Privacy Policy

1. Introduction & Statutory Framework

This Privacy Policy explains the data governance practices of QWIKPRO PAYMENTS PRIVATE LIMITED ("QwikPro", "Company", "we", "us", or "our") (CIN: U66190GJ2023PTC144619) regarding the collection, storage, processing, transfer, and safeguarding of personal data through our platform at https://qwikpro.in and related applications, web portals, and software solutions.

This Policy is formulated in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act 2023"), read with relevant provisions of the Information Technology Act, 2000 ("IT Act") and applicable rules framed thereunder. The Digital Personal Data Protection Rules, 2025 have been notified and are subject to phased commencement. References in this Policy to obligations under the DPDP Act and Rules apply to the extent and from the date such provisions become applicable to QwikPro's processing activities. References to the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") are retained for transitional and historical context, subject to the overarching applicability of the DPDP Act 2023 and rules notified thereunder. Where healthcare workflows are enabled, this Policy operates in harmony with the digital health standards and consent guidelines established by the National Health Authority (NHA) under the Ayushman Bharat Digital Mission (ABDM).

2. Data Fiduciary & Data Processor Roles

Under the DPDP Act 2023, the legal role and obligations of QwikPro depend upon the specific product, integration, and purpose for which personal data is processed:

• QwikCare (Patient-Facing Personal Health Records Platform): Where QwikPro directly interfaces with individual users to manage user accounts, platform authentication, profile preferences, and platform-level features, QwikPro may act as a Data Fiduciary in determining the purpose and means of such platform processing. However, where health information originates from or is independently controlled by a hospital, clinic, medical practitioner, diagnostic laboratory, or pharmacy, primary clinical custody and responsibility remain with that respective originating entity.
• QwikDoc (Clinic & Doctor Practice Management SaaS): For patient clinical notes, electronic prescriptions, diagnostic attachments, and consultation records maintained by healthcare providers or healthcare facilities, the treating doctor, clinic, or hospital acts as the primary Data Fiduciary determining the clinical purpose and means of processing. QwikPro provides software infrastructure and acts as a Data Processor processing clinical records solely on the instructions of the healthcare provider and subject to applicable service agreements.
• QwikPharm (Pharmacy Management & POS SaaS): For customer profiles, prescription dispensing entries, inventory logs, and billing records maintained by licensed retail pharmacies, the independent pharmacy operates as the Data Fiduciary. QwikPro provides technology infrastructure and operates as a Data Processor acting on the pharmacy's instructions.
• QwikPe (Payment & Billing Software Intermediary): QwikPro provides technology infrastructure to enable digital billing, fee presentation, and transaction reconciliation. QwikPro acts as a technology intermediary and does not operate as an RBI-regulated bank or Payment Aggregator. Payment processing, card tokenization, and settlements are executed through authorized RBI-regulated payment aggregators and banking partners. QwikPro does not collect or store sensitive payment credentials such as card numbers, CVV codes, or UPI PINs.

3. Categories of Information We Collect

Depending on how you interact with our Platform and the specific services enabled, we may collect and process different categories of data:

4. Purposes of Processing & Assistive AI Workflows

QwikPro processes data solely for legitimate, authorized, and transparent objectives, including:

• Service Provisioning & Authentication: Establishing user accounts, verifying identity through OTPs, scheduling doctor consultations, enabling teleconsultations, and digitizing records in QwikCare.
• Ecosystem Order Routing: Enabling electronic prescription routing to independent licensed pharmacies (including seller-side workflows supporting Open Network for Digital Commerce / ONDC protocols, where applicable) and routing diagnostic requests to accredited laboratories.
• Billing & Payment Facilitation: Generating platform receipts, facilitating doctor fee presentation, and reconciling settlements via QwikPe and authorized RBI-compliant payment aggregators.
• Interoperability & ABDM Integration: Creating or verifying ABHA numbers, facilitating consent-governed health record discovery, and supporting HL7/FHIR-compliant health data exchange under NHA frameworks.
• Assistive AI & Document Processing: Providing layout-aware Optical Character Recognition (OCR), document parsing, and structured organization for user-uploaded health records. Such tools operate strictly as assistive, non-diagnostic features that require human verification by a Registered Medical Practitioner (RMP) or the user before clinical reliance. Identifiable clinical data is not utilized to train public third-party foundational models. For comprehensive details regarding model governance, human-in-the-loop safeguards, and clinical disclaimers, please consult our Health Data & AI Policy.
• Security & Fraud Mitigation: Monitoring for account compromise, verifying transaction integrity, preventing abuse, and safeguarding platform availability.
• Statutory Compliance: Fulfilling mandatory record-keeping requirements under the Drugs and Cosmetics Act, the IT Act, applicable tax legislation, and lawful court or regulatory directives.

