Do My CheckUp

1. About this Privacy Notice

Do My Checkup is a Hospital Management System developed by WebSplend. This notice explains how personal information may be collected, used, stored, protected and shared through the HMS.

This notice applies to patients, healthcare professionals, hospital employees, authorised HMS users and other individuals whose information is processed through the platform.

2. Who is responsible for your information?

The healthcare institution (hospital, clinic, diagnostic centre or other healthcare provider) using Do My Checkup HMS is generally the Data Fiduciary for patient and healthcare information processed under its authority.

WebSplend, through its product Do My Checkup, acts as the technology and software service provider and generally operates as a Data Processor when processing information on behalf of the healthcare institution under its instructions.

WebSplend / Do My Checkup may independently act as a Data Fiduciary for personal information collected and processed for its own business operations, customer relationships, subscriptions and technical service administration.

For requests concerning patient records, individuals should contact their respective healthcare institution. For software-related privacy enquiries, they may contact:

Privacy Email: info@domycheckup.com
Grievance Email: grievance@domycheckup.com
Contact: +91 88943-45566

3. Information we collect and process

Depending on the services used, information may include:

• Identity and contact: Name, age, date of birth, gender, address, telephone number, email and patient identification number.
• Healthcare: Medical history, consultations, diagnoses, prescriptions, allergies, laboratory results, radiology records, admissions, discharges and treatment information.
• Appointments: Doctor details, appointment dates, visit history and scheduling information.
• Financial: Billing, payments, insurance, empanelment and related transaction records.
• ABDM: ABHA number or address, care-context references, linking requests, consent-related information and permitted health-information exchanges.
• Staff: Employment details, professional qualifications, assigned roles and authorised system activities.
• Technical: Login information, security events, IP addresses, access logs and device information.
• Documents: Uploaded reports, prescriptions, identification documents and other records relevant to the service.

Only information necessary for the applicable purposes should be collected and processed.

4. Why we use information

1. Patient registration, appointment scheduling and healthcare administration.
2. Clinical consultations, diagnosis, treatment and continuity of care.
3. Laboratory, radiology, pharmacy and other authorised healthcare activities.
4. Billing, payments, insurance processing and statutory accounting.
5. Authorised ABDM linking and health-information exchange.
6. Employee account administration and role-based access management.
7. System security, incident investigation, troubleshooting and audit.
8. Compliance with applicable legal, regulatory and medical record-keeping obligations.
9. Necessary communications relating to healthcare services and appointments.

Processing must have an applicable lawful ground, such as valid consent or a permitted legitimate use under applicable law. Additional consent will be requested where necessary for a separate purpose.

5. Consent and withdrawal

Where processing is based on consent, individuals may withdraw that consent using the privacy contact or an available request mechanism in the HMS.

Withdrawal will apply to the relevant consent-based processing, subject to applicable law. It will not automatically require deletion of records that must be retained for healthcare, legal or regulatory reasons.

A withdrawal request will be verified and processed in accordance with applicable requirements.

6. ABHA and ABDM integration

Where the HMS participates in the Ayushman Bharat Digital Mission (ABDM), ABHA identifiers, care contexts and health information will be processed according to the applicable ABDM framework.

Consent-controlled health-information exchange will take place only where an appropriate, valid authorisation exists and the required ABDM conditions are satisfied.

Participation in optional ABDM services and consent-based sharing must be distinguished from healthcare services that may be provided independently of such participation.

7. Information sharing

• Authorised healthcare personnel and departments.
• Relevant hospitals or branches where permitted.
• Approved IT, hosting and support service providers.
• Laboratories, pharmacies, insurers or other healthcare service participants where necessary and lawful.
• Authorised ABDM ecosystem participants within the applicable consent framework.
• Government, regulatory or judicial authorities where legally required.

Service providers processing information on behalf of the responsible institution must be subject to appropriate contractual, confidentiality and security obligations.

Personal information will not be used for unrelated marketing without an appropriate lawful basis.

8. Data storage and retention

Information is retained according to its purpose and applicable healthcare, financial, regulatory and legal requirements. Different categories of information may have different retention periods.

Once retention is no longer required, personal information will be securely deleted, anonymised or otherwise handled in accordance with applicable obligations.

Records subject to valid legal holds, ongoing disputes or mandatory medical record-retention requirements may be retained for the necessary period.

9. Data security

The responsible institution and its authorised service providers implement appropriate technical and organisational safeguards for personal information.

Depending on the system configuration, safeguards may include user authentication, role-based permissions, secure transmission, access logging, monitoring, backups and protection against unauthorised disclosure or alteration.

Security incidents involving personal information will be assessed and notified to affected individuals and competent authorities where required by applicable law.

10. Children's personal information

Information about children and individuals represented by legally recognised guardians will be processed in accordance with applicable consent, guardianship and healthcare requirements.

Parent or guardian verification will be used where required. Relevant statutory exceptions for necessary healthcare services will be respected.

11. Your privacy rights

Subject to applicable law, individuals may request:

• Information about the processing of their personal data.
• Correction, completion or updating of inaccurate information.
• Erasure of information where legally permissible.
• Withdrawal of consent for consent-based processing.
• Resolution of privacy grievances.
• Nomination of another individual to exercise applicable rights in specified circumstances.

Requests may require reasonable identity verification.

12. How to submit a request or complaint

For hospital-held patient information, individuals should contact the responsible healthcare institution through its published privacy contact.

Requests relating to Do My Checkup's own processing or technical privacy support may be sent to:

Privacy Contact: info@domycheckup.com
Phone: +91 88943-45566

Grievance Contact: grievance@domycheckup.com
Phone: +91 8580501114

Address: TDI Business Center, Sector 118, Near VR Punjab Mall, Mohali (SAS Nagar), Punjab 140307, India.

Privacy grievances will be handled within the applicable statutory time frame. Where available under applicable law, individuals may escalate unresolved matters to the Data Protection Board of India through its officially prescribed complaint mechanism.

13. International processing

Where personal information is processed or accessed outside India, the responsible entity will comply with applicable legal restrictions and relevant contractual and security requirements.

Details of applicable hosting and service-provider arrangements may be obtained from the responsible institution, subject to lawful disclosure limitations.

14. Changes to this notice

This notice may be revised to reflect changes in the HMS, applicable laws, healthcare services or data-handling practices.

Material changes will be communicated through appropriate channels, and the updated notice will display its version and effective date.