Privacy Policy

DAAP CareConnect (“CareConnect,” “we,” “us”) is a WhatsApp-based appointment booking and reminder platform built and operated by DaaPrime Tech, provided to hospitals and clinics (“Hospitals”) so their patients can book, reschedule, and manage appointments directly on WhatsApp, and so hospital staff can manage those appointments from a web dashboard.

This policy explains what information we collect, how we use it, and the choices available to patients, hospital staff, and doctors who use CareConnect.

From patients, via WhatsApp: your phone number, name, date of birth, and the appointment details you provide (department, doctor, date, time, and any reason or notes you share). We only collect what a message-driven appointment flow needs to actually book and remind you of your visit.

From hospital staff: the name, email address, and (hashed, never stored in plain text) password used to sign in to the hospital dashboard, plus a record of the actions taken through that dashboard for audit purposes.

From a hospital admin who connects Google Calendar: a hospital may connect one Google account (for the whole hospital, not per doctor) for the optional Google Meet tele-consultation feature. When an admin does this, we receive an OAuth access token and refresh token from Google, and the email address of the connected Google account. These tokens are encrypted before they are stored — see “Google Calendar integration” below for exactly what this access is, and is not, used for.

Documents: if a hospital chooses to upload patient reports or prescriptions through the dashboard, those files are stored on the hospital's behalf.

• To book, reschedule, cancel, and send reminders for appointments.
• To let hospital staff view and manage their hospital's own appointments and patients.
• To create a Google Calendar event with a Google Meet link for a tele-consultation appointment, when the hospital has connected a Google account.
• To maintain an audit trail of actions taken in the hospital dashboard, for security and accountability.
• To operate, secure, and improve the platform itself.

We do not sell patient or hospital data, and we do not use it for advertising.

Specifically, when a hospital admin connects a Google account on the hospital's behalf:

• We request access only to create calendar events (the calendar.events scope) — we cannot read your Gmail, Drive, or any other Google data.
• We create exactly one calendar event per tele-consultation booking (across any doctor at that hospital), containing the appointment time and a Google Meet link. We do not read, list, or otherwise access any of your other existing calendar events.
• The connection can be revoked at any time from the hospital admin's own Settings page inside CareConnect, or directly from your Google Account's third-party access settings.
• Disconnecting deletes the stored access/refresh tokens; it does not delete any calendar event already created.

We use the following third-party services to operate CareConnect, each only for the specific purpose below:

• Meta (WhatsApp Business Platform) — to send and receive the WhatsApp messages that power the booking flow.
• Google (Calendar API) — only for hospitals whose admin opts in, as described above.
• Our hosting and database providers — to run the application and store data securely.

We do not share patient or appointment data with any other third party, and never for marketing purposes.

We retain appointment and patient records for as long as needed to provide the service to your hospital and to meet applicable healthcare record-keeping requirements. A patient may request deletion of their data at any time by messaging “DELETE” to the hospital's WhatsApp number, or by contacting the hospital directly.

Passwords are hashed, never stored in plain text. Google Calendar access/refresh tokens are encrypted at rest. All traffic to and from CareConnect is encrypted in transit (HTTPS). Access to a hospital's data within the dashboard is scoped to that hospital's own staff and doctors.

Depending on your location, you may have rights to access, correct, or delete your personal information, including under India's Digital Personal Data Protection Act, 2023. To exercise these rights, contact the hospital you booked with, or reach us directly using the details below.

We may update this policy from time to time. We will update the “Last updated” date above when we do. Continued use of CareConnect after a change means you accept the updated policy.