Privacy Policy

Last updated: [date]

QueCare is a service of [QueueCareSolutions — registered company name], [registered address] ("QueCare", "we"). It helps clinics run their waiting line: you join a clinic's queue or book a visit in the QueCare app, on the web, on the clinic's WhatsApp number or at the front desk, and see your place in line. This policy covers the QueCare app for iPhone and Android, the website quecaresolutions.com and the WhatsApp service. It explains what personal data we handle, why, who sees it and the choices you have, in line with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act").

Who is responsible for your data

When you join a clinic's queue, the clinic decides why and how your visit information is used for your care, and QueCare handles it on the clinic's behalf. For your QueCare account itself (your number, name, saved children and app settings), QueCare is responsible. Either way, you can contact us using the details at the end of this page.

What we collect

You give us

• Mobile number: to sign in. We confirm it with a one-time code sent by SMS.
• Name (and e-mail, only if you add one).
• Children you add: each child's name and birth month and year (not the full date of birth). See Children.
• Visit details: the clinic and doctor, who the visit is for, and the reason for the visit if you type one.
• Messages you send to a clinic's WhatsApp number through QueCare, and the replies.
• Your language (English or Tamil) and notification choices.

Created when you use QueCare

• Visit history: your token number and place in line, arrival time and how you were marked as arrived (by you or by the front desk), when you were called in, finished, missed or cancelled, and next-visit dates the clinic gives you (for example vaccinations).
• Notifications we sent you about your visits, and whether you have opened them in the app.
• Push notification token: an identifier for the QueCare app on your phone, issued through Expo's push service (which uses Apple's and Google's push services), so we can send you alerts such as "your turn is near". It is sent only if you allow notifications. We also keep the phone type (iPhone or Android) and the app version.
• Security records: the network (IP) address and time of sign-in and booking attempts, kept to stop fake bookings and abuse. Phone numbers in these records are masked.

Location

QueCare asks for your location only while you are using the app, never in the background, and only for these moments:

• "I'm here" check-in: your phone sends its position once. Our server works out how far you are from the clinic and, if you are close enough, marks you as arrived. We store only the arrival time and that distance in metres, not your position.
• Joining at the clinic: some clinics take joins only from people already at the clinic. Your position is checked the same way, and only the distance is kept.
• Clinics near you: your position is sent with the search to find nearby clinics and is not saved. Our web server's technical logs may record the search for a short time ([__] days).

If you do not allow location, you can still use QueCare: the front desk can mark you as arrived, and the map starts from the city centre.

We do not collect your medical records, diagnoses, prescriptions, contacts, photos or payment card details. The app takes no payments.

Why we use it

• To sign you in and keep your account secure.
• To give you a token or booking, show and update your place in line, and tell you when your turn is near.
• To let the clinic run its waiting room: call patients, record arrivals and no-shows, and give next-visit dates.
• To send you messages about your visits by push notification, WhatsApp or SMS.
• To prevent misuse, such as fake bookings, and to keep records the clinic needs.
• To fix problems and improve the service.

We process your data with your consent, which you give when you create an account or join a queue, and for the other uses the DPDP Act allows. We do not sell your data, do not use it for advertising and do not track you across other apps or websites. The app contains no advertising or analytics trackers.

Who sees it

• The clinic you visit and its staff (front desk, assistants and doctors): your name, mobile number, who the visit is for, the reason you typed, your token and your visit history at that clinic. A clinic does not see your visits to other clinics. Your children's birth month and year stay in your account (to show their age in the app) and are not shown to the clinic.
• Family you share a tracking link with: if you tap Share, anyone with that private link can see that visit's place in line.
• Service providers who process data for us under contract and only to run QueCare ("data processors"):
  • Amazon Web Services: hosting and database ([region — confirm]).
  • Twilio [or MSG91 — confirm the SMS provider in use]: sending sign-in codes by SMS.
  • Meta (WhatsApp Business Platform): messages with the clinic's WhatsApp number.
  • Expo (650 Industries, Inc.), Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): delivering push notifications to your phone. They receive the push token and the text of the notification (for example your token number and the clinic's name).
  • Google Maps and Apple Maps: showing the map in the app. They receive the map area being shown, not your account details.
• Authorities, where the law requires it.

