Privacy Policy

Who We Are

DrFolios is a professional reputation intelligence platform built exclusively for senior Indian doctors. It is operated by ReputeFlows (the "Company", "we", "us", or "our"), a startup registered in India.

DrFolios helps doctors understand, manage, and strengthen their professional reputation online — including review monitoring, AI-assisted response drafting, career profile management, and authority scoring.

Platform URL: drfolios.com
Operator contact: kondurhai@gmail.com

What We Collect

Doctor Profile Data

When you register as a doctor on DrFolios, we collect:

• Full name, email address, and profile photograph (optional)
• Medical qualifications, specialty, and years of experience
• NMC (National Medical Council) or State Council registration number — used for identity verification
• Clinic or hospital affiliations, practice locations, and contact information you choose to display
• Career milestones, publications, fellowships, and awards you enter into your Career Journey
• Languages spoken and professional biography

Review and Reputation Data

We collect publicly available reviews about you from platforms including Google, Practo, JustDial, and Lybrate. This is publicly accessible data. We do not collect patient health records or any information that identifies your patients.

Usage Data

We collect standard technical data including IP address, browser type, pages visited, and session duration for security and platform improvement purposes.

Payment Data

Subscription payments are processed by Razorpay. We do not store card numbers or payment credentials. We retain transaction IDs and subscription status for billing records.

What We Do Not Collect

We do not collect, store, or process:

• Patient health records, diagnoses, prescriptions, or treatment histories
• Patient identities (names, contact details, Aadhaar numbers)
• Clinical consultation notes (AI Voice Scribe transcripts, when available, are owned by the doctor and never transmitted to us)
• Any data that would constitute "health data of a data principal" under DPDPA Section 2(t)

This boundary is maintained by design. If a patient review happens to mention identifying health information, our AI system flags it with a containsPII marker and suppresses it from automated outputs.

How We Use Your Data

We do not sell your data. We do not use your data for advertising. DrFolios is an ad-free platform.

AI Processing

DrFolios uses AI to analyse patient reviews and draft reply suggestions. Here is how this works:

• Review analysis: Review text is sent to our AI engine (powered by Google Gemini and Anthropic Claude) to extract sentiment, clinical aspects mentioned, and urgency signals. Review text is processed transiently — it is not stored by the AI provider beyond the duration of the API call.
• Reply drafting: When you request an AI-drafted reply, the review text and your specialty are sent to the AI engine. The draft is returned to you for review and editing. We do not auto-post replies.
• PII detection: Our AI system is configured to detect when a review contains patient-identifying health information. When detected, the containsPII flag is set and the review excerpt is suppressed from automated outputs.
• No training on your data: Your profile data and review data are not used to train AI models.

Third-Party Services

We use the following third-party services. All are contractually bound to handle data in compliance with applicable law:

We do not share your data with any other third parties without your explicit consent.

Your Rights Under DPDPA

Under India's Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:

• Right to access: Request a copy of the personal data we hold about you
• Right to correction: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to grievance redressal: Lodge a complaint with our Grievance Officer (details below)
• Right to nominate: Nominate another individual to exercise your rights on your behalf

To exercise any of these rights, email our Grievance Officer at kondurhai@gmail.com with the subject line "DPDPA Rights Request". We will respond within 30 days.

Data Retention

We retain your data for as long as your account is active. If you close your account:

• Profile data is deleted within 30 days of account closure
• Review data collected from public sources is deleted within 30 days
• Transaction records are retained for 7 years as required by Indian financial regulations
• Anonymised, aggregated platform analytics may be retained indefinitely

Security

We implement industry-standard security measures including:

• HTTPS encryption for all data in transit
• Database access controls with role-based permissions
• Session-based authentication with secure cookies
• Regular security reviews of third-party integrations

In the event of a data breach that is likely to result in harm to you, we will notify you and the Data Protection Board of India within the timeframe required by DPDPA.

Contact & Grievance Officer

This policy was last reviewed on 9 June 2026. We will notify registered doctors of material changes via email before they take effect.