Legal · Policies · V1.0

Legal &Compliance

Everything governing your use of Doxmate — terms, privacy, data protection, deletion, medical disclaimers, and refunds — all in one place.

Last Updated: 23 August 2026Effective From: 23 August 2026Operated by: Brainox Tech

Terms of Use

Effective Date: 23 August 2026 · Last Updated: 23 August 2026

These Terms of Use (“Terms”) govern access to and use of Doxmate, an AI-powered healthcare operations and automation platform developed and operated by Brainox Tech (“Doxmate”, “we”, “our”, or “us”).

Doxmate provides healthcare organizations with software tools for clinic and hospital operations, including appointment management, patient records, prescriptions, billing, queue management, WhatsApp-based patient communication, AI-powered automation, patient engagement, growth and review-management workflows, and supported third-party integrations.

These Terms apply to clinics, hospitals, diagnostic centres, healthcare professionals, administrators, staff members, and other authorized users (“User”, “you”, or “your”).

By creating an account, accessing, connecting to, or using Doxmate, you agree to these Terms and the policies referenced in them. If you do not agree with these Terms, you must not use Doxmate.

1. Definitions

1.1 Doxmate

“Doxmate” means the software platform, websites, dashboards, APIs, WhatsApp integrations, AI services, healthcare-management functionality, and related services operated by Brainox Tech.

1.2 Healthcare Organization

A Healthcare Organization includes a clinic, hospital, diagnostic centre, medical practice, laboratory, or other healthcare provider using Doxmate.

1.3 Authorized User

An Authorized User is a doctor, administrator, receptionist, staff member, or other person authorized by the Healthcare Organization to use Doxmate.

1.4 Patient

A Patient is an individual whose appointment, communication, healthcare, billing, queue, or other information is managed through Doxmate by a Healthcare Organization.

2. Eligibility and Authority

To use Doxmate:

  • You must be at least 18 years old, unless applicable law permits otherwise.
  • You must provide accurate and current information.
  • You must have authority to create or use an account on behalf of the Healthcare Organization where applicable.
  • You must comply with these Terms and applicable laws.
  • You must have appropriate authority to access patient and healthcare information.

If you use Doxmate on behalf of a clinic, hospital, or other organization, you represent that you have authority to bind that organization to these Terms.

3. Doxmate Services

Depending on the subscription, configuration, and features enabled for an organization, Doxmate may provide:

Clinic Operations

  • Appointment scheduling
  • Appointment rescheduling and cancellation
  • Patient management
  • Patient records / EMR
  • Doctor management
  • Doctor availability and appointment slots
  • Queue and token management
  • Patient check-in and consultation workflow
  • Billing and receipts
  • Prescription management
  • Patient history and healthcare information management
  • Operational dashboards and analytics

AI & Automation

  • WhatsApp AI Agent
  • AI-assisted appointment booking
  • AI-powered patient conversations
  • Administrative enquiry handling
  • Automated reminders
  • Follow-ups
  • Patient communication automation
  • AI-assisted patient summaries
  • Other AI-assisted administrative workflows made available through Doxmate

Engagement & Growth

  • Appointment reminders
  • Check-in confirmations
  • No-show recovery
  • Abandoned-booking follow-ups
  • Patient engagement workflows
  • Google Business Profile-related functionality
  • Review collection
  • AI-assisted review responses
  • Business/profile insights and growth workflows

Integrations

Depending on availability and account configuration:

  • WhatsApp / Meta Cloud API
  • Google Sign-In
  • Google Calendar
  • Google Sheets
  • Google Meet
  • Other supported third-party integrations

The exact features available to a User may depend on the applicable plan, configuration, geographic availability, technical availability, and product version.

4. Healthcare and Clinical Responsibility

Doxmate is a technology platform and does not replace qualified healthcare professionals.

Certain Doxmate features may allow Healthcare Organizations to store and manage healthcare information, including information contained in patient records, prescriptions, clinical notes, and other EMR-related information.

However:

  • Doxmate does not independently provide medical treatment.
  • Doxmate does not establish a doctor-patient relationship.
  • Doxmate does not replace a healthcare professional's judgment.
  • Healthcare professionals remain responsible for diagnosis, treatment, prescriptions, and clinical decisions.
  • AI-generated information must not be treated as a substitute for professional medical judgment.

Healthcare Organizations remain responsible for the clinical services they provide to patients.

5. AI Services

Doxmate may use AI to support administrative and operational workflows.

AI functionality may include:

  • Patient conversations
  • Appointment scheduling
  • Appointment-related enquiries
  • Reminders
  • Follow-ups
  • Queue-related assistance
  • Administrative automation
  • AI-generated patient summaries
  • Review-related assistance
  • Other AI-supported workflows

AI systems can produce inaccurate, incomplete, or unexpected results. You acknowledge that:

  • AI outputs should be reviewed where appropriate.
  • AI-generated summaries may contain errors or omissions.
  • AI responses should not be treated as medical advice unless a specifically documented Doxmate feature expressly states otherwise.
  • Healthcare professionals remain responsible for clinical decisions.
  • Users must not rely solely on AI output for emergency, diagnostic, treatment, or other critical medical decisions.

For further information, see the Ethical AI Use Policy.

6. Patient and Healthcare Data

Doxmate may process Personal Data and healthcare information depending on the features used by the Healthcare Organization. This may include:

  • Patient identity information
  • Contact information
  • Appointment information
  • Patient history
  • Vitals
  • Medical information entered into the EMR
  • Prescriptions
  • Clinical notes
  • Billing information
  • Queue information
  • WhatsApp communications
  • Documents uploaded by authorized users
  • Other information entered into the Platform

Healthcare Organizations generally act as the Data Controller/Data Fiduciary for patient information. Doxmate generally acts as a Data Processor or equivalent service provider when processing information on behalf of Healthcare Organizations.

Healthcare Organizations are responsible for:

  • Establishing a lawful basis for processing.
  • Providing appropriate privacy notices.
  • Obtaining consent where required.
  • Ensuring information is accurate.
  • Controlling authorized access.
  • Complying with applicable healthcare and privacy laws.

The relationship between Doxmate and the Healthcare Organization is further governed by the Data Protection Agreement (DPA) where applicable.

7. Privacy and Data Protection

Doxmate processes information in accordance with its applicable privacy and security policies. These include:

  • Privacy Policy
  • Data Deletion Policy
  • Data Protection & Security Policy
  • Data Protection Agreement
  • Ethical AI Use Policy

Doxmate does not sell Personal Data or patient medical records. Healthcare Organizations should not provide Doxmate with information that they are legally prohibited from processing or sharing with a service provider.

8. User Account and Security Responsibilities

Users are responsible for protecting their account credentials. You agree to:

  • Keep login credentials confidential.
  • Use appropriate security practices.
  • Not share accounts where individual accounts are required.
  • Notify Doxmate promptly of suspected unauthorized access.
  • Ensure only authorized personnel access patient information.
  • Review and manage user access appropriately.
  • Use Multi-Factor Authentication where available.

You are responsible for activity conducted through your account unless caused by unauthorized access that was not reasonably attributable to your actions or omissions.

9. Patient Data Accuracy

Healthcare Organizations are responsible for the accuracy and completeness of information entered into Doxmate.

Doxmate may provide tools that assist with:

  • Patient data entry
  • Data organization
  • AI-assisted summaries
  • Appointment information
  • Prescription management
  • Billing
  • Reporting

These tools do not guarantee that information entered, imported, generated, or displayed will always be error-free. Users should verify important information before relying on it.

10. WhatsApp and Meta Requirements

Doxmate may use the Meta WhatsApp Cloud API to provide WhatsApp-based functionality. Users must comply with applicable:

  • Meta Business Terms
  • WhatsApp Business Terms
  • WhatsApp Business Messaging Policies
  • WhatsApp Commerce Policies where applicable
  • Opt-in and communication requirements
  • Applicable privacy and communication laws

Doxmate may restrict or suspend WhatsApp functionality if:

  • Meta restricts or suspends the connected account.
  • The connected WhatsApp Business Account violates Meta policies.
  • The User engages in prohibited messaging.
  • The User sends spam or unauthorized communications.
  • Continued access creates legal, security, or platform-policy risks.

Doxmate is not responsible for restrictions independently imposed by Meta.

11. Google Services and Integrations

Doxmate may provide optional integrations with Google services, including:

  • Google Sign-In
  • Google Calendar
  • Google Sheets
  • Other supported Google services where available

These integrations require user authorization through Google's authorization mechanisms. When connecting Google services:

  • You authorize Doxmate to access only the permissions requested and approved.
  • Google may independently process information under Google's terms and policies.
  • You may revoke access through your Google Account.
  • Doxmate does not receive your Google Account password.

Google User Data is handled in accordance with applicable Google API policies, including the Google API Services User Data Policy and its Limited Use requirements. Doxmate does not use Google User Data for advertising, selling data, or training generalized AI/ML models.

12. Third-Party Services

Doxmate relies on third-party infrastructure and services to provide certain functionality. These may include:

  • Meta / WhatsApp Cloud API
  • Amazon Web Services
  • Google services and APIs
  • Payment providers
  • AI/LLM providers
  • Communications providers
  • Security and monitoring providers
  • Other technology providers required for specific features

Third-party services may have their own terms, privacy policies, technical limitations, outages, or availability requirements. Doxmate is not responsible for failures caused solely by a third-party provider beyond Doxmate's reasonable control.

13. AI and Third-Party AI Providers

Certain Doxmate AI functionality may rely on third-party AI or Large Language Model providers. Depending on the feature and configuration, information submitted to an AI workflow may be processed by the relevant AI infrastructure provider. Doxmate will apply applicable contractual, technical, and privacy safeguards to such processing.

Users must not intentionally submit information to an AI workflow where such processing is prohibited by applicable law, their organization's policies, or the relevant Doxmate feature's documented limitations.

14. Payments, Subscriptions and Fees

Where Doxmate Services are provided under a paid plan:

  • Fees will be displayed or communicated before purchase where applicable.
  • Billing may be monthly, annually, or according to another agreed billing period.
  • Fees are generally payable according to the applicable subscription terms.
  • Taxes may apply where required by law.
  • Failure to pay applicable fees may result in suspension or termination.

Free plans, trials, promotional offers, and usage limits may be subject to separate eligibility and fair-use conditions. Refunds and cancellations are governed by the applicable Refund & Cancellation Policy.

15. Changes to Services and Features

Doxmate is continuously developed and may:

  • Add new features.
  • Improve existing features.
  • Modify workflows.
  • Remove obsolete functionality.
  • Change technical infrastructure.
  • Change third-party integrations.
  • Introduce or discontinue AI providers.
  • Change feature availability between plans.

We will make reasonable efforts to avoid materially disrupting active services. Certain third-party integrations may become unavailable if the relevant provider changes its API, policies, pricing, or technical requirements.

