Legal
Privacy policy
What RxKite collects, why, where it is kept, who it is shared with, and your rights.
This policy explains how RxKite ("we") handles personal data when doctors ("you") use the service at rxkite.com. It is written in line with India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and its Rules of 2025, the Information Technology Act, 2000 and its rules on sensitive personal data, and the directions of CERT-In.
RxKite is run by RxKite. Our grievance officer is Dr. Shounak Pal (dr@rxkite.com).
Three kinds of data
Your account data. Your name, email, mobile number, medical registration number and council, qualifications, clinic details, signature and stamp images, and payment records. If we ask you to confirm your registration, also the registration certificate and photo ID you send. If you sign in with Google, also your Google account's email and the ID Google gives that account. We are responsible for this data.
Affiliates' data. If you apply to our affiliate programme, we keep your name, email, mobile and what you tell us in your application to decide on it, and delete the application a year after we decide. If you join, we keep your name, email, mobile, PAN and payout details (UPI ID or bank account, stored encrypted) to pay you commission and to meet tax law, for as long as tax law requires.
Your patients' data. The patients you register, the prescriptions you write, the documents you attach to them, the lab results you enter for them and the chats you save with them. For this data you are the data fiduciary and we are your data processor: we handle it only on your instructions, only to provide the service to you. What we promise you as your processor, and what you are responsible for towards your patients, is set out in the terms of use.
In short, tell your patients that you keep their records electronically with a service provider, as you would tell them you keep paper records, and keep the records your profession requires you to keep.
What we collect, why, and on what basis
| Data | What we use it for | Why we may |
|---|---|---|
| Name, email, mobile number, password (stored only as a one-way hash), Google sign-in ID if you use it | Your account: signing you in, codes, receipts, telling you about your account | Your consent when you sign up, to provide the service you ask for |
| Medical registration number and council, qualifications, clinic details, signature, stamp and logo | Printing them on your prescriptions; checking that RxKite is used by registered doctors | Your consent, to provide the service |
| What the NMC's public register shows for your registration number, and the registration certificate and photo ID you send if we ask | Checking that the registration is yours, so that no one prescribes in another doctor's name | Your consent, to provide the service, and keeping patients safe |
| Payments, plan and invoices | Billing you, tax records | Your consent and the law (tax records) |
| Sign-ins, the address they came from, changes you make, which records were opened and by whom | Security, finding misuse, answering a complaint or an investigation | The law (CERT-In's directions, the DPDP Rules) and keeping your patients' data safe |
| What you agreed to and when | Showing that you agreed, if asked | The law |
| News and offers by email | Telling you about new features and offers | Only if you ticked the box for it, or turn it on in Settings |
| Your patients' records | Only to provide the service to you, on your instructions | You decide, as their data fiduciary (below) |
We do not sell data, show advertising in RxKite, or use patient data to train any model. We never use your patients' data for any purpose of our own, and it never reaches the analytics and advertising tools described below. We look at usage only in totals, such as how many doctors were active today, and never inside prescriptions.
Promotional emails are your choice. They are a separate, optional box at sign-up, off unless you tick it. Each has an unsubscribe link, and you can turn them off or on in Settings → Your data; emails about your account, such as sign-in codes and receipts, still come. We never send them to your patients.
Who else handles data
Only the providers needed to run the service, each bound by its terms to use the data only to provide its service to us and to keep it secure:
| Provider | What it does |
|---|---|
| Oracle Cloud Infrastructure | Runs the application, on a server in its Mumbai region, India |
| Akamai (Linode) | Runs the application, on a second server in its Mumbai region, India |
| PlanetScale | Hosts the database (PostgreSQL) on Amazon Web Services in Mumbai, India: accounts, patients and prescriptions |
| Cloudflare | Carries all traffic to and from rxkite.com: domain name service, content delivery, the firewall and the secure link to our servers, so every page and request passes through it, encrypted. Also stores files: prescription PDFs, letterheads, signatures, stamps and attached documents |
| Bunny.net | Storage for encrypted backups |
| Amazon SES and Resend | Send email: sign-in codes, password resets and the prescriptions you choose to email. Amazon SES (Amazon Web Services) sends them, and Resend takes over if SES cannot. Our news and offers to you go by Resend: your name and email address |
| Razorpay | Take payments when you pay. We never see or store your card details |
| Meta (WhatsApp) | Delivers the prescriptions and consultation links you choose to send on WhatsApp from RxKite's number: the patient's mobile number and name, your name and clinic contact, the visit date, and the prescription PDF or the link. Meta keeps each message for up to 30 days to deliver it. Nothing else about your patients is sent, and messages are never used for marketing |
| Google (Sign in with Google) | Only if you choose to sign in with Google: Google confirms it is you and tells us your Google account's name, email and account ID. We ask for nothing more, so we never see your Gmail, Drive, contacts or anything else in your Google account |
| hCaptcha, Google reCAPTCHA or Cloudflare Turnstile | One of these checks that sign-ups, sign-ins, password resets and feedback from visitors who are not signed in come from people, not bots |
| Google and Cloudflare (STUN servers) | When a video call or live chat starts, your browser and your patient's each ask one of these public servers for their own internet address, so the two can connect directly. The servers see those addresses, never the call or the chat |
| Sentry | Receives a technical report when something in RxKite breaks, and how long pages take to load, so we can fix problems. We set it up so that reports leave out patient and prescription details, what you type into forms, email addresses, phone numbers and IP addresses |
We also keep an encrypted copy of our backups on our own backup server in India. We update this list before a new provider starts handling your patients' data.
