is completely secure; if a personal data breach happens, we will inform the Data Protection Board of India and the people affected as required by the DPDP Act, and report cyber security incidents to CERT-In as required.

7. Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data we hold about you and how we use it;
• correct, complete or update your data. You can edit most of it in the app;
• have your data erased when it is no longer needed. You can delete your account in the app;
• withdraw your consent at any time. This does not affect what we did before, but it may mean we can no longer provide the Service;
• nominate another person to exercise these rights if you die or become unable to;
• have your grievance addressed by us, and, if you are not satisfied, complain to the Data Protection Board of India.

To use any of these rights, email grievance@longlyf.in from your registered email address, or contact us using the details below. We may need to confirm your identity first.

8. Children

Longlyf accounts are for adults. A parent or lawful guardian may book visits for a child from their own account, and by doing so gives consent for the child's booking details to be processed for that visit. We do not track children or show them targeted advertising.

9. Changes to this Policy

If we change this Policy, we will update the date at the top. For important changes we will tell you in the app before they take effect and ask for your consent again where the law requires it.

10. Grievance Officer and contact

If you have a complaint about the Service, about content on it, or about how we handle your personal data, please contact our Grievance Officer:

• Mr. Sekh Imtiazuddin, Grievance Officer, Longlyf Medtech Private Limited
• Email: grievance@longlyf.in
• Phone: +91 99333 33777 (Monday to Saturday, 10 am to 6 pm)
• Address: West Bengal, India

We will acknowledge your complaint within 24 hours and try to resolve it within 15 days of receiving it, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Consumer Protection (E-Commerce) Rules, 2020. Please tell us your name, phone number, the booking or account concerned, and what went wrong.