16. Acceptable Use

You may use Doxmate only for lawful and authorized purposes. You must not use Doxmate to:

  • Commit fraud.
  • Engage in unlawful activity.
  • Send spam.
  • Send unauthorized bulk communications.
  • Harass patients or other individuals.
  • Misrepresent an AI system as a human where disclosure is required.
  • Circumvent WhatsApp or Meta restrictions.
  • Upload or process data without appropriate authorization.
  • Gain unauthorized access to another organization or user's account.
  • Interfere with the Platform.
  • Introduce malware or malicious code.
  • Attempt to bypass security controls.
  • Reverse-engineer the Platform except where expressly permitted by applicable law.
  • Scrape or systematically extract Platform data without authorization.
  • Use Doxmate to develop or operate a competing service by copying protected Platform functionality or confidential information.
  • Use AI functionality for unlawful, harmful, discriminatory, deceptive, or abusive purposes.

17. Prohibited Clinical and Emergency Use

Doxmate's general AI functionality must not be used as the sole basis for:

  • Emergency medical decisions.
  • Diagnosis.
  • Treatment selection.
  • Medication decisions.
  • Clinical triage.
  • Interpretation of medical test results.
  • Determining whether emergency care is required.

Where Doxmate provides healthcare-management functionality, final clinical decisions remain with appropriately qualified healthcare professionals. Patients should seek appropriate professional or emergency medical assistance when necessary.

18. Intellectual Property

Doxmate and its underlying technology are owned by or licensed to Brainox Tech. This includes, where applicable:

  • Software
  • Source code
  • User interfaces
  • Dashboards
  • Workflows
  • AI configurations
  • Branding
  • Documentation
  • Designs
  • Databases and database structures
  • APIs
  • Proprietary technology
  • Doxmate trademarks and logos

Subject to these Terms, Doxmate grants the User a limited, non-exclusive, non-transferable, revocable right to access and use the Platform for the User's authorized business operations during the applicable subscription period.

You may not copy, reproduce, distribute, sell, sublicense, or commercially exploit Doxmate technology except as expressly authorized. Nothing in these Terms transfers ownership of Doxmate intellectual property to the User.

19. Customer Data Ownership

Subject to applicable law and the rights of Data Subjects:

  • The Healthcare Organization retains its rights in Customer Data that it provides to Doxmate.
  • Doxmate does not claim ownership of patient records merely because they are stored or processed through the Platform.
  • Doxmate receives the rights necessary to host, process, transmit, back up, display, and otherwise handle Customer Data solely to provide the Services and fulfill applicable legal obligations.

The Controller remains responsible for ensuring that it has the necessary rights and authority to provide the data to Doxmate.

20. Service Availability

Doxmate is provided on an “as-is” and “as-available” basis to the extent permitted by law. We aim to maintain reliable service but do not guarantee:

  • Continuous availability.
  • Error-free operation.
  • Uninterrupted access.
  • Perfect AI accuracy.
  • Continuous WhatsApp delivery.
  • Continuous third-party integration availability.
  • That every feature will be available at all times.

Service interruptions may occur because of:

  • Maintenance.
  • Infrastructure failures.
  • Internet or telecommunications failures.
  • Meta/WhatsApp restrictions.
  • Third-party API failures.
  • Security incidents.
  • Government restrictions.
  • Force majeure events.

21. Data Backup

Doxmate may maintain backups for operational resilience and disaster recovery. Backups are subject to applicable retention and security controls. Users remain responsible for maintaining their own copies of information where they require independent backup or archival records.

22. Disclaimer of Warranties

To the maximum extent permitted by applicable law, Doxmate does not warrant that:

  • The Platform will always be available.
  • The Platform will be completely error-free.
  • AI outputs will always be accurate.
  • Appointment availability will always be correctly interpreted.
  • Messages will always be delivered.
  • Third-party services will always remain available.
  • The Platform will meet every particular business or clinical requirement.

Mandatory warranties that cannot legally be excluded remain unaffected.

23. Limitation of Liability

To the maximum extent permitted by law, Brainox Tech and Doxmate will not be liable for indirect, incidental, consequential, special, punitive, or exemplary damages arising from use of the Services. This may include losses arising from:

  • Business interruption.
  • Loss of revenue.
  • Patient no-shows.
  • Incorrect appointment information.
  • Communication delays.
  • WhatsApp delivery failures.
  • Third-party outages.
  • AI-generated errors.
  • User configuration errors.
  • Unauthorized access caused by inadequate User security practices.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited under applicable law.

Subject to applicable law and any separate written agreement, Doxmate's aggregate liability arising from the Services will generally not exceed the fees actually paid by the relevant User to Doxmate during the three months immediately preceding the event giving rise to the claim.

24. Indemnification

To the extent permitted by law, you agree to defend, indemnify, and hold harmless Brainox Tech, Doxmate, and their personnel from claims, losses, liabilities, damages, and reasonable expenses arising from:

  • Your unlawful use of Doxmate.
  • Violation of these Terms.
  • Violation of Meta/WhatsApp policies.
  • Unauthorized patient-data processing.
  • Unauthorized communications.
  • Misuse by your staff or authorized users.
  • Your violation of applicable privacy or healthcare laws.
  • Your infringement of third-party rights.

This section does not apply to the extent a claim results from Doxmate's own gross negligence, willful misconduct, or other liability that cannot legally be transferred.

25. Suspension and Termination

Doxmate may suspend or terminate access where reasonably necessary if:

  • You materially breach these Terms.
  • You engage in unlawful activity.
  • You misuse patient or Personal Data.
  • You violate Meta/WhatsApp policies.
  • Your connected WhatsApp Business Account is restricted.
  • You attempt unauthorized access.
  • You introduce security threats.
  • Required subscription payments remain unpaid.
  • Continued access presents a security, legal, or regulatory risk.

Where practical, Doxmate may provide notice and an opportunity to remedy a breach before termination. Immediate suspension may occur where necessary to protect users, systems, Personal Data, third-party services, or legal compliance.

26. Effect of Termination

Upon termination:

  • User access may be disabled.
  • Connected third-party integrations may be disconnected.
  • WhatsApp connections may be revoked.
  • Data will be handled according to the applicable Data Deletion Policy and Data Protection Agreement.
  • Amounts already due may remain payable.
  • Provisions relating to confidentiality, intellectual property, liability, indemnification, dispute resolution, and other provisions intended to survive termination will remain effective.

27. Regulatory Compliance

Users must comply with all laws applicable to their use of Doxmate. Depending on the jurisdiction and circumstances, this may include:

  • Data protection laws.
  • Healthcare privacy laws.
  • Electronic communications laws.
  • Consumer protection laws.
  • Cybersecurity requirements.
  • Advertising and marketing laws.
  • Applicable Meta/WhatsApp requirements.
  • Applicable Google API requirements.

Doxmate may implement additional restrictions where necessary to comply with applicable law or third-party platform requirements. Nothing in these Terms constitutes a representation that Doxmate is certified under a particular regulatory or security framework unless expressly stated by Brainox Tech in writing.

28. Force Majeure

Doxmate will not be responsible for delays or failures caused by circumstances beyond its reasonable control, including:

  • Natural disasters.
  • War.
  • Terrorism.
  • Government action.
  • Pandemics or public-health emergencies.
  • Internet infrastructure failures.
  • Telecommunications failures.
  • Cloud infrastructure outages.
  • Third-party API outages.
  • Large-scale cyberattacks.
  • Power failures.
  • Other events beyond reasonable control.

29. Changes to These Terms

Doxmate may update these Terms to reflect:

  • New products or features.
  • Changes to existing Services.
  • Changes to laws or regulations.
  • Security improvements.
  • Changes to third-party integrations.
  • Changes to business practices.

Material changes may be communicated through the Platform, website, email, or other reasonable methods where appropriate. The latest version will contain the applicable “Last Updated” date.

Continued use of Doxmate after an updated version becomes effective constitutes acceptance of the revised Terms to the extent permitted by law.

30. Related Policies

These Terms should be read together with Doxmate's applicable policies, including:

  • Privacy Policy
  • Data Deletion Policy
  • Data Protection & Security Policy
  • Data Protection Agreement (DPA)
  • Ethical AI Use Policy
  • Refund & Cancellation Policy
  • Any applicable Acceptable Use or third-party integration policies

These documents collectively describe how Doxmate operates and how information and Services are governed.

31. Severability

If any provision of these Terms is found to be invalid, unlawful, or unenforceable, that provision will be interpreted to the maximum extent permitted by law, and the remaining provisions will remain effective.

32. No Waiver

Failure by Doxmate to enforce any provision of these Terms does not constitute a waiver of the right to enforce that provision later.

33. Assignment

You may not transfer or assign your rights or obligations under these Terms without Doxmate's prior written consent, except where permitted by applicable law.

Doxmate may assign or transfer these Terms as part of a merger, acquisition, restructuring, sale of assets, or similar corporate transaction, subject to applicable law.

34. Governing Law and Jurisdiction

These Terms are governed by the laws of India, subject to mandatory rights and protections applicable to users under the laws of their jurisdiction.

Unless otherwise required by applicable law, courts having jurisdiction in Bundi, Rajasthan, India will have jurisdiction over disputes arising from these Terms.

35. Contact Information

For questions regarding these Terms, legal matters, privacy, security, or Doxmate Services:

Doxmate

Registered Business Name: Brainox Tech

Business Owner: Pratyaksh Gautam

Email: hello@doxmate.in

Support: hello@doxmate.in

Privacy & Data Protection: hello@doxmate.in

Security: hello@doxmate.in

Phone: +91 76654 27777

Website: https://www.doxmate.in

Registered Business Address: A-43, New Mansarovar Colony, Chittor Road, Bundi, Rajasthan, India – 323001

© 2026 Brainox Tech. All rights reserved.

Privacy Policy

Effective Date: 23 August 2026 · Last Updated: 23 August 2026

Platform / Brand: Doxmate

Registered Business Name: Brainox Tech

Business Owner: Pratyaksh Gautam

Website: www.doxmate.in

Email: hello@doxmate.in

Phone: +91 76654 27777

Address: A-43, New Mansarovar Colony, Chittor Road, Bundi, Rajasthan, India – 323001

1. Introduction

At Doxmate, operated by Brainox Tech, we respect the privacy and confidentiality of personal information and healthcare information processed through our platform.

Doxmate is a healthcare technology platform designed to help clinics, hospitals, doctors, and healthcare organizations manage their day-to-day administrative and operational activities.

Our currently available services may include:

  • Appointment management and appointment booking
  • Patient management
  • Electronic Medical Records (EMR)
  • Prescription management
  • Billing and invoicing
  • Queue management
  • WhatsApp-based appointment automation and patient communication
  • Automated appointment confirmations, reminders and follow-ups
  • WhatsApp Inbox and conversation management
  • AI-powered administrative assistance
  • AI-generated patient summaries based on information provided through supported workflows
  • Google Calendar integration
  • Google Sheets integration
  • Google Meet integration where enabled through supported calendar workflows
  • Google Sign-In
  • Google Review and reputation-management features
  • AI-assisted review responses and related review-management functionality
  • Operational analytics and reporting
  • QR-based appointment booking and related patient self-booking functionality

This Privacy Policy explains how Doxmate collects, uses, stores, processes, protects, and discloses Personal Data when you use our website, applications, dashboards, integrations, WhatsApp services, or other currently available Doxmate services.

