Legal

Privacy Policy

Version 2 · Last updated 12 October 2026 · हिंदी में पढ़ें

This page explains, in simple words, how Fix My Appointment uses your personal details: what we collect, why, who can see it, how long we keep it, and your rights. It is our privacy policy, and our notice to you under India's Digital Personal Data Protection Act, 2023.

In short

We use your details to run your account and your clinic visits, and to send you messages about them.
We never sell your details, and we never use your medical records for ads.
You can see, correct or delete your details, and withdraw your consent, at any time.

1. Who we are

Fix My Appointment is run by HYLISH ("we" and "us"). We decide how the details in your Fix My Appointment account are used.

The clinics and doctors you visit write your visit records: your appointments, vitals and prescriptions. These are the clinic's medical records, and the clinic is responsible for them. We keep them safely for the clinic, and use them only to run the service.

2. What we collect, and why

We collect only what we need. Here is each kind of detail, why we need it, who can see it, and how long we keep it.

Your details	Why we need them	Who can see them	How long we keep them
Your account: name, email, mobile number, and your password or Google sign-in	To make your account and sign you in, and to check it is really you with a code by SMS or email. We never see your password.	You. Our team, only when helping you.	Until you delete your account.
Your patient details: name, age, gender, mobile, email, address, city and state, and your Patient ID	So the clinic knows who you are and can reach you, and to print some of them on your prescriptions.	You, and the clinics and doctors you book.	Until you delete your account. The clinic keeps them on its visit records (section 6).
Your appointments: the doctor, clinic, date and time, your serial number, and any note you write for the doctor	To book your visit, run the clinic's queue, and send you confirmations and reminders.	You, and the clinic and doctor you booked.	The clinic keeps them as medical records (section 7).
Your visit records: vitals (such as blood pressure and weight), diagnosis, prescriptions and tests, written by the clinic	So your doctor can treat you, and you can see and download your prescriptions.	You, and the clinic and its doctors. A pharmacy linked to the clinic sees what it needs to give you your medicines. Doctors at other clinics only if you agree (section 3).	The clinic keeps them as medical records (section 7).
Your consents: when you agreed to this policy and to which version, and your choice about sharing with other clinics	To show what you agreed to, and when.	You, and our team.	Kept after you delete your account, as proof. They hold no medical details.
Messages and calls: the SMS, WhatsApp messages and emails we send you, your WhatsApp chats with Ria, Ria's phone calls and call notes, and call-back requests	To confirm and remind you, and to answer your questions.	You, and our team.	We are setting time limits (section 7).
Your location, only if you allow it	To show doctors near you.	Google Maps, to work out distances. We round it to about 100 metres first.	Not kept. We never save your exact position.
Website forms: contact, call-back, demo and price requests, and webinar sign-ups — your name, mobile, email, clinic name and message	To reply to you and do what you asked.	Our team.	We are setting time limits (section 7).
Job applications: your details and your CV	To consider you for this role and future roles.	Our hiring team.	One year after our decision, then deleted.
Doctors and clinic staff: name, contact details, qualification, registration number, speciality, timings, fee and photo. A doctor's home address and personal mobile are kept private	To set up your profile, show patients who you are, and check that doctors are registered.	Patients see a doctor's name, photo, qualification, speciality, clinic, fee and timings — never the mobile number or home address. Your clinic and our team see the rest.	Until the clinic removes you, or your account is deleted.
Clinics: clinic details, registration documents, GST details, plan, invoices and payments	To check that the clinic is real, run its account, and bill it.	The clinic owner, and our team.	While the clinic uses Fix My Appointment. Invoices and payments: at least as long as tax law needs.
Safety records: sign-in codes and records, and logs of who opened patient records	To keep accounts safe and find misuse.	Our team only.	We are setting time limits (section 7).
Cookies, only if you allow them, on our information pages	To count visits and measure our ads.	Google Analytics and Meta (section 5).	Until you change your choice (section 5).

3. Who can see your details

Access follows strict roles:

You see your own account, appointments and prescriptions.
Clinics see their own appointments and patients. A doctor sees the patients they consult, and their own clinic's records of them.
Pharmacies linked to a clinic see only what they need to give you your medicines: your name, age, gender, allergies and the prescription. They see it only for that clinic and, by default, from the last 90 days.
Our team sees what it needs to check clinics, help you, and keep the service safe.
Service providers who work for us, such as Google, Twilio and Meta, handle some details for us (section 4).
The government or the police, only when the law requires it.

We never sell your details, and we never use your medical records for ads.

These rules are enforced on our servers, not just hidden on screen. When an admin opens or exports other people's data, a pharmacy views a prescription, or a doctor or clinic opens a patient's history, it is logged. We also keep a record each time you turn sharing on or off.