To check a registration, we search the National Medical Commission's public Indian Medical Register (nmc.org.in) with the registration number and council, and nothing else about you. We keep what it shows for that number: the name, council, year and qualification, never the date of birth, parent's name or address the register also shows.
We disclose data to authorities only when Indian law requires it.
Where data is kept
The application runs on two servers in Mumbai, one at Oracle Cloud and one at Akamai (Linode), and the database in Amazon Web Services' Mumbai region, all in India. Our own server in India runs the database updates and backups. Some of the providers above store or process data outside India: our encrypted backups are stored in Singapore (Bunny), and email, WhatsApp, Cloudflare's network, Google's services and error reports (Sentry) may process data in other countries where those providers operate. So your account data and your patients' data may be stored or processed outside India. The DPDP Act allows this, except to countries the Government of India restricts, and we will not keep data in such a country.
Backups are encrypted before they leave our server, with a key the storage providers do not hold. How we protect data is described on our security page.
Cookies and visitor statistics
We use one essential cookie to keep you signed in, and one to remember a trusted device if you ask us to. When you first arrive from a link or another website, a first-party cookie notes where you came from (for example "google / organic" or the name of a campaign) for up to 60 days; if you sign up, that label is kept with your account so we can tell which of our outreach works. It holds no personal information. If you opened the link of one of our affiliates (people we accept into our programme to introduce RxKite to doctors), a first-party cookie remembers which affiliate for up to 60 days; if you sign up, your account is linked to that affiliate so they can be paid a commission. The affiliate sees only your initials, when you joined and whether you are on a paid plan, never your contact details, patients or prescriptions. Apart from Google's cookies described below, which load only if you allow them, there are no advertising or third-party tracking cookies.
On our public pages, such as the home page, pricing and articles, we count visits with Plausible Analytics. It sets no cookies and does not keep your IP address or build a profile of you: it records the page, the site you came from, your browser, operating system, device type and country, so we see totals, not individuals. It never runs inside the app, where you work with patients and prescriptions, or on any page while you are signed in.
Google Analytics and our ads. When we advertise, we may also use Google Analytics and Google Tag Manager on the public pages, to see how visitors find us and which of our ads bring doctors to the site. They never run while you are signed in. Google sets its own cookies, which recognise your browser when you come back, and receives the page you are on, the site or ad you came from, and your browser, device and approximate location. Google handles this under its own privacy policy and may process it outside India. We do not use it to show you ads based on your browsing.
Google's tools load only if you allow them. While we use them, a small bar on the public pages asks once; until you choose Allow, they do not load. If you sign up after allowing them, our server tells Google Analytics that a sign-up happened, identified only by the random ID Google gave your browser: never your name, email, mobile or anything you enter in the app. Google's tags never run on the sign-up form or inside the app, and never receive patient data.
To change your answer, use the link about Google Analytics at the foot of any public page: Google's tools then stop loading in your browser and their cookies are removed, or start again. Blocking cookies in your browser also stops them.
Video calls and live chat
When you start a video call or a live chat with a patient, we keep a record that you did: which patient, when it started and when it ended. The link you send holds a random code; we keep only a one-way hash of it, which cannot be turned back into the link. To find each other, your browser and your patient's pass a few small setup messages through our server. They are sealed with a key that is part of the link, and we delete them when the call ends. Browsers do not send that part of the link to us; if you have us email or WhatsApp the link for you, the key passes through our server once and is not stored.
The video, sound, messages and files then go directly between the two devices, encrypted end to end. We never receive them, and we do not record calls. A chat is kept only if you save it when you end it: its messages are then stored with the patient, and the attachments you tick are added to the patient's documents. If you destroy a chat, we keep only a line in the audit log saying that a chat took place, with no words from it.
Your patient does not need an account. When they open the link, our server sees their IP address and browser, as for any visit to the site. The call and chat pages run no visitor statistics or Google tools, and set no cookies.
The free pad maker
The free prescription pad maker works in your browser. What you type into it, and any logo you add, stay on your device (in your browser's storage, so the pad is still there when you come back) and are never sent to us.