2. Important Privacy Principles

We follow these core principles:

  1. We collect and process information only for legitimate and necessary purposes.
  2. We do not sell Personal Data or patient medical records.
  3. Healthcare organizations generally remain responsible for patient information that they collect and process through Doxmate.
  4. Doxmate generally acts as a service provider/Data Processor when processing patient information on behalf of a healthcare organization.
  5. We apply reasonable administrative, technical, and organizational safeguards to protect information.
  6. We limit access to Personal Data based on legitimate business and operational requirements.
  7. Optional third-party integrations are enabled only after appropriate authorization.
  8. Google API data is processed in accordance with applicable Google API policies, including the Limited Use requirements.
  9. Doxmate's AI features currently described in this Privacy Policy are intended primarily for administrative and operational assistance and do not replace qualified healthcare professionals.

3. Definitions

“Doxmate”

“Doxmate”, “we”, “our”, or “us” means the Doxmate platform operated by Brainox Tech.

“Brainox Tech”

“Brainox Tech” means the registered business responsible for operating and providing the Doxmate platform.

“Platform”

“Platform” means the currently available Doxmate websites, web applications, dashboards, APIs, WhatsApp integrations, appointment systems, patient-management functionality, EMR functionality, billing, queue management, AI administrative features, review-management functionality, and supported third-party integrations.

“User”

“User” means an individual who accesses or uses Doxmate, including healthcare professionals, clinic administrators, reception staff, authorized employees, and other authorized users.

“Healthcare Organization”

“Healthcare Organization” means a clinic, hospital, doctor, medical practice, healthcare provider, diagnostic center, or other organization using Doxmate.

“Patient”

“Patient” means an individual whose information is entered, uploaded, transmitted, or otherwise processed through Doxmate by or on behalf of a Healthcare Organization.

“Personal Data”

“Personal Data” means information that identifies or can reasonably be associated with an individual.

“Healthcare Information”

“Healthcare Information” means information relating to a patient's health, medical history, treatment, consultation, prescription, clinical records, reports, or other healthcare-related information.

“Processing”

“Processing” includes collecting, recording, storing, organizing, retrieving, viewing, using, transmitting, modifying, sharing, deleting, or otherwise handling information.

“Third-Party Services”

“Third-Party Services” means external services integrated with or used by Doxmate, including Google services, Meta WhatsApp Cloud API, payment providers, cloud infrastructure providers, analytics services, and other service providers necessary to operate the Platform.

4. Scope of This Privacy Policy

This Privacy Policy applies to Personal Data processed through currently available Doxmate services. It covers information processed through:

  • Doxmate website
  • Doxmate account and dashboard
  • Appointment management
  • Patient management
  • EMR
  • Prescription management
  • Billing
  • Queue management
  • WhatsApp integration
  • WhatsApp Inbox
  • AI administrative features
  • Patient summaries generated through supported administrative workflows
  • Google Calendar integration
  • Google Sheets integration
  • Google Meet-related appointment workflows where enabled
  • Google Sign-In
  • Google Review and reputation-management functionality
  • Operational analytics and reporting
  • Customer support
  • Security and fraud-prevention systems

This Privacy Policy does not automatically apply to third-party services themselves. Those services operate under their own privacy policies and terms.

5. Information We Collect

The type of information we collect depends on how you use Doxmate.

A. Account and Organization Information

When a Healthcare Organization creates or manages a Doxmate account, we may collect:

  • Organization name
  • Doctor or practitioner name
  • Administrator name
  • User name
  • Email address
  • Phone number
  • Business address
  • Clinic or hospital information
  • Professional information provided by the organization
  • Login credentials and authentication information
  • User roles and permissions
  • Subscription information
  • Account configuration
  • Communication preferences

6. Appointment Information

When Doxmate is used for appointment management or booking, we may process:

  • Patient name
  • Phone number
  • Email address, where provided
  • Date of birth, where required
  • Gender, where provided
  • Appointment date and time
  • Appointment status
  • Doctor or practitioner
  • Department or service
  • Clinic location
  • Follow-up information
  • Appointment notes
  • Booking source
  • Cancellation information
  • Rescheduling information
  • Check-in information
  • Attendance information
  • Reminder status
  • Queue-related information

This information is used to facilitate appointment booking, scheduling, confirmations, reminders, follow-ups, reporting, and related operational workflows.

7. Patient Management Information

Healthcare organizations may use Doxmate to maintain patient profiles and administrative records. Depending on the organization's configuration, information may include:

  • Name
  • Phone number
  • Email
  • Date of birth
  • Gender
  • Address
  • Patient identification information
  • Appointment history
  • Communication history
  • Follow-up history
  • Notes entered by authorized users
  • Billing-related information
  • Prescription-related information
  • Healthcare records maintained by the organization

The Healthcare Organization determines what patient information it enters into Doxmate and is responsible for ensuring that such collection and processing is lawful.

8. Electronic Medical Records (EMR)

Where the EMR functionality is enabled, Doxmate may process healthcare information entered or uploaded by authorized Healthcare Organizations. This may include:

  • Medical history
  • Symptoms
  • Clinical notes
  • Diagnoses recorded by healthcare professionals
  • Treatment information
  • Prescriptions
  • Medications
  • Allergies
  • Vital signs
  • Laboratory reports
  • Imaging reports
  • Surgical history
  • Family medical history
  • Uploaded medical documents
  • Clinical attachments
  • Other information maintained by the Healthcare Organization

Doxmate provides technology for storing and managing this information but does not independently determine the medical purpose for which a Healthcare Organization collects patient information. The Healthcare Organization remains responsible for the accuracy, legality, retention, access, and clinical use of patient records.

9. Prescription Information

Where prescription functionality is enabled, Doxmate may process:

  • Patient identification information
  • Doctor information
  • Medicines
  • Dosage information
  • Frequency
  • Duration
  • Instructions
  • Prescription date
  • Follow-up information
  • Other information entered by authorized healthcare professionals

Prescription information is processed to provide the requested healthcare-management functionality. Doxmate does not independently prescribe medication or replace the professional judgment of a qualified healthcare professional.

10. Billing and Payment Information

Doxmate may process information necessary to manage clinic billing and customer subscriptions. This may include:

  • Invoice information
  • Billing records
  • Patient billing information entered by the Healthcare Organization
  • Subscription plan
  • Subscription status
  • Payment status
  • Transaction identifiers
  • Invoice history
  • GST or tax information
  • Billing contact information

Where payments are processed through third-party payment providers, those providers may collect payment information directly. Doxmate does not intentionally store complete debit-card or credit-card numbers, CVV codes, or equivalent sensitive payment credentials on its own systems unless expressly stated for a particular payment service. Payment providers process payment information under their own terms and privacy policies.

11. Queue Management Information

Where Queue Management is enabled, Doxmate may process:

  • Queue token
  • Patient name or identifier
  • Check-in time
  • Queue position
  • Waiting time
  • Doctor availability
  • Consultation status
  • Queue priority where configured
  • Estimated consultation time
  • Service completion status

This information is used to facilitate patient flow and administrative coordination.

12. WhatsApp Services

Doxmate supports WhatsApp-based patient communication and appointment automation through the Meta WhatsApp Cloud API. Where enabled, Doxmate may process:

  • WhatsApp phone number
  • Patient name
  • Message content
  • Appointment details
  • Appointment confirmations
  • Reminder messages
  • Cancellation requests
  • Rescheduling requests
  • Follow-up communications
  • Delivery status
  • Read status
  • Conversation timestamps
  • Message templates
  • Other information necessary to provide the WhatsApp functionality

WhatsApp information is processed to provide the communication and automation features requested by the Healthcare Organization. Doxmate does not sell WhatsApp message content. WhatsApp communications may be processed through Meta's infrastructure. Meta may process information in accordance with its own terms and privacy policies. Healthcare Organizations are responsible for configuring their WhatsApp communication practices and obtaining any consent or authorization required by applicable law.

13. WhatsApp Automated Communication

Depending on the features enabled, Doxmate may automatically send administrative communications such as:

  • Appointment confirmations
  • Appointment reminders
  • Cancellation confirmations
  • Rescheduling communications
  • Follow-up reminders
  • Queue-related notifications
  • Patient responses to appointment enquiries
  • Other operational communications supported by the Platform

Healthcare Organizations are responsible for ensuring that their automated communications comply with applicable laws, regulations, and Meta's WhatsApp Business policies.

14. WhatsApp Inbox

Where the WhatsApp Inbox is enabled, authorized Healthcare Organization users may view and manage conversations between the organization and patients. Doxmate may process:

  • Conversation history
  • Message content
  • Patient contact information
  • Conversation timestamps
  • Appointment status
  • Message status
  • User actions
  • Internal operational information associated with the conversation

Access to conversations is controlled through the Healthcare Organization's account permissions.

15. Google Services

Doxmate provides optional integrations with certain Google services. Currently supported Google services may include:

  • Google Sign-In
  • Google Calendar
  • Google Sheets
  • Google Meet-related workflows where enabled through supported integrations

Google integrations are optional and require user authorization. Doxmate requests only the permissions reasonably necessary to provide the selected functionality.

16. Google Sign-In

If you choose to sign in using Google, Doxmate may receive:

  • Name
  • Email address
  • Google Account identifier
  • Profile information made available through the authorization process

Google Sign-In information is used to authenticate and manage your Doxmate account. Doxmate does not receive your Google account password through Google Sign-In.

17. Google Calendar

Where a user connects Google Calendar, Doxmate may process information necessary to synchronize appointments. This may include:

  • Calendar identifier
  • Calendar events
  • Appointment date and time
  • Event title
  • Event description
  • Calendar availability where required
  • Appointment status
  • Information necessary to create, update, or remove appointment events

Google Calendar information is used solely to provide the requested scheduling and synchronization functionality. Google Calendar data is not used for:

  • Advertising
  • Personalized marketing
  • Selling or licensing data
  • User profiling
  • Unrelated analytics
  • Training generalized AI models

Users may disconnect Google Calendar or revoke Doxmate's permissions at any time.

18. Google Sheets

Where Google Sheets integration is enabled, Doxmate may process information necessary to create, export, or update authorized operational reports. This may include:

  • Spreadsheet identifiers
  • Worksheet names
  • Spreadsheet metadata
  • Data generated by Doxmate for reporting
  • Appointment information
  • Operational records
  • Patient-related information included in authorized reports
  • Payment or follow-up information included in authorized reports

Doxmate only accesses Google Sheets information necessary to provide the functionality authorized by the user. Google Sheets data is not used for advertising, unrelated profiling, or generalized AI model training.

19. Google Meet and Online Appointment Workflows

Where Doxmate's supported Google Meet workflow is enabled through Google Calendar integration, Doxmate may process information necessary to generate or associate a meeting link with an appointment. This may include:

  • Appointment date and time
  • Doctor information
  • Patient appointment information
  • Calendar event information
  • Meeting identifier or meeting link

Doxmate provides the integration functionality but does not control Google's operation of Google Meet. Google processes information according to its own terms and privacy policies.

