Privacy Policy

At RxBot ("we," "our," or "us"), we are committed to protecting the privacy and security of the personal and medical information processed through our WhatsApp-based AI assistant. This Privacy Policy outlines how we collect, use, process, and safeguard data in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) of India and applicable telemedicine guidelines.

1. Information We Collect

RxBot operates as a data processor for registered medical practitioners. We explicitly collect WhatsApp phone numbers and prescription data to fulfill our core services. Down to specifics, we collect the following types of information:

• Doctor Information: Name, clinic details, WhatsApp mobile number, email address, and registration credentials.
• Patient Information: WhatsApp phone numbers, patient names, and demographic details explicitly provided by the doctor for prescription generation.
• Medical Data: Images of handwritten prescriptions, audio notes for transcription, generated digital prescriptions (PDFs), and structured medicine dosages processed via our AI models.

2. How We Use and Process Data

We process data exclusively for the purpose of providing the RxBot service to you:

• AI Parsing: Using advanced third-party LLMs (such as Anthropic Claude via API) to extract and structure handwritten, dictated, or typed medical information into verifiable digital records.
• Communication: Transmitting generated prescriptions (PDFs), follow-up messages, dosage reminders, and actionable buttons directly to patients via the WhatsApp Business API.
• Clinic Referrals: Orchestrating the automated referral module for doctors utilizing our system.

3. Data Sharing with Third Parties

To provide core functionalities, RxBot shares necessary data fragments safely with trusted sub-processors:

• Meta (WhatsApp Business API): Used strictly for message delivery. All communication flows through Meta's secure cloud infrastructural guardrails.
• AI Partners (e.g., Anthropic, OpenAI): For interpreting messy handwriting via OCR or parsing voice notes. Crucially, we utilize zero-retention enterprise API endpoints where applicable, meaning third parties do not utilize your patients' PHI to train their foundational models.
• Database Services: Hosted natively on secure infrastructure (e.g., Supabase) with geographic constraints favoring Indian data localization compliances.

4. Data Retention and Security

Prescription images and audio buffers sent to our WhatsApp number are temporarily processed in protected volatile memory and securely deleted after successful PDF generation and delivery. The finalized digital prescriptions and metadata are retained in an encrypted database strictly to provide historical access to the Doctor requesting it. We deploy industry-standard TLS encryption for data in transit and AES-256 for data at rest.

5. Doctor's Responsibility and Consent

As the "Data Fiduciary" (under DPDPA 2023), the Doctor holds the primary responsibility to secure explicit and informed consent from the patient regarding the digital processing and transmission of their medical data via WhatsApp. RxBot, as the "Data Processor," acts strictly upon the Doctor's commands.

6. User Data Deletion Rights

Users can request deletion of their data at any time. Patients and doctors retain full rights to request the permanent deletion of their digital records, opt-out of follow-up messages, or export their data. Data deletion requests can be invoked directly via the WhatsApp interface or by emailing our support team, which our automated cleanup scripts and routines will honor expeditiously.

7. Contact Us

For questions or concerns regarding these privacy practices, or to report a data grievance, contact us at:

Business Name: RxBot
Email: care@rxbot.in