If you pay ₹10 for a pad without the rxkite.com line, you pay Razorpay directly, and we receive the payment's reference and amount. Your browser also sends us a one-way fingerprint of the registration number on the pad, so the payment can cover pads with that number and no other; we store it only after scrambling it again with a secret key, so it cannot be turned back into the number. We do not learn your name, clinic or anything else on the pad. These payment records are kept as long as tax law requires.
Feedback you send us
If you use the Feedback button, we keep what you write, the rating and the email address you choose to give, the page you sent it from (without any patient or record identifier), and your browser. If you are signed in, your feedback is linked to your account and deleted with it. We do not keep your IP address, take screenshots or read anything else on the page. Each message is emailed to us through our email provider. Please do not include patient details in feedback. You can ask us to delete your feedback at any time.
How long we keep it
- Your account and your patients' records: as long as your account is open. If you delete your account, your data is removed from the live service after 30 days.
- Backups: deleted data leaves our backups within 90 days, as they rotate. If backups were failing for that long, the last good backup is kept until a newer one exists, so that the service can be restored; it is encrypted and used for nothing else.
- Signed prescriptions: the PDF copy of each signed prescription is kept in locked storage for at least 10 years from signing, so a medical record cannot be changed or lost. After your account is deleted it can no longer be opened in RxKite; we retrieve one only for a request we must answer by law (from you, your patient, a court or a regulator), and it is deleted when its lock ends.
- Security log: the log of sign-ins, changes and which records were opened is kept for at least a year, as CERT-In's directions and the DPDP Rules ask. When an account is deleted, its entries and a short closure record (your name, email, mobile and registration) are kept for a year from when each happened, used only to answer security, legal or regulatory requests, and then reduced to what was done and when.
- Payment records: as long as tax law requires.
- Voice messages for your waiting room's TV (Speak on the TV): deleted within 10 minutes of being sent.
- Registration certificate and photo ID, if we ask for them: deleted 90 days after you send them. If we block an account because its registration is not the account holder's, they are kept, as the reason for the block, for as long as it lasts.
- What you agreed to: as long as your account is open and a year after, to show what was agreed.
- Requests and complaints about personal data: three years after each is closed, to show how it was handled.
RxKite is not an archive for records you must keep after you leave. Before you delete your account, we ask you to confirm that you have downloaded the records you need, and you can download them at any time until the deletion date.
If there is a data breach
If a breach affects your patients' data, we email you as soon as we know, with what we know and what we are doing about it. We also turn on a button in RxKite that lets you email a notice to every patient who has an email address on file, and help you inform the Data Protection Board of India, as the law requires of you. The details are in the terms of use.
If a breach affects your own account data, we tell you and the Data Protection Board of India as the DPDP Act requires: what happened, what it may mean for you, what we have done, what you can do, and whom to ask. We report security incidents to CERT-In within 6 hours, as its directions require.
Your rights
Under the DPDP Act you can:
- See and get a copy of your data, and a summary of what we hold, what we do with it and who handles it: Settings → Your data → Download all your data, or ask us.
- Correct or complete it: in Settings, or ask us.
- Erase it: delete your account in Settings → Your data; we keep only what the law asks, as set out above.
- Withdraw your consent at any time, as easily as you gave it: promotions in Settings or by the unsubscribe link; for everything else, by deleting your account or writing to us. It stops our use of your data from then on; it does not undo what was done before. As we cannot run your account without your data, withdrawing consent to it closes your account.
- Name a nominee, who can use these rights for you if you die or cannot act yourself: Settings → Your data → Nominee. We ask them for proof before acting, and they never get your password or your patients' records.
- Complain to us, and if you are not satisfied, to the Data Protection Board of India.
Your patients' rights. Your patients exercise their rights through you, as their data fiduciary. On a patient's record you can download a copy of that patient's records for them, correct them, and erase their data when they ask (keeping, if you choose, the signed prescriptions and bills the law asks you to keep). A printable privacy notice for your patients is in Settings → Your data. If a patient writes to us, we pass the request to you and help you respond.
Children. Your patients may be children. You collect their data, and a guardian's name, to treat them; the DPDP Rules let a doctor or clinic do this without a separate verified consent from the parent, to the extent needed to protect the child's health. RxKite never tracks children, shows them advertising or uses their data for anything else. Accounts are only for registered doctors, front desk staff and affiliates, who are adults.
Contact and grievances
For any question about your data, to use your rights, or to raise a grievance, use the form on the contact page, or write to support@rxkite.com (or getrxkite@gmail.com if that address does not reach us). Our grievance officer is named on the contact page. We acknowledge a request at once and answer within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
To report a security issue, see our security page. We do not run a bug bounty programme.
Changes
If this policy changes in a way that matters, we will tell you by email or in the app before the change applies, and ask you to agree to it in the app. We keep a record of which version you agreed to and when.