5. Consent Architecture & Revocation

We operate on the foundational principle of explicit, informed, and revocable consent in alignment with Section 6 of the DPDP Act 2023:

• Granular Health Consent: Health data is not accessed, processed, or shared without explicit user authorization. Within ABDM-aligned workflows, users are presented with standardized consent notices detailing the purpose of exchange, the recipient healthcare entity, the requested health record types, and the validity duration.
• Revocation of Consent: You retain the legal right to revoke previously granted consent at any time via your platform privacy settings or by writing to our Grievance Officer. Withdrawal of consent operates prospectively; it does not affect the lawfulness of any processing carried out prior to withdrawal. Furthermore, consent withdrawal does not mandate the immediate erasure of data where retention is mandated or permitted by applicable law, statutory record-keeping requirements, security logging, or legitimate operational defenses.
• Impact of Withholding Consent: You are free to refuse non-essential data. However, declining required identity, clinical, or payment information may prevent the delivery of specific services, such as teleconsultation booking, prescription transmission, or ABHA record linking.

6. Disclosure & Ecosystem Partners

We never sell, rent, or trade your personal or health data to third-party commercial advertisers or data brokers. Data is disclosed strictly to authorized ecosystem participants under binding confidentiality terms and lawful grounds:

• Independent Healthcare Providers (Doctors & Clinics): Relevant clinical history, appointment details, and patient records are shared with the specific medical practitioner or healthcare facility you choose to consult.
• Licensed Fulfillment Pharmacies: Prescriptions and delivery details are transmitted to the independent licensed pharmacy selected for fulfillment (including pharmacies participating in ONDC-enabled workflows). The independent licensed dispensing pharmacy is solely responsible for prescription verification, professional validation, and dispensing in accordance with the Drugs and Cosmetics Act, 1940 and Pharmacy Act, 1948. QwikPro provides technology infrastructure and does not own pharmacy inventory or act as a dispensing entity.
• Accredited Diagnostic Laboratories & Phlebotomy Partners: Personal contact information, test orders, and scheduling details are shared with selected accredited diagnostic laboratories and authorized phlebotomy partners solely for sample collection, laboratory testing, report generation, and electronic report delivery.
• Open Network for Digital Commerce (ONDC) Workflows: QwikPro provides technology infrastructure supporting seller-side ONDC workflows and integrations. Order, catalogue, fulfillment, and delivery metadata are exchanged with authorized network participants (such as Buyer Applications, Gateways, and logistics carriers) strictly according to open protocol specifications, contractual arrangements, and applicable data privacy standards. Pursuant to the ONDC Network Participant Agreement, where participating sellers opt into network quality scoring or registry listings, merchant catalogue and fulfillment performance data may be shared with ONDC in accordance with ONDC Network Policy.
• Payment Aggregators & Financial Institutions: Transaction payloads and billing identifiers are shared with licensed payment partners to execute payment authorizations, settlements, and refunds.
• Cloud Infrastructure & Enterprise Software: Secure Indian cloud hosting providers, SMS gateways, and authentication vendors bound by strict contractual data processing terms.
• Client-Side Communication Links: Where our website displays links to connect via third-party communication services (such as WhatsApp), clicking such links initiates a client-side session governed by the respective third-party platform's privacy policy. QwikPro does not transmit platform database records to third-party messaging services without user initiation.
• Law Enforcement & Regulatory Authorities: Disclosed only where strictly mandated by applicable law, valid judicial orders, statutory notices, or binding governmental directives under Indian law.

7. Security Safeguards & Breach Protocols

QwikPro implements technical and organizational safeguards appropriate to the nature of the data and processing activities, designed to protect personal data against unauthorized access, loss, alteration, or disclosure:

8. Cookies & Tracking Technologies

QwikPro utilizes strictly necessary, functional, and session cookies and local storage tokens to maintain user authentication, remember interface preferences, and protect platform security. We do not deploy third-party commercial advertising cookies, tracking pixels, or behavioral profiling tools across our core digital health platform.