20. Google API Limited Use

Doxmate's use of information obtained through Google APIs is intended to comply with the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide the functionality requested by the user.

Doxmate does not sell Google user data. Doxmate does not use Google API data for advertising or personalized marketing. Doxmate does not use Google API data to develop, improve, or train generalized artificial intelligence or machine learning models. Google permissions can be reviewed or revoked through the user's Google Account settings.

21. AI-Powered Administrative Services

Doxmate currently provides AI-powered functionality for administrative and operational workflows. Depending on the features enabled, AI may assist with:

  • Appointment booking
  • Patient enquiries
  • Appointment scheduling
  • Appointment reminders
  • Follow-ups
  • Queue-related workflows
  • Patient communication
  • Administrative documentation
  • Patient summaries based on information provided through supported workflows
  • Review-management assistance
  • Operational assistance

AI processing may involve information already provided to Doxmate by the Healthcare Organization or patient.

22. AI Data Use

Doxmate processes information required to provide the requested AI functionality. Healthcare and patient information is not used by Doxmate to independently make medical decisions. Where AI is used to generate administrative summaries or responses, the output is generated from information available to the relevant Doxmate workflow.

Doxmate does not represent AI-generated information as a substitute for professional healthcare judgment. Healthcare professionals remain responsible for reviewing information and making clinical decisions.

23. AI and Medical Information

Doxmate may process healthcare information through administrative AI functionality when a Healthcare Organization enables such functionality. However:

  • Doxmate AI does not independently diagnose medical conditions.
  • Doxmate AI does not independently prescribe medication.
  • Doxmate AI does not replace a healthcare professional.
  • Doxmate AI does not independently make clinical decisions.
  • AI-generated summaries or information should be reviewed by an appropriately authorized healthcare professional where used in connection with patient care.

The Healthcare Organization remains responsible for determining whether and how AI-generated information should be used.

24. Google Data and AI

Google API data obtained through Google Calendar, Google Sheets, Google Sign-In, or supported Google integrations is not used by Doxmate to train generalized artificial intelligence or machine learning models. Where Google information is processed by an AI-powered feature, such processing is limited to providing the specific functionality requested by the authorized user.

25. Google Review and Reputation Management

Where Google Review-related functionality is enabled, Doxmate may process information necessary to:

  • Generate or provide a review link
  • Generate a QR code for the review link
  • Request patient feedback
  • Manage review-related workflows
  • Apply configured rating filters
  • Assist with review responses
  • Monitor authorized Google Business Profile information
  • Generate operational review insights

Where an organization enables automated review responses, the organization remains responsible for reviewing its configuration and ensuring that its communication practices comply with applicable laws and platform policies. Doxmate does not sell review information. Google processes Google Business Profile and review-related information under Google's own policies.

26. Information Collected Automatically

When you use Doxmate, we may automatically collect technical information such as:

  • IP address
  • Browser type
  • Device type
  • Operating system
  • Language
  • Login timestamps
  • Session information
  • Approximate geographic region
  • Device information
  • Error logs
  • Performance information
  • Network information
  • Security events

This information may be used to:

  • Maintain platform security
  • Detect abuse
  • Troubleshoot technical issues
  • Monitor system performance
  • Improve reliability
  • Prevent fraudulent or unauthorized activity

27. Cookies and Similar Technologies

Doxmate may use cookies, local storage, session technologies, and similar technologies for purposes including:

  • Authentication
  • Secure sessions
  • Remembering preferences
  • Security
  • Fraud prevention
  • Performance monitoring
  • Analytics
  • Platform functionality

Third-party services integrated with Doxmate may also use their own cookies or similar technologies. Where required by applicable law, Doxmate will obtain consent for non-essential cookies. You may control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Platform.

28. Analytics and Usage Information

Doxmate may collect information about how users interact with the Platform, including:

  • Features used
  • Pages viewed
  • Navigation patterns
  • Session information
  • System errors
  • Performance metrics
  • API usage
  • Operational activity

This information may be used to maintain, secure, troubleshoot, and improve Doxmate. Where possible, analytics may be aggregated or de-identified.

29. Customer Support Information

When you contact Doxmate, we may collect:

  • Name
  • Email
  • Phone number
  • Organization information
  • Support requests
  • Correspondence
  • Screenshots
  • Diagnostic information
  • Feedback
  • Relevant account or technical information

This information is used to investigate issues, provide support, maintain service quality, and improve the Platform.

30. How We Use Personal Data

Depending on the context, Doxmate may use Personal Data to:

  • Create and manage accounts
  • Provide Doxmate services
  • Process appointments
  • Manage patient records
  • Provide EMR functionality
  • Support billing
  • Manage queues
  • Send appointment communications
  • Provide WhatsApp automation
  • Provide AI administrative assistance
  • Generate administrative summaries
  • Synchronize authorized Google services
  • Provide review-management functionality
  • Provide customer support
  • Maintain security
  • Detect fraud and abuse
  • Troubleshoot technical issues
  • Maintain backups and disaster recovery
  • Comply with applicable legal obligations
  • Enforce our agreements
  • Improve the reliability and performance of the Platform

We do not use Personal Data for purposes unrelated to the services provided unless permitted by law or authorized by the relevant party.

31. Healthcare Organizations as Data Controllers

Healthcare Organizations generally determine:

  • Why patient information is collected
  • What patient information is collected
  • How patient information is used
  • Who may access patient information
  • How long patient information should be retained
  • Whether patient consent is required
  • Which Doxmate features and integrations are enabled

Accordingly, Healthcare Organizations generally act as the Data Controller or Data Fiduciary, as applicable under relevant law, for patient information processed through Doxmate.

32. Doxmate as Data Processor / Service Provider

When Doxmate processes patient information on behalf of a Healthcare Organization, Doxmate generally acts as a Data Processor, service provider, or equivalent entity under applicable law. Doxmate processes such information:

  • To provide contracted services
  • According to the Healthcare Organization's configuration and instructions
  • To maintain security
  • To provide technical support
  • To comply with applicable legal obligations

Doxmate does not determine the medical purpose for which the Healthcare Organization collects patient information.

33. Patient Privacy Requests

Patients should generally direct requests concerning their medical records, appointments, prescriptions, clinical information, or other patient information to the Healthcare Organization responsible for their care.

Depending on applicable law, patients may have rights including:

  • Access
  • Correction
  • Deletion where legally permitted
  • Withdrawal of consent where applicable
  • Restriction or objection to certain processing
  • Other rights provided by applicable law

Doxmate will provide reasonable assistance to Healthcare Organizations where required by applicable law or contractual obligations.

34. Consent

Where consent is required by applicable law, Doxmate or the relevant Healthcare Organization will obtain consent before collecting or processing Personal Data. Consent should be:

  • Clear
  • Specific
  • Informed
  • Voluntary
  • Capable of being withdrawn where applicable

Where processing is permitted on another lawful basis, separate consent may not be required. Healthcare Organizations remain responsible for obtaining patient consent where they determine that consent is legally required.

35. Children and Minors

Doxmate may process information relating to minors when such information is provided by or on behalf of a Healthcare Organization for legitimate healthcare or administrative purposes. Healthcare Organizations are responsible for:

  • Obtaining required parental or guardian consent
  • Determining the lawful basis for processing
  • Managing access to pediatric records
  • Complying with applicable child-protection and privacy laws

Doxmate applies appropriate security measures to information relating to minors. Doxmate's AI administrative features do not independently diagnose, prescribe, or make clinical decisions regarding minors.

36. Data Sharing

Doxmate does not sell Personal Data or patient medical records. Information may be shared or made accessible only where reasonably necessary:

With the Healthcare Organization

Patient information may be accessed by authorized users designated by the Healthcare Organization.

With Service Providers

Doxmate may use trusted service providers for:

  • Cloud hosting
  • Infrastructure
  • Security
  • Authentication
  • Payment processing
  • Customer support
  • Analytics
  • Messaging
  • Technical operations

These providers are permitted to process information only as necessary to provide their services.

With Integrated Services

Information may be transmitted to services that the user or Healthcare Organization has intentionally connected, such as:

  • Meta WhatsApp Cloud API
  • Google Calendar
  • Google Sheets
  • Google services used for supported workflows
  • Payment providers

For Legal Requirements

Information may be disclosed where required by:

  • Law
  • Court order
  • Government authority
  • Regulatory requirement
  • Legal process

To Protect Rights and Security

Information may be disclosed where reasonably necessary to:

  • Prevent fraud
  • Detect security threats
  • Investigate abuse
  • Protect users
  • Protect Doxmate
  • Enforce legal agreements

37. Third-Party Services and Subprocessors

Doxmate relies on selected third-party providers to operate its services. Depending on the functionality used, third parties may include providers for:

  • Cloud infrastructure
  • Authentication
  • Payment processing
  • Messaging
  • Google integrations
  • Security
  • Analytics
  • Customer support

Third-party providers may process Personal Data only to the extent necessary to provide their services or comply with applicable law. Third-party services operate under their own terms and privacy policies.

38. Data Security

Doxmate implements reasonable administrative, technical, and organizational safeguards designed to protect Personal Data and healthcare information. These measures may include:

  • HTTPS/TLS encryption
  • Encryption of stored information where appropriate
  • Secure authentication
  • Role-Based Access Control
  • Least-privilege access
  • Audit logging
  • Session controls
  • Secure cloud infrastructure
  • Security monitoring
  • Vulnerability management
  • Backup and disaster recovery
  • Access restrictions
  • Confidentiality obligations for authorized personnel

No electronic system can guarantee absolute security. Users and Healthcare Organizations are also responsible for protecting their credentials, devices, accounts, and authorized access.

39. Data Retention

Doxmate retains information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

  • Providing services
  • Maintaining accounts
  • Maintaining healthcare records on behalf of Healthcare Organizations
  • Customer support
  • Security
  • Legal compliance
  • Financial and accounting requirements
  • Dispute resolution
  • Fraud prevention
  • Backup and disaster recovery

For patient information processed on behalf of a Healthcare Organization, retention is generally determined by the Healthcare Organization and applicable legal requirements. When information is no longer required, Doxmate may delete, anonymize, or securely dispose of it, subject to legal, contractual, backup, and security requirements.

40. Account Closure

When a Doxmate account is closed:

  • User access may be disabled.
  • Active services may be terminated.
  • Data may be retained for applicable legal, contractual, financial, security, or operational requirements.
  • Healthcare Organizations may request data export where supported and subject to applicable terms.
  • Backup copies may remain for a limited period according to backup retention procedures.

41. Backups and Disaster Recovery

Doxmate may maintain backups to support:

  • Service continuity
  • Disaster recovery
  • Security investigations
  • Data restoration
  • Business continuity

Backup copies are protected using reasonable security controls. Backups may continue to exist for a limited period after information is removed from active systems. Backups are not routinely accessed except when necessary for legitimate operational, security, legal, or recovery purposes.