4. Where your data is kept, and security

Our main database is on Google Cloud in Mumbai, India, protected by role-based security rules. Some services we use handle data outside India:

Sign-in — Google Firebase Authentication, which runs in the USA.
SMS messages (such as codes and confirmations) and Ria's phone calls — Twilio.
WhatsApp messages — Meta.
Emails — Google (Gmail).
Maps and distance — Google Maps, using your location rounded to about 100 metres.
Our AI assistants, Ria and Fixy, and our check of clinic documents — Google Gemini.

We send each service only what it needs for its job. Payments are handled by Razorpay; we never store card numbers. All secret credentials stay on our servers.

How we protect your details. Everything travels encrypted (HTTPS), and Google encrypts what it stores. Each person sees only what their role allows, and our servers check this every time. Prescription files and CVs can't be opened straight from storage. If a data breach affects you, we will tell you and the authorities, as the law requires.

5. Analytics and ads cookies — only if you allow them

On our information pages (such as Home, Pricing and Contact) we ask you first before using two services:

Google Analytics counts visits and the pages viewed, so we can improve the site.
Meta Pixel (Facebook and Instagram) tells us whether people who saw our ads visited the site, so we can measure our ads.

Both use cookies and receive details such as your device, browser, approximate location from your internet connection, and the pages you visit. They run only if you click Allow all, or tick them under Choose. They never run on pages where you book or view an appointment, check a prescription, sign up or sign in, on clinic websites, or in any dashboard — so your medical records, prescriptions and appointment details are never shared with them. You can change your choice at any time with Cookie settings at the bottom of our information pages. When you withdraw, we stop both and delete their cookies.

6. Your rights and choices

See your details. Your profile, appointments and prescriptions are in your dashboard. For a summary of all the details we hold about you, and a list of who we shared them with, write to our Grievance Officer (section 10).
Correct or update them. Change your details in My Profile at any time. A visit record, such as a prescription, can be corrected only by the clinic that wrote it — ask the clinic, or tell us and we will pass it on.
Choose what you share. You can turn sharing with other clinics on or off in My Profile, and withdraw location permission from your browser.
Choose someone to act for you. You can name a person who can use these rights for you if you die or cannot act yourself. Write to our Grievance Officer.
Complain — see section 10.

We reply to every request within one month.

Withdrawing your consent

You can withdraw your consent at any time, and it is as easy as giving it: in My Profile, under Your consents, tap Withdraw consent. We then close your account, as explained below. Doctors and clinic owners can use Delete Account in their Profile, and anyone can write to our Grievance Officer instead. Withdrawing does not undo what was done with your consent before you withdrew it.

You can also stop just one thing: turn off sharing with other clinics in My Profile, or change your cookie choice with Cookie settings.

If you delete your account

When you delete your account, or withdraw your consent, your login, profile and sign-up record are deleted, and sharing with other clinics stops. Clinics you visited keep their own records of those visits (appointments, prescriptions and vitals), because these are medical records. Ask the clinic if you want those removed. Appointments you have already booked stay with the clinic, so cancel them first if you don't want them. We keep a short record that you agreed and later withdrew, with no medical details, to show that we followed the law.

7. How long we keep your details

Your account and profile: until you delete your account. A nightly check removes anything left behind once an account is gone.
Visit records (appointments, vitals and prescriptions): the clinic keeps them as its medical records. How long is the clinic's choice, within the law.
Clinic invoices and payments: at least as long as tax law needs.
Job applications and CVs: one year after our decision, then deleted.
Your consents: kept after your account is deleted, as proof of what you agreed to.
Messages, Ria's chats and call notes, website requests, sign-in codes and safety logs: we are setting time limits for these, and will list them here before they start. Until then, you can ask our Grievance Officer to delete yours, unless the law needs us to keep them.

8. Children

You must be 18 or older to make an account. A parent or legal guardian books for a child from their own account, and confirms when booking that they are the child's parent or guardian. At a clinic's desk, the parent gives the child's details to the clinic in person.

We never use a child's details for ads. If you think we hold a child's details without a parent's yes, write to our Grievance Officer and we will act on it.

9. Changes to this policy, and other languages

If we change this policy in a way that matters, we will show you the new version when you next sign in, and ask you to agree again. The version and date are at the top of this page.

This policy is also in Hindi (हिंदी). If you need it in another language listed in the Eighth Schedule of the Constitution of India, write to our Grievance Officer and we will send it to you.

10. Grievance Officer, and how to complain

For any question or complaint about your personal data, write to support@fixmyappointment.com. We reply within one month.

If you are not happy with our reply, you can complain to the Data Protection Board of India. We will add the Board's link here when it starts taking complaints.