Privacy Policy

We publish two iOS and Android apps: OduDoc (the patient app, bundle ID com.odudoc.patient) and OduDoc Pro (the professional app for doctors, nurses, pharmacists, lab techs and other clinical staff — bundle ID com.odudoc.doctor). Both are operated by Sarjudas Digital Trading and Escrow Services LLC and communicate exclusively with www.odudoc.com servers over HTTPS.

Device permissions we request

• Camera — for video consultations and uploading photos of prescriptions, lab reports, or wounds. Off by default; you grant access the first time you start a video call or photo upload.
• Photo library — to attach existing reports to a consultation. We never read photos in the background.
• Microphone — for video and voice consultations.
• Notifications — appointment reminders, doctor messages, lab-result alerts. You can disable any category in Settings → Notifications.
• HealthKit (iOS) / Health Connect (Android) — only if you opt in. Used to import heart rate, sleep, steps, and BP readings for your doctor. Revocable at any time from the OS settings.
• Location (Doctor app only) — when responding to a home-visit request. Not used for tracking.

What we do NOT collect

• Contacts list, SMS, call history, browser history.
• Advertising identifiers — we do not run ads.
• Background location — location is foreground-only, request-scoped.

Deleting your account from a mobile app

Open the app → Profile → Delete account. Or use the web page at odudoc.com/account/delete. Either route immediately tombstones your login. Clinical records may be retained for the period required by healthcare law (typically 7 years) in pseudonymised form — see the Data Retention section below.

Children and the apps

Neither app is targeted at children under 13. For pediatric care, a parent or guardian must create the account and add the child as a family member.

You can create or sign in to OduDoc with Google, Apple, or Facebook instead of a password. When you do, the provider gives us only the minimum profile needed to identify your account. We request the least-privilege scopes and we do not post to your social accounts, read your contacts, or access anything beyond the fields listed below.

OduDoc uses the third-party providers below to operate the service. Each is bound by a data-processing agreement (DPA) and, where required, a Business Associate Agreement (BAA). We share only the minimum data each provider needs, and none of them may use it for their own purposes. We give at least 30 days' notice before adding a new sub-processor that handles personal data.

The exact provider active for a given feature depends on your organisation's configuration and region. AI, video, and email use a failover chain, so the specific provider may vary per request; every provider in the chain is bound by the same terms above.

We retain personal data only as long as needed for the purposes it was collected for. Specific retention windows:

• Account data — for the lifetime of your account, plus 30 days after deletion (recovery window).
• Medical records & prescriptions — 7 years from the consultation date, or longer where local healthcare law requires (e.g. 10 years in parts of the EU, indefinitely in some US states).
• Payment records — 7 years for tax / accounting compliance.
• Server logs & analytics — 90 days, then aggregated.
• Marketing emails — until you unsubscribe, plus 30 days for the suppression-list record.

You may request earlier deletion at any time via the Rights section below; statutory medical-record retention may delay full erasure of clinical data.

OduDoc serves patients and hospitals globally. Our servers are located in the United States and the European Union, and your data may be transferred to, stored in, or processed in any country where we, our service providers, or our affiliates operate. We rely on Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework for these transfers.

If you are in the EU, UK, or EEA

Under the GDPR / UK GDPR you have the right to: access, rectify, erase, restrict, port, or object to processing of your personal data; withdraw consent at any time; and lodge a complaint with your supervisory authority (e.g. the ICO in the UK, the CNIL in France). The legal bases we rely on are contractual necessity (delivering the consultation you booked), legitimate interest (fraud prevention, service improvement), consent (marketing emails), and legal obligation (medical- record retention).

If you are a California resident

Under the CCPA / CPRA you have the right to know what personal information we collect, to delete it (subject to exceptions like medical-record retention), to correct it, to opt out of any "sale" or "sharing" of personal information, and to non- discrimination for exercising your rights. We do not sell your personal information. To exercise CCPA rights, email [email protected] with the subject line "CCPA request".

Other regions

We honour comparable rights for residents of jurisdictions including Canada (PIPEDA), Brazil (LGPD), the UAE (PDPL), Australia (Privacy Act), and India (DPDP Act 2023). Where local law grants you a stronger right than the rights listed above, that stronger right applies.

Data Protection Officer

For privacy-specific questions or to exercise any of the rights above, contact our DPO at [email protected]. We respond within 30 days as required under most data- protection regimes.