42. Anonymized and Aggregated Information

Where appropriate, Doxmate may create aggregated or anonymized information that no longer reasonably identifies an individual. Such information may be used for purposes including:

  • Service analytics
  • Performance measurement
  • Capacity planning
  • Security analysis
  • Product improvement
  • Statistical reporting

We do not intentionally use anonymization to circumvent applicable privacy rights.

43. International Data Processing

Doxmate is a cloud-based platform and certain information may be processed or stored through service providers or infrastructure located in jurisdictions other than the location where the information was originally collected. International processing may be necessary for:

  • Cloud hosting
  • Backups
  • Security
  • Platform operations
  • Third-party integrations
  • Customer support
  • Disaster recovery

Where international transfers are subject to legal requirements, Doxmate will take reasonable measures to comply with applicable requirements.

44. Meta WhatsApp Data

WhatsApp communications may pass through Meta's infrastructure. Meta may process WhatsApp-related information according to Meta's applicable terms, policies, and infrastructure. Doxmate does not control Meta's independent processing of information. Healthcare Organizations should ensure that their use of WhatsApp through Doxmate complies with applicable privacy requirements and Meta's WhatsApp Business policies.

45. Data Breach and Security Incidents

Doxmate maintains processes designed to detect, investigate, contain, and respond to security incidents. Where Doxmate becomes aware of a confirmed breach affecting information processed on behalf of a Healthcare Organization, Doxmate will notify the relevant organization without undue delay or within the timeframe required by applicable law or contractual agreement.

Depending on the circumstances, Doxmate may:

  • Investigate the incident
  • Contain affected systems
  • Revoke compromised credentials
  • Apply security fixes
  • Restore services
  • Preserve relevant evidence
  • Assess affected information
  • Cooperate with authorities where legally required

Healthcare Organizations remain responsible for determining whether patient or regulatory notification is required under applicable law when they act as the Data Controller/Data Fiduciary.

46. Your Security Responsibilities

Users should:

  • Keep passwords confidential
  • Use strong passwords
  • Enable available security features
  • Avoid sharing account credentials
  • Maintain appropriate user permissions
  • Protect devices used to access Doxmate
  • Report suspected unauthorized access promptly
  • Disconnect integrations that are no longer required

If you believe your Doxmate account has been compromised, contact us immediately.

47. GDPR and International Privacy Rights

If you are located in the European Economic Area, United Kingdom, or another jurisdiction where GDPR or equivalent laws apply, you may have additional rights. Depending on applicable law, these may include:

  • Right to access
  • Right to correction
  • Right to deletion
  • Right to restriction
  • Right to object
  • Right to data portability
  • Right to withdraw consent
  • Right to lodge a complaint with a relevant supervisory authority

Where Doxmate acts as a Data Processor for a Healthcare Organization, requests concerning patient information should generally be directed to the relevant Healthcare Organization. Doxmate will provide reasonable assistance where required by applicable law.

48. India – Digital Personal Data Protection

Doxmate is committed to complying with applicable Indian privacy and data-protection requirements, including the Digital Personal Data Protection Act, 2023, to the extent applicable to our processing activities. Doxmate may update its privacy practices as applicable rules, regulations, notifications, and regulatory guidance develop. Nothing in this Privacy Policy limits any mandatory rights provided to individuals under applicable law.

49. Data Accuracy

Doxmate provides technology that allows Healthcare Organizations and authorized users to create and manage information. Healthcare Organizations are responsible for ensuring that information entered into the Platform is accurate and appropriately maintained. Doxmate may provide tools that assist with data organization, summaries, reminders, and automation, but users remain responsible for reviewing information where appropriate.

50. Privacy of Healthcare Information

Healthcare information is treated as confidential information. Doxmate restricts access based on legitimate operational requirements and uses reasonable security measures to protect healthcare information. Healthcare Organizations remain responsible for determining who within their organization should have access to patient information.

51. Changes to This Privacy Policy

Doxmate may update this Privacy Policy from time to time to reflect:

  • Changes in our services
  • Changes in currently available features
  • Changes in privacy laws
  • Changes in regulatory requirements
  • Security improvements
  • Changes in third-party integrations
  • Operational changes

When we make material changes, we may update the “Last Updated” date and provide additional notice where required by applicable law. We recommend reviewing this Privacy Policy periodically.

52. Contact Us

If you have questions about this Privacy Policy, Personal Data, healthcare information, privacy requests, security concerns, or data processing practices, please contact us.

Brainox Tech – Doxmate

Business Owner: Pratyaksh Gautam

Email: hello@doxmate.in

Website: www.doxmate.in

Phone: +91 76654 27777

Address: A-43, New Mansarovar Colony, Chittor Road, Bundi, Rajasthan, India – 323001

For patient-record requests, we generally recommend contacting the Healthcare Organization responsible for the relevant patient relationship first.

53. Acknowledgement

By accessing or using Doxmate, you acknowledge that you have had the opportunity to review this Privacy Policy and understand how Personal Data may be processed in connection with the Doxmate Platform. Where applicable, use of specific features may also be subject to additional terms, notices, consent requirements, or agreements.

© 2026 Brainox Tech. All rights reserved.

Data Protection Agreement

Version 2.0 · Effective Date: 23 August 2026 · Last Updated: 23 August 2026

This Data Protection Agreement (“DPA”) forms part of the agreement between Brainox Tech, operating the Doxmate platform (“Doxmate”, “Processor”, “we”, “us”, or “our”) and the clinic, hospital, healthcare organization, diagnostic centre, or other authorized organization using Doxmate (“Controller”, “Customer”, “you”, or “your”).

This DPA governs the processing of Personal Data by Doxmate on behalf of the Controller in connection with the Doxmate Platform and is intended to establish the respective responsibilities of the parties regarding the protection of Personal Data.

This DPA applies to the extent required by applicable data protection, privacy, cybersecurity, healthcare, and electronic communications laws.

1. Definitions

“Controller”

Means the clinic, hospital, healthcare organization, diagnostic centre, or other entity that determines the purposes and means of processing Personal Data. For patient and healthcare information, the Healthcare Organization will generally act as the Controller/Data Fiduciary.

“Processor”

Means Brainox Tech, the operator of Doxmate, when processing Personal Data on behalf of the Controller.

“Data Subject”

Means an identified or identifiable individual whose Personal Data is processed through the Services, including patients, doctors, staff, administrators, or other individuals.

“Personal Data”

Means information relating to an identified or identifiable individual, as defined under applicable data protection law.

“Health Data”

Means information relating to an individual's physical or mental health, medical history, diagnoses, prescriptions, laboratory reports, treatment information, allergies, clinical notes, vital signs, or other healthcare information processed through Doxmate's healthcare-management functionality.

“Processing”

Means any operation performed on Personal Data, including collection, recording, organization, storage, retrieval, consultation, use, transmission, disclosure, modification, deletion, restriction, or destruction.

“Services”

Means the currently available Doxmate Platform and its enabled functionality, which may include appointment management, patient management, EMR, prescription management, billing and invoice management, queue and token management, WhatsApp-based communication, AI Agent functionality, patient communication automation, reminders and follow-ups, engagement and review-management functionality, Growth Agent functionality, Google Business Profile/review-related workflows, Google Sign-In, Google Calendar, Google Sheets, Google Meet-related workflows, and other integrations and administrative functionality made available by Doxmate. The specific Services available to a Controller depend on the features enabled for its account.

“Subprocessor”

Means a third party engaged by Doxmate to process Personal Data in connection with providing the Services.

“Applicable Laws”

Means privacy, data protection, healthcare, cybersecurity, consumer protection, electronic communications, and other laws applicable to the relevant processing activities, including the Digital Personal Data Protection Act, 2023 (India), where applicable, and the GDPR where applicable.

2. Subject Matter and Purpose of Processing

The Processor may process Personal Data on behalf of the Controller to provide, maintain, secure, and support the Services. Depending on the Services enabled, processing may include:

  • Creating and managing patient appointments
  • Scheduling and rescheduling appointments
  • Sending appointment confirmations and reminders
  • Managing patient queues and tokens
  • Managing patient profiles and records
  • Maintaining Electronic Medical Records
  • Managing prescriptions
  • Managing billing and invoices
  • Providing WhatsApp-based patient communication
  • Operating AI-powered administrative workflows
  • Generating AI-assisted administrative summaries
  • Managing patient enquiries
  • Managing patient engagement workflows
  • Managing review and reputation workflows
  • Supporting Growth Agent functionality
  • Synchronizing authorized information with connected third-party services
  • Generating operational reports
  • Providing analytics and dashboards
  • User authentication and account management
  • Customer support
  • Security monitoring
  • Troubleshooting
  • Backup and disaster recovery
  • Preventing fraud, abuse, and unauthorized access
  • Complying with applicable legal obligations

Doxmate will not process Personal Data for purposes unrelated to the Services except where required by law or otherwise permitted under an applicable agreement.

3. Categories of Data Subjects

Depending on the Services used, Doxmate may process Personal Data relating to:

  • Patients
  • Prospective patients
  • Doctors
  • Healthcare professionals
  • Nurses and clinical staff
  • Receptionists
  • Clinic administrators
  • Hospital administrators
  • Other authorized staff
  • Users of the Doxmate Platform
  • Individuals communicating with a Healthcare Organization through supported channels

4. Categories of Personal Data

Depending on the Services enabled, the Processor may process the following categories of Personal Data.

4.1 Patient and Appointment Data

  • Name
  • Phone number
  • Email address
  • Date of birth
  • Gender
  • Address
  • Appointment date and time
  • Appointment status
  • Doctor/provider information
  • Cancellation information
  • Rescheduling information
  • Reminder and follow-up information
  • Queue/token information
  • Check-in information
  • Administrative notes

4.2 Healthcare and EMR Data

Where the Controller uses Doxmate's EMR or healthcare-management functionality, Doxmate may process:

  • Medical history
  • Clinical notes
  • Diagnoses entered by authorized healthcare professionals
  • Prescriptions
  • Medication information
  • Allergies
  • Vital signs
  • Laboratory information
  • Medical reports
  • Treatment information
  • Uploaded healthcare documents
  • Other healthcare information entered into the Platform

The Controller remains responsible for determining the lawful basis, purpose, accuracy, and retention requirements applicable to such healthcare information.

4.3 Account and Staff Data

  • Name
  • Email address
  • Phone number
  • User role
  • Professional information
  • Login and authentication information
  • Organization information
  • Permissions and access information

4.4 Billing and Payment Information

Depending on the Services used:

  • Invoice information
  • Billing information
  • Payment status
  • Transaction identifiers
  • Subscription information
  • Tax-related information
  • Billing contact information

Payment card or financial information may be processed directly by applicable payment providers where applicable.