For full details regarding the types of cookies we use, their operational lifespan, and instructions on managing browser cookie controls, please consult our standalone Cookie Policy.

9. Data Retention & Archival Policies

Retention periods vary according to the nature of the data, the purpose of processing, applicable law, contractual requirements, and the operational role of QwikPro or the relevant independent healthcare or service provider:

• Provider-Controlled Clinical Records: Retention of medical records, consultation notes, and diagnostic attachments is governed primarily by the originating healthcare provider or health facility, applicable professional standards (such as National Medical Commission regulations or state clinical establishment rules), and the clinical necessity of care. Where hosted or processed via QwikDoc or QwikCare, records may be maintained for baseline periods (such as three (3) years or more as guided by professional standards or provider instructions), subject to applicable provider policies.
• Financial, Tax & Billing Records: Invoices, payment transaction reference IDs, and settlement logs are retained in accordance with applicable Indian taxation, Goods and Services Tax (GST), and corporate record-keeping laws (which may prescribe periods of up to eight (8) years).
• Platform & Security Logs: Authentication access logs, operational telemetry, and security audit trails are retained for system integrity, cyber defense, and fraud mitigation for operational windows appropriate to the system.
• Account Erasure & Statutory Overrides: Upon receiving and verifying an account erasure request, personal data that is no longer necessary for the purpose for which it was processed will be securely deleted or permanently anonymized, except where retention remains required or permitted under applicable law, statutory record-keeping rules, or legitimate dispute defense.

10. Data Principal Rights Under DPDP Act, 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you are entitled to exercise specific statutory rights in relation to your personal data processed by QwikPro:

• Right to Access Information (Section 11): You have the right to request a summary of the personal data being processed by QwikPro, the processing activities undertaken, and the identities of other Data Fiduciaries or Data Processors with whom personal data has been shared, subject to statutory limits.
• Right to Correction & Erasure (Section 12): You have the right to request the correction of inaccurate or misleading personal data, completion of incomplete records, updating of obsolete details, and erasure of personal data that is no longer necessary for the purpose for which it was processed, unless retention is mandated by law.
• Right of Grievance Redressal (Section 13, read with Section 8(10), as applicable): You have the right to readily available grievance redressal in respect of any act or omission by QwikPro regarding the performance of its obligations in relation to your personal data or the exercise of your rights.
• Right to Nominate (Section 14): You have the right to designate an individual who may exercise your rights as a Data Principal in the event of death or incapacity.
• Administrative Export & Interoperability Features: Where supported by the platform and applicable healthcare interoperability workflows, QwikCare may provide administrative export or portability features for user-authorized health information, including structured formats such as FHIR where applicable. Such functionality is a platform feature designed to advance patient health data access and is distinct from any statutory right under applicable data-protection law.

11. Protection of Minors' Information

In accordance with Section 9 of the DPDP Act 2023, our platform does not permit independent account registration by individuals under eighteen (18) years of age. Accounts or health profiles for children or minors may only be created, maintained, and operated by their lawful parents or legal guardians.

QwikPro does not engage in behavioral tracking, targeted advertising, or profiling directed toward minors, nor do we process children's data in any manner likely to cause detrimental effects on their well-being.

12. Data Localization & Cross-Border Transfers

In harmony with ABDM health data management guidelines and domestic data governance standards, all sensitive personal health records and core transaction data facilitated by QwikPro are hosted and stored on secure cloud servers physically located within the sovereign territory of the Republic of India.

Any cross-border data transfer complies strictly with applicable statutory requirements, governmental notifications, and Central Government transfer rules under the DPDP Act 2023.

13. Grievance Redressal & Designated Officer

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and Section 13 of the Digital Personal Data Protection Act, 2023 (read with Section 8(10), as applicable), data principals may submit privacy inquiries, exercise statutory rights, or lodge formal data governance grievances by contacting our designated Grievance Officer:

Formal privacy grievances are acknowledged within forty-eight (48) hours of receipt and addressed within thirty (30) calendar days (or statutory windows under prevailing rules). For our complete multi-tier escalation hierarchy, third-party grievance routing, and investigation protocols, please review our dedicated Grievance Redressal Policy.

14. Modifications to this Policy

QwikPro reserves the right to modify this Privacy Policy to accommodate new technical functionalities, statutory amendments, or regulatory guidelines. We will notify users of substantial modifications by updating the "Last Updated" timestamp at the apex of this document. We encourage users to periodically review this page to remain informed of our privacy and data governance practices.