Privacy Policy

WaitingMate ("We", "Us", "Our", "Company") respects your privacy and is committed to protecting the personal data of our users ("User", "You", "Data Principal"). This Privacy Policy explains how we collect, process, store, disclose, and safeguard your personal information when you access or use our website, mobile applications, queue management services, appointment booking systems, and related technology solutions (collectively, "Services").

This Privacy Policy is formulated in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 ("IT Act"), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") of India.

1. Roles of Parties (Data Fiduciary & Data Processor)

Under the DPDP Act 2023, WaitingMate acts as a Data Fiduciary regarding the account, registration, and usage data collected directly from Users. For clinical notes, prescriptions, and patient records uploaded independently by healthcare vendors (doctors/clinics), the respective Vendor establishment acts as the primary Data Fiduciary, and WaitingMate processes such data as a Data Processor under vendor instructions.

2. Categories of Data We Collect

2.1 Personal Data Provided Voluntarily

We collect personal information that you provide when registering an account, booking an appointment, joining a virtual queue, or interacting with Services:

• Identity & Contact Data: Name, mobile number, email address, gender, age, profile photo.
• Account Credentials: Passwords, OTP verification tokens, login credentials.
• Service & Appointment Records: Token numbers, service requested, appointment date/time, vendor preference, queue status history.
• Clinical & Prescription Data: Medical notes, chief complaints, symptoms, advice, and digital prescriptions created or received by you through vendor consultations.
• Payment Metadata: Transaction reference IDs, payment status, bill amounts (raw credit card/UPI details are handled securely by RBI-authorized Payment Gateways).

2.2 Automatically Collected Technical Data

When you access our Services, our servers automatically record technical log data:

• Device identifiers (IP address, device model, operating system, browser type).
• Approximate geolocation data (city/state level) to locate nearby vendors.
• Platform interaction logs (pages viewed, click activity, error logs, session duration).
• Cookies and local storage data to preserve session states and dark mode preferences.

3. Legal Grounds & Purpose of Data Processing

We process your personal data solely for legitimate, specified, and lawful purposes based on your explicit consent or legal necessity:

• To issue virtual queue tokens, manage digital appointment slots, and notify you of live queue status.
• To deliver real-time notifications via SMS, WhatsApp (Fast2SMS API), and email regarding token turn updates and digital invoices.
• To maintain user accounts, authenticate logins via OTPs, and prevent unauthorized access.
• To provide medical vendors with necessary patient identity details for consultation fulfillment.
• To comply with statutory legal mandates, regulatory compliance, and law enforcement requests under Indian law.
• To detect, prevent, and mitigate fraud, security incidents, and technical failures.

4. Data Sharing and Disclosure Rules

WE DO NOT SELL, RENT, OR TRADE YOUR PERSONAL DATA TO THIRD-PARTY ADVERTISERS OR DATA BROKERS.

We share your personal information strictly on a need-to-know basis under the following limited circumstances:

• With Vendors (Service Establishments): When you join a queue or book an appointment with a doctor, clinic, or salon, your name, phone number, and service request are shared with that specific Vendor to enable service delivery.
• With Service Providers: Trusted third-party cloud infrastructure hosts, SMS gateway providers (e.g. Fast2SMS), and payment processors operating under strict data protection contracts.
• For Legal & Law Enforcement Obligations: We may disclose personal data if required by a court order, government directive, police investigation, or statutory mandate under Indian law.
• Business Reorganization: In the event of a merger, acquisition, or asset sale, user data may be transferred subject to the acquiring entity adhering to this Privacy Policy.

5. Data Security & Reasonable Security Practices

In compliance with Section 43A of the IT Act and SPDI Rules 2011, WaitingMate maintains robust technical, physical, and organizational security measures to prevent unauthorized access, alteration, disclosure, or destruction of data:

• Encryption: Data in transit is protected using SSL/TLS 1.3 encryption protocols.
• Access Control: Strict role-based access controls and multi-factor authentication for administrative databases.
• Infrastructure Security: Enterprise cloud servers with automated firewalls, intrusion detection, and periodic vulnerability scanning.

While we implement state-of-the-art security safeguards, no electronic transmission over the Internet can be guaranteed as 100% immune. Users are advised to protect their device PINs and OTPs.

6. Data Retention Period

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, maintain active user accounts, resolve disputes, or comply with statutory record-keeping periods prescribed by Indian tax, medical, and IT laws. Upon expiry of retention requirements or account deletion request, data is securely erased or anonymized.

7. Rights of Data Principals under DPDP Act 2023

As a Data Principal in India, you hold specific statutory rights regarding your personal data:

• Right to Access: Request a summary of personal data being processed by us.
• Right to Correction & Erasure: Request correction of inaccurate data or deletion of your personal account data (subject to legal retention obligations).
• Right to Withdraw Consent: Withdraw your consent for non-essential data processing at any time.
• Right to Grievance Redressal: Register complaints regarding data processing with our Data Protection / Grievance Officer or the Data Protection Board of India.

To exercise any of these rights, please submit a written request to our Grievance Officer at privacy@waitingmate.com.

8. Children's Personal Data

WaitingMate does not knowingly collect or process personal data of children under 18 years without verifiable consent from their parent or lawful guardian. Parents or guardians may manage appointment queues on behalf of minors under their account profile.

9. Cookies and Local Storage

We use essential functional cookies and HTML5 localStorage to preserve login sessions, theme preferences (light/dark mode), and recent branch selections. You can disable non-essential cookies via browser settings, though certain queue features may require essential session cookies to function properly.

10. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect technological updates, legal modifications, or platform enhancements. Updated versions will be published on the Platform with a revised "Last Updated" timestamp. We encourage you to review this page periodically.

11. Data Protection & Grievance Redressal Officer

If you have any questions, concerns, or complaints regarding the processing of your personal data or wish to exercise your statutory rights under the DPDP Act 2023, please contact our designated Grievance Officer:

We acknowledge data privacy grievances within 36 hours and resolve inquiries within 15 working days as mandated under Indian IT Rules & DPDP Act 2023.