4.5 WhatsApp and Communication Data

Where WhatsApp Services are enabled:

  • WhatsApp phone numbers
  • Message content
  • Appointment-related communications
  • Reminder communications
  • Follow-up communications
  • Patient enquiries
  • Conversation history
  • Delivery and read status
  • Messaging metadata

4.6 Queue and Operational Data

  • Token number
  • Queue position
  • Check-in status
  • Consultation status
  • Doctor assignment
  • Waiting-time information
  • Appointment workflow status

4.7 AI-Processed Information

Where AI functionality is enabled, Doxmate may process:

  • Patient enquiries
  • Conversation information
  • Appointment information
  • Clinic information
  • Administrative information
  • Information provided for AI-assisted summaries
  • Other information necessary to perform the selected AI workflow

AI processing is subject to Doxmate's applicable privacy, security, and ethical AI policies.

4.8 Technical and Usage Data

  • IP address
  • Device information
  • Browser information
  • Authentication logs
  • Access logs
  • API logs
  • Error logs
  • Security events
  • Service usage information

5. Processing of Health Data

The Controller acknowledges that certain Doxmate Services may process Health Data. Where Doxmate processes Health Data on behalf of the Controller:

  • The Controller remains responsible for determining the lawful purpose and basis for processing.
  • The Controller determines which Health Data is entered into the Platform.
  • The Controller determines applicable retention periods, subject to applicable law.
  • Doxmate processes Health Data to provide the Services and according to the Controller's instructions, except where otherwise required by law.
  • Doxmate applies reasonable technical and organizational safeguards to protect Health Data.

Doxmate does not independently determine a patient's medical treatment, diagnosis, or clinical care.

6. Processing Instructions

Doxmate shall process Personal Data:

  1. To provide the Services;
  2. In accordance with the Controller's documented instructions;
  3. As reasonably necessary to maintain, secure, troubleshoot, and support the Services;
  4. As required by applicable law.

If Doxmate is required by law to process Personal Data beyond the Controller's instructions, Doxmate will, where legally permitted, inform the Controller of that requirement. Doxmate may process information in aggregated or anonymized form for legitimate purposes where such information no longer identifies an individual.

7. Controller Responsibilities

The Controller is responsible for:

  • Establishing a lawful basis for processing Personal Data.
  • Providing appropriate privacy notices to Data Subjects.
  • Obtaining consent where legally required.
  • Ensuring that Personal Data supplied to Doxmate is accurate and lawful.
  • Determining appropriate retention periods.
  • Ensuring that users have appropriate authority to access patient information.
  • Configuring user permissions appropriately.
  • Protecting account credentials.
  • Complying with applicable healthcare and privacy requirements.
  • Ensuring that communications sent through WhatsApp and other channels are lawful and appropriate.
  • Responding to Data Subject requests where the Controller is responsible for doing so.
  • Providing Doxmate with reasonable instructions necessary to process Personal Data.

The Controller must not use the Services for unlawful processing or in a manner that violates applicable laws or third-party platform policies.

8. Processor Obligations

Doxmate shall:

8.1 Process Data Appropriately

Process Personal Data only for purposes connected with the Services, the Controller's instructions, or applicable legal requirements.

8.2 Maintain Confidentiality

Ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations.

8.3 Implement Security Measures

Maintain reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, unauthorized disclosure, accidental loss, destruction, alteration, or unauthorized processing. Security measures may include:

  • Encryption
  • Access controls
  • Authentication
  • Role-based permissions
  • Logging
  • Monitoring
  • Secure cloud infrastructure
  • Network security
  • Backup controls
  • Incident-response procedures

8.4 Assist the Controller

Where reasonably required, Doxmate will assist the Controller with:

  • Data access requests
  • Correction requests
  • Deletion requests
  • Restriction requests
  • Data portability requests
  • Security assessments
  • Incident investigations
  • Regulatory obligations

Such assistance may be subject to reasonable technical limitations and costs where permitted by law.

9. Confidentiality

Doxmate shall take reasonable measures to ensure that personnel and contractors with access to Personal Data are authorized to access such information, receive appropriate confidentiality obligations, and access information only when necessary for their responsibilities. Confidentiality obligations continue after the individual's employment, engagement, or access to the Services ends.

10. Data Security

Doxmate maintains security practices described in its Data Protection & Security Policy. Depending on the relevant Service, these may include:

  • TLS/HTTPS for data transmission
  • Encryption of stored information where appropriate
  • Role-Based Access Control
  • Least-privilege access
  • Authentication controls
  • Security monitoring
  • Logging
  • Backup and recovery mechanisms
  • Infrastructure security
  • API security
  • Access reviews
  • Incident-response procedures

No online service can guarantee absolute security. Doxmate will maintain reasonable safeguards appropriate to the nature and risks of the processing.

11. Assistance With Data Subject Rights

Where the Controller is legally responsible for responding to a Data Subject request, Doxmate will provide reasonable assistance where technically applicable. This may include assistance with:

  • Access
  • Correction
  • Deletion
  • Restriction
  • Objection
  • Data portability

Doxmate may require the Controller to verify the identity and authority of the requesting Data Subject. Doxmate will not independently disclose patient information to a requester where the Controller's authorization or applicable legal requirements are necessary.

12. Security Incident and Breach Notification

If Doxmate becomes aware of a confirmed Personal Data breach affecting Personal Data processed on behalf of the Controller, Doxmate will notify the Controller without undue delay, subject to applicable law. Where reasonably available, the notification may include:

  • Nature of the incident
  • Categories of affected information
  • Approximate number of affected Data Subjects
  • Approximate number of affected records
  • Known or suspected cause
  • Measures taken to contain the incident
  • Remediation measures
  • Recommended steps for mitigation

Doxmate will provide reasonable cooperation to assist the Controller with applicable breach-response obligations. The Controller remains responsible for regulatory or Data Subject notifications where required by applicable law, unless the law places such responsibility directly on Doxmate.

13. Subprocessors

Doxmate may use third-party Subprocessors to provide infrastructure, communications, integrations, payment functionality, analytics, security, or other Platform capabilities. Depending on the Services used, categories of Subprocessors may include:

Cloud Infrastructure

  • Amazon Web Services (AWS)

Messaging

  • Meta / WhatsApp Cloud API

Google Services

  • Google Cloud / Google APIs
  • Google Identity Services
  • Google Calendar
  • Google Sheets
  • Other Google services specifically authorized by the user

Payment Services

Payment processors used by Doxmate where applicable.

Security, Monitoring and Infrastructure Services

Third-party providers used for hosting, monitoring, security, logging, communications, or infrastructure operations where applicable.

Doxmate may update its Subprocessors as its Platform and infrastructure evolve. Where applicable law requires notice or approval of material Subprocessor changes, Doxmate will provide such notice or obtain such approval in accordance with the applicable requirements.

14. Subprocessor Obligations

Doxmate will require relevant Subprocessors to implement appropriate confidentiality and security measures appropriate to the services they provide. Subprocessors may process Personal Data only to the extent necessary to provide the relevant services, comply with applicable law, or perform their contractual obligations. Doxmate remains responsible for managing its Subprocessors in accordance with applicable legal requirements.

15. Google User Data

Where the Controller or authorized user connects Google Services, Google User Data may be processed in accordance with the permissions granted through Google OAuth. Supported Google integrations may include Google Sign-In, Google Calendar, and Google Sheets. Google data will be accessed only to provide the functionality authorized by the user.

Doxmate does not sell Google User Data and does not use Google User Data for advertising or personalized marketing. Google User Data obtained through Google APIs is not used to develop, improve, or train generalized AI or machine-learning models. Doxmate's use of Google User Data is subject to the Google API Services User Data Policy, including applicable Limited Use requirements.

16. WhatsApp Data

Where the Controller enables WhatsApp Services:

  • WhatsApp communications may be transmitted through Meta's WhatsApp Cloud API.
  • Doxmate may process message content and messaging metadata necessary to provide the enabled functionality.
  • Meta independently operates its WhatsApp infrastructure and may process information under its own policies and legal requirements.
  • The Controller is responsible for ensuring its WhatsApp communications comply with applicable law and Meta/WhatsApp policies.

Doxmate cannot control information independently retained by Meta or by a Data Subject's WhatsApp device.

17. International Data Transfers

Personal Data may be processed or stored in jurisdictions outside the Controller's country depending on the infrastructure, Subprocessors, and Services used. Where applicable law restricts international transfers, Doxmate will implement appropriate safeguards required by that law. Depending on the jurisdiction, safeguards may include:

  • Standard Contractual Clauses
  • Appropriate contractual protections
  • Adequacy mechanisms
  • Technical security measures
  • Encryption
  • Access controls

The parties acknowledge that cloud-based services and third-party integrations may involve international processing.

18. Data Retention

Personal Data will be retained for as long as reasonably necessary to:

  • Provide the Services
  • Maintain the Controller's account
  • Meet the Controller's instructions
  • Meet legal obligations
  • Maintain security
  • Resolve disputes
  • Maintain financial and accounting records
  • Support backup and disaster recovery

For healthcare records, the Controller generally determines appropriate retention periods subject to applicable healthcare and data-protection requirements. Doxmate may retain certain technical, security, billing, or legal records after account termination where required or permitted by law.

19. Return and Deletion of Data

Upon termination of the Services or a valid written deletion request, Doxmate will delete or return Personal Data in accordance with the applicable agreement and Doxmate's Data Deletion Policy, subject to legal retention requirements. Where technically and legally applicable:

  • Active account data will be deleted within the applicable deletion period.
  • The Controller may request export or return of available data before deletion.
  • Backup copies may remain temporarily until the applicable backup-retention cycle ends.
  • Data required to comply with law may be retained for the legally required period.
  • Security, fraud-prevention, billing, and dispute-related information may be retained where legally permitted.

Doxmate may anonymize information where appropriate instead of deleting it.

20. Audits and Compliance Information

Where required by applicable law or contractual agreement, Doxmate may provide reasonable information necessary to demonstrate compliance with its data-protection obligations. This may include:

  • Security documentation
  • Data-protection policies
  • Subprocessor information
  • High-level infrastructure information
  • Security-control descriptions
  • Incident information where applicable

Any formal audit must:

  • Be reasonably scoped.
  • Be conducted with reasonable advance notice.
  • Avoid unnecessary disruption to Doxmate's operations.
  • Protect the confidentiality and security of Doxmate and other customers.
  • Not expose other customers' information.

Additional audit requirements may be subject to reasonable costs and contractual arrangements.

21. Data Protection Impact Assessments

Where reasonably necessary and required by applicable law, Doxmate will provide reasonable assistance to the Controller with information relevant to a Data Protection Impact Assessment (DPIA). The Controller remains responsible for conducting its own DPIA where legally required.

22. Regulatory and Government Requests

Doxmate may disclose Personal Data where required by:

  • Applicable law
  • Court order
  • Government authority
  • Law-enforcement request
  • Regulatory requirement

Where legally permitted, Doxmate may notify the Controller of such requests. Doxmate may challenge or limit an unlawful or overbroad request where reasonably appropriate.