Some providers may process data outside India. Where they do, it is protected under contract and as the DPDP Act allows.

Children

Parents and guardians use QueCare for their children. Children do not use QueCare themselves: you must be 18 or older to create an account, and the app is not directed at children.

When you add a child, or book a visit for a child, you give us the child's name and birth month and year (not the full date of birth). Only you, the parent or guardian, enter this, from your own account, which is tied to a mobile number confirmed by a one-time code. When you save a child, the app asks you to confirm that you are the child's parent or lawful guardian and that you agree to us keeping these details for the child's clinic visits. This is how we ask for a parent's consent for a child's data under section 9 of the DPDP Act.

[For legal review: under section 9 of the DPDP Act and rule 10 of the DPDP Rules, 2025, the parent's consent must be "verifiable" and we must take care that the person giving it is an identifiable adult. Confirm (1) whether a verified mobile number plus the parent's confirmation is enough, or whether an identity or age check (for example DigiLocker) is needed; (2) whether a Fourth Schedule exemption for clinical establishments or healthcare applies to QueCare, which acts for the clinic; (3) the date from which rule 10 applies.]

We use children's data only to run their visits: the clinic sees the child's name on the visit, never the birth month and year. We never use it for tracking, profiling, advertising or anything a child would not expect. To remove a child, tap the child in Account → My children: the child's saved name and birth month and year are deleted. Visits you already made for that child keep the child's name in the clinic's records until you delete your account.

How long we keep it

• Your account and saved children: until you delete them or your account.
• Visit records: kept for the clinic's history while the clinic uses QueCare, for at most [__] years unless the law requires longer. When you delete your account, your past visits are anonymised (see below).
• Sign-in codes: expire after 5 minutes.
• Push tokens: removed when you sign out or delete your account.
• Records of who changed what at the clinic: 12 months. Security records and messages: [__] months.

Deleting your account

In the app, go to Account → Delete account. Without the app, use quecaresolutions.com/delete-account (you confirm with a code sent to your number), or write to us (below). When you delete your account:

• your upcoming visits and bookings are cancelled (a visit already with the doctor is finished by the clinic);
• your name, mobile number, e-mail, saved children, push tokens, notifications and reminders are deleted, and you are signed out on every phone;
• your past visits stay in the clinic's records as "Deleted user" (clinic, doctor, token, date and times, and whether the visit was completed, missed or cancelled), without your name, number, the child's name, the reason you typed or where you joined from, so the clinic's records stay correct. This remaining record no longer identifies you.

This happens straight away and cannot be undone. Signing in again later with the same number starts a new, empty account. Messages in the clinic's WhatsApp chat stay in that chat; reply STOP there to stop them.

Your rights

Under the DPDP Act you can:

• Access: ask for a summary of the data we hold about you and who we shared it with.
• Correct or update: change your name in the app (Account → Edit profile), remove a child and add them again, or ask us.
• Erase: delete your account as above. Some records may be kept where the clinic or the law requires it; we will tell you if so.
• Withdraw consent: turn off notifications, reply STOP on WhatsApp or SMS, or delete your account. Withdrawing consent does not affect what was done before.
• Nominate someone to exercise these rights for you if you die or are unable to.
• Grievance: complain to our Grievance Officer (below). If you are not satisfied with the answer, you may complain to the Data Protection Board of India.

Security

Data is sent over encrypted (HTTPS) connections and stored on secured servers. In the app, your sign-in is kept in the phone's secure storage. Staff access at a clinic is limited by role and recorded. Each family sees only their own visits.

Clinic staff logins: when front desk staff, assistants or doctors log in or open a desk (or a walk-in kiosk is locked), the browser's location is checked once against the clinic's address. We keep only whether the login was at the clinic and roughly how far away it was, in metres, never the location itself. Owners and admins get a one-time code by SMS on every login.

Contact and Grievance Officer

Questions, requests and complaints: privacy@quecaresolutions.com.

Grievance Officer: [Name], [QueueCareSolutions — registered company name], [address]. E-mail: privacy@quecaresolutions.com · Phone: [phone]. We aim to reply within [__] days.

For help with the app, see Help & support.

Changes

We will post any changes here and update the date above. For important changes, we will tell you in the app or by message before they take effect.