23. Liability

Each party remains responsible for its own obligations under applicable law. The Controller remains responsible for:

  • Lawful collection and use of Personal Data
  • Patient notices and consent where required
  • User permissions
  • Clinical and healthcare decisions
  • Instructions provided to Doxmate

Doxmate remains responsible for its obligations regarding processing and safeguarding Personal Data under its control and applicable contractual obligations. Any limitation of liability or indemnification obligations will be governed by the applicable primary agreement between the parties.

24. Term and Termination

This DPA remains effective for as long as Doxmate processes Personal Data on behalf of the Controller. Upon termination:

  • Access may be disabled.
  • Processing will cease except where necessary for legal, security, backup, or other permitted purposes.
  • Personal Data will be returned or deleted in accordance with Section 19.
  • Confidentiality obligations will continue.
  • Applicable security and legal obligations will survive as required.

25. Conflict With Other Agreements

If there is a conflict between this DPA and another agreement between the parties regarding the processing of Personal Data, the parties will interpret the documents to give effect to applicable data-protection requirements. Where the primary agreement contains specific data-protection terms that expressly override this DPA, those terms will apply to the extent legally permitted.

26. Governing Law

This DPA will be governed by the governing-law provisions of the primary service agreement between the parties. Where no separate governing-law provision exists, the laws applicable to the contractual relationship between Brainox Tech and the Controller will apply, subject to mandatory data-protection requirements applicable to the processing.

27. Changes to This DPA

Doxmate may update this DPA where reasonably necessary to reflect:

  • Changes to the Doxmate Platform
  • Changes to Services
  • Changes to Subprocessors
  • Changes to applicable law
  • Changes to security practices
  • Changes to data-processing requirements

Where a change materially affects the Controller's obligations or rights and applicable law requires notice, Doxmate will provide appropriate notice. The latest version will be published on the Doxmate website where applicable.

28. Contact Information

For data protection, privacy, security, or DPA-related matters:

Doxmate

Registered Business Name: Brainox Tech

Business Owner: Pratyaksh Gautam

Data Protection & Privacy: hello@doxmate.in

Security: hello@doxmate.in

Support: hello@doxmate.in

Phone: +91 76654 27777

Website: https://www.doxmate.in

Address: A-43, New Mansarovar Colony, Chittor Road, Bundi, Rajasthan, India – 323001

© 2026 Brainox Tech. All rights reserved.

Data Protection & Security Policy

Effective Date: 23 August 2026 · Last Updated: 23 August 2026

Doxmate is a healthcare technology platform operated by Brainox Tech. We prioritize the confidentiality, integrity, and availability of patient, clinic, healthcare, and organizational information processed through our Platform.

This Data Protection & Security Policy describes the security practices and safeguards Doxmate uses to protect information entrusted to us. This policy applies to the currently available Doxmate services, including the Doxmate website, admin dashboard, account systems, appointment management, patient management, EMR, prescription management, billing, queue management, WhatsApp Cloud API workflows, WhatsApp Inbox, AI-powered administrative features, supported Google integrations, Google Review functionality, and associated backend systems.

1. Scope of the Policy

This policy applies to information processed through Doxmate, including:

  • Clinic and hospital information
  • Patient and appointment information
  • Healthcare and EMR information
  • Prescription information
  • Billing and invoice information
  • Queue and check-in information
  • Staff and user accounts
  • Authentication and access information
  • WhatsApp messages and messaging metadata
  • Google integration information
  • AI-generated administrative summaries and outputs
  • Operational and analytics information
  • System, security, and audit logs

This policy covers:

  • Doxmate applications
  • Cloud infrastructure
  • Databases
  • APIs
  • AI automation workflows
  • WhatsApp integrations
  • Third-party integrations
  • Backup systems
  • Internal operational procedures

2. Data Classification

Doxmate may process different categories of information depending on the services enabled by a Healthcare Organization.

A. Account and Organizational Data

Examples include:

  • Clinic or hospital name
  • Doctor information
  • Administrator information
  • Staff information
  • Email addresses
  • Phone numbers
  • User roles
  • Account configuration
  • Business information

B. Patient and Administrative Data

Examples include:

  • Patient name
  • Phone number
  • Email address
  • Appointment information
  • Queue/token information
  • Check-in information
  • Reminder and follow-up information
  • Communication history
  • Administrative notes

C. Healthcare Information

Where the Healthcare Organization uses Doxmate's EMR, prescription, or patient-management functionality, Doxmate may process healthcare information including:

  • Medical history
  • Clinical notes
  • Diagnoses entered by healthcare professionals
  • Prescriptions
  • Medication information
  • Allergies
  • Vital signs
  • Laboratory information
  • Medical reports
  • Treatment information
  • Uploaded healthcare documents

Doxmate treats healthcare information as confidential and applies appropriate security controls based on the nature of the information.

D. Technical and Security Data

Doxmate may also process:

  • IP addresses
  • Authentication information
  • Device information
  • Access logs
  • API logs
  • Error logs
  • Security events
  • System performance information

3. Security Principles

Doxmate's security program is based on the following principles:

  • Confidentiality: Information should only be accessible to authorized persons and systems.
  • Integrity: Appropriate controls are used to prevent unauthorized modification or destruction of information.
  • Availability: Systems are designed to support reliable access to services.
  • Least Privilege: Users and systems receive only the access reasonably necessary for their responsibilities.
  • Data Minimization: Doxmate seeks to process information reasonably necessary for providing the requested services.
  • Accountability: Security activities and access may be logged and reviewed where appropriate.

4. Security Measures

A. Encryption

Doxmate uses encryption and secure communication technologies to protect information.

In Transit

Communication between supported clients, Doxmate systems, APIs, and third-party services is protected using secure transport protocols such as HTTPS/TLS where applicable.

At Rest

Doxmate uses encryption mechanisms appropriate to the underlying infrastructure and storage systems for protecting stored information and backups. Where third-party infrastructure is used, applicable provider security controls also apply.

Credentials

Passwords and authentication credentials are protected using appropriate security mechanisms. Doxmate does not intentionally store passwords in plain text.

5. Cloud Infrastructure

Doxmate uses cloud infrastructure and technology providers to operate its Platform. Where AWS infrastructure is used, applicable security capabilities may include:

  • Network isolation
  • Identity and Access Management
  • Security groups
  • Firewall controls
  • Encrypted storage
  • Backup mechanisms
  • Monitoring
  • Logging
  • Infrastructure access controls

Cloud infrastructure providers maintain their own security certifications and compliance programs. Doxmate's use of a cloud provider does not transfer responsibility for Doxmate's own application-level security obligations.

6. Access Control

Doxmate uses access-control measures designed to restrict access to Personal Data and healthcare information. Depending on the system and account configuration, controls may include:

  • Role-Based Access Control (RBAC)
  • User roles and permissions
  • Least-privilege access
  • Administrative access restrictions
  • Authentication controls
  • Session management
  • Access logging
  • Credential management
  • Access reviews

Healthcare Organizations are responsible for assigning appropriate permissions to their employees and authorized users.

7. Administrative Access

Access to production systems and sensitive information is restricted to authorized personnel who require such access for legitimate business or technical purposes. Where appropriate:

  • Access is granted based on job responsibilities.
  • Access is reviewed periodically.
  • Privileged access is restricted.
  • Administrative activity may be logged.
  • Access may be revoked when no longer required.

Doxmate personnel are expected to maintain confidentiality of information accessed through their work.

8. Network and Application Security

Doxmate uses reasonable technical controls to protect its applications and infrastructure. Depending on the relevant system, these may include:

  • Network security controls
  • Firewall rules
  • Rate limiting
  • Input validation
  • Authentication controls
  • Authorization controls
  • Secure API design
  • Protection against common application vulnerabilities
  • Security monitoring
  • Error and event logging
  • Availability monitoring
  • Abuse detection

Security controls may be updated as the Platform evolves.

9. API Security

Doxmate provides and uses APIs for platform functionality and integrations. API security measures may include:

  • Authentication
  • Authorization
  • Access tokens
  • Rate limiting
  • Input validation
  • Request monitoring
  • Logging
  • Permission controls
  • Credential revocation

API credentials should not be publicly shared or stored in insecure locations.

10. WhatsApp Cloud API Security

Doxmate uses the Meta WhatsApp Cloud API for supported WhatsApp-based communication and automation. Doxmate applies reasonable safeguards to information processed through its WhatsApp integration. These may include:

  • Secure API communication
  • Authentication and authorization controls
  • Access restrictions
  • Message and event logging
  • Controlled integration credentials
  • Secure webhook processing
  • Protection against unauthorized API access

WhatsApp and Meta operate their own infrastructure and security controls. Doxmate cannot control Meta's independent processing, storage, retention, or security practices. Healthcare Organizations are responsible for using WhatsApp in accordance with applicable privacy requirements and Meta's applicable WhatsApp Business policies.

11. Google Integration Security

Doxmate supports certain Google integrations, including supported Google Sign-In, Google Calendar, Google Sheets, and Google Meet-related workflows. When these integrations are enabled:

  • Access requires appropriate authorization.
  • Doxmate requests permissions reasonably necessary for the selected functionality.
  • Access tokens and credentials are protected using reasonable security controls.
  • Users may revoke Google authorization.
  • Doxmate does not request a user's Google password through Google Sign-In.

Google independently operates its infrastructure and security controls.

12. AI Processing Security

Doxmate currently provides AI-powered administrative functionality. Depending on the enabled feature, AI may process information such as:

  • Patient enquiries
  • Appointment information
  • Administrative information
  • Conversation information
  • Information provided for patient summaries
  • Review-related information

Doxmate applies reasonable access and security controls to information processed by its AI-enabled workflows. AI-generated information is not automatically treated as a verified medical decision. Where healthcare information is processed through an AI-assisted workflow, appropriate authorized users remain responsible for reviewing information before relying on it for clinical or operational purposes where appropriate.

13. AI and Healthcare Information

Doxmate may process healthcare information through currently available administrative workflows where enabled by the Healthcare Organization. Doxmate's AI functionality does not replace professional medical judgment. Doxmate does not represent administrative AI outputs as:

  • A medical diagnosis
  • A medical prescription
  • Emergency medical advice
  • A substitute for a qualified healthcare professional

Healthcare Organizations remain responsible for determining appropriate use of AI-generated information.

14. Data Retention and Deletion

Doxmate retains information only for as long as reasonably necessary for:

  • Providing services
  • Maintaining accounts
  • Supporting Healthcare Organizations
  • Security
  • Legal compliance
  • Financial and accounting requirements
  • Dispute resolution
  • Backup and disaster recovery

Healthcare Organizations generally determine retention requirements for patient healthcare information processed on their behalf, subject to applicable law. Data deletion requests are handled according to Doxmate's Data Deletion Policy. Backups may continue to contain information for a limited period after deletion from active systems until the applicable backup-retention cycle is completed.

15. Backup and Disaster Recovery

Doxmate may maintain backups to support:

  • Business continuity
  • Disaster recovery
  • Data restoration
  • System recovery
  • Security investigations

Backups are protected using reasonable technical and organizational safeguards. Backup information may not be immediately deleted when information is removed from active systems. Backup copies are generally subject to scheduled retention and deletion procedures.

16. Organizational Security

Doxmate maintains organizational measures designed to protect confidential information. Depending on the circumstances, these may include:

  • Confidentiality obligations
  • Access restrictions
  • Security awareness
  • Privacy and security procedures
  • Internal access controls
  • Security reviews
  • Employee and contractor responsibilities
  • Offboarding access removal
  • Incident-response procedures

Personnel are granted access to information only where reasonably required for their responsibilities.

17. Security Monitoring and Logging

Doxmate may maintain logs and monitoring systems for:

  • Authentication activity
  • Administrative actions
  • API activity
  • Security events
  • System errors
  • Performance
  • Availability
  • Suspicious activity

Security logs may be retained for a reasonable period to support:

  • Security investigations
  • Fraud prevention
  • Troubleshooting
  • Compliance
  • Incident response

18. Vulnerability and Security Management

Doxmate may periodically review its applications and infrastructure for security risks. Depending on the system, security practices may include:

  • Vulnerability identification
  • Dependency updates
  • Security patches
  • Configuration reviews
  • Access reviews
  • Application security testing
  • Infrastructure monitoring
  • Incident analysis

Security practices may evolve as new threats and vulnerabilities emerge.

19. Incident Response and Breach Handling

Doxmate maintains procedures for responding to suspected or confirmed security incidents. Depending on the incident, response activities may include:

  1. Detection and assessment
  2. Containment
  3. Investigation
  4. Impact assessment
  5. Credential or access revocation
  6. Remediation
  7. System recovery
  8. Root-cause analysis
  9. Preventive improvements
  10. Notification where legally required

Where a confirmed incident affects information processed on behalf of a Healthcare Organization, Doxmate will notify the relevant organization as required by applicable law or contractual obligations. Where applicable law imposes a specific notification deadline, Doxmate will follow the legally applicable requirements.

20. User Responsibilities

Healthcare Organizations and users also have an important role in protecting information. Users should:

  • Use strong and unique passwords.
  • Keep login credentials confidential.
  • Avoid sharing accounts.
  • Assign access only to authorized staff.
  • Remove staff access when employment or authorization ends.
  • Protect devices used to access Doxmate.
  • Review user permissions periodically.
  • Report suspected unauthorized access.
  • Follow applicable privacy and healthcare requirements.
  • Use WhatsApp communication appropriately.
  • Obtain required patient permissions or consent where applicable.
  • Avoid entering information into Doxmate that they are not authorized to process.

Healthcare Organizations are responsible for determining the lawful basis for collecting and processing patient information and for maintaining appropriate patient-data practices.

21. Third-Party Providers and Subprocessors

Doxmate may rely on third-party providers necessary to operate its currently available services. Depending on the functionality used, these may include:

  • Amazon Web Services (AWS) — cloud infrastructure
  • Meta / WhatsApp Cloud API — WhatsApp communication
  • Google — supported authentication and productivity integrations
  • Payment providers — where applicable
  • Security, monitoring, and infrastructure providers — where applicable

Third-party providers may process information only to the extent reasonably necessary to provide their services or comply with applicable legal requirements. Third-party providers maintain their own privacy and security policies. Doxmate may update its third-party service providers as its infrastructure and services evolve.

For questions regarding current subprocessors or data-processing arrangements, contact hello@doxmate.in.

22. Cross-Border Data Processing

Doxmate is a cloud-based service. Depending on the infrastructure, integrations, and service providers used, information may be processed or stored in jurisdictions outside the country where the information was originally collected. Where cross-border processing is subject to applicable legal requirements, Doxmate will take reasonable measures required under applicable law. Such measures may include appropriate contractual, technical, or organizational safeguards.

23. Compliance Framework

Doxmate seeks to maintain security practices consistent with applicable legal and industry requirements. Depending on the relevant service and jurisdiction, our security and privacy practices may take into consideration:

  • Applicable Indian data-protection and information-technology requirements
  • Digital Personal Data Protection Act, 2023, to the extent applicable
  • GDPR requirements where applicable
  • Applicable contractual privacy requirements
  • Meta/WhatsApp Business policies
  • Google API requirements
  • Industry-standard information-security practices

References to security frameworks or regulatory requirements do not mean that Doxmate represents itself as formally certified under a particular standard unless expressly stated. Doxmate does not claim to be HIPAA compliant or ISO 27001 certified unless such certification is separately obtained and expressly communicated.

24. Security and Healthcare Data

Healthcare information requires appropriate safeguards because unauthorized disclosure or alteration may create significant risks. Doxmate therefore applies reasonable security controls to protect healthcare information processed through its currently available services. However, no internet-based service, cloud infrastructure, or electronic transmission method can guarantee absolute security. Doxmate cannot guarantee that information will never be subject to unauthorized access, loss, alteration, or disclosure despite reasonable safeguards.

25. Data Protection Requests

For questions or requests concerning:

  • Data security
  • Data protection
  • Security incidents
  • Personal Data
  • Data deletion
  • Data access
  • Privacy concerns

please contact Doxmate using the information below. Where Doxmate processes patient information on behalf of a clinic or hospital, the relevant Healthcare Organization may need to participate in the request process.

26. Policy Updates

Doxmate may update this Data Protection & Security Policy to reflect:

  • Changes to currently available services
  • Changes to infrastructure
  • Changes to security practices
  • Changes to third-party providers
  • Regulatory developments
  • New security requirements
  • Improvements to our security controls

The latest version will be published on the Doxmate website with the revised “Last Updated” date.

27. Contact Information

For privacy, data protection, security, or information-security inquiries:

Doxmate

Registered Business Name: Brainox Tech

Business Owner: Pratyaksh Gautam

Email: hello@doxmate.in

Phone: +91 76654 27777

Website: https://www.doxmate.in

Address: A-43, New Mansarovar Colony, Chittor Road, Bundi, Rajasthan, India – 323001

For security or data-protection matters, please use hello@doxmate.in.

© 2026 Brainox Tech. All rights reserved.

Data Deletion Policy

Effective Date: 23 August 2026 · Last Updated: 23 August 2026

At Doxmate, operated by Brainox Tech, we respect privacy, healthcare confidentiality, and the rights of individuals and organizations regarding their Personal Data.

This Data Deletion Policy explains how clinics, hospitals, administrators, staff members, and patients can request deletion of Personal Data processed through Doxmate.

Doxmate provides healthcare technology and administrative software. Depending on the service being used, Doxmate may process appointment information, patient information, healthcare records, billing information, WhatsApp communications, queue information, and other information entered or generated through the Platform.

For patient information processed on behalf of a clinic or hospital, the clinic or hospital generally acts as the Data Controller/Data Fiduciary, while Doxmate generally acts as a Data Processor/service provider.

1. Who This Policy Applies To

This policy applies to deletion requests from:

  • Clinics and hospitals using Doxmate
  • Doctors and healthcare professionals
  • Clinic administrators
  • Authorized clinic staff
  • Patients whose information is processed through Doxmate
  • Other individuals whose Personal Data is processed through Doxmate

2. Types of Data That May Be Deleted

Depending on the circumstances and applicable legal requirements, Doxmate may process and delete the following categories of information.

A. Account and Clinic Data

  • Clinic or hospital name
  • Business information
  • Administrator information
  • User accounts
  • Staff names
  • Staff phone numbers
  • Staff email addresses
  • User roles and permissions
  • Account configuration
  • Login-related information

B. Patient and Appointment Data

Depending on the Doxmate services used by the Healthcare Organization:

  • Patient name
  • Phone number
  • Email address
  • Date of birth
  • Gender
  • Address
  • Patient identifiers
  • Appointment dates and times
  • Appointment status
  • Cancellation and rescheduling information
  • Follow-up information
  • Queue/token information
  • Check-in information
  • Appointment reminders
  • Patient communication history
  • Administrative notes

C. Healthcare and EMR Data

Where the Healthcare Organization uses Doxmate's EMR and patient-management functionality, Doxmate may process information such as:

  • Medical history
  • Clinical notes
  • Diagnoses entered by healthcare professionals
  • Prescriptions
  • Medication information
  • Allergies
  • Vital signs
  • Laboratory information
  • Medical reports
  • Treatment information
  • Uploaded healthcare documents
  • Other healthcare information entered by authorized users

For patient healthcare records maintained on behalf of a clinic or hospital, deletion generally requires authorization from the relevant Healthcare Organization because that organization determines the purpose, retention requirements, and legal basis for maintaining the records.

D. Billing Data

Depending on the services used:

  • Invoice information
  • Billing records
  • Payment status
  • Transaction identifiers
  • Tax information
  • Subscription information
  • Billing contact information

Certain financial or tax records may need to be retained for legally required periods and therefore may not be immediately deletable.

E. WhatsApp Data

Where Doxmate's WhatsApp services are used, information may include:

  • WhatsApp phone numbers
  • Message content
  • Appointment-related messages
  • Reminder messages
  • Follow-up messages
  • Conversation history
  • Message timestamps
  • Delivery status
  • Read status
  • Messaging metadata
  • WhatsApp account/configuration information

F. Google Integration Data

Where a user has connected supported Google services, Doxmate may process information associated with:

  • Google account authentication
  • Google Calendar events
  • Calendar identifiers
  • Google Sheets information
  • Spreadsheet identifiers
  • Google Meet-related appointment information

Deletion of data associated with a connected Google service may also require the user to disconnect or revoke the relevant Google authorization.

G. System and Usage Information

Doxmate may process:

  • Access logs
  • Authentication logs
  • Security logs
  • API logs
  • Error logs
  • Device information
  • Technical information
  • Service usage information

Certain security and technical logs may be retained where reasonably necessary for security, fraud prevention, troubleshooting, legal compliance, or dispute resolution.

3. Important: Healthcare Records and Patient Data

Doxmate does not independently determine whether a patient's healthcare record should be deleted. For patient information processed on behalf of a clinic or hospital:

  • The clinic or hospital generally determines the applicable retention period.
  • The clinic or hospital is responsible for determining whether deletion is legally permitted.
  • The clinic or hospital may need to authorize a patient's deletion request.
  • Doxmate may require instructions or authorization from the relevant Healthcare Organization before deleting such information.

Accordingly, a patient requesting deletion of medical records should generally contact the clinic, hospital, doctor, or healthcare organization responsible for their care. Where Doxmate is legally required to assist with such a request, we will provide reasonable assistance.

4. What Happens When You Request Deletion

Depending on the type of information and the requester, Doxmate may:

  1. Verify the identity or authority of the requester.
  2. Identify the relevant account or information.
  3. Determine whether the request is valid and legally permissible.
  4. Coordinate with the relevant Healthcare Organization where required.
  5. Delete information from active systems where deletion is appropriate.
  6. Revoke relevant account or integration access where applicable.
  7. Retain only information that must legally or legitimately be retained.
  8. Delete or anonymize retained information when the applicable retention period ends.

Deletion may not always mean immediate physical removal from every backup or third-party system.

5. How to Request Data Deletion

Send your request to: hello@doxmate.in

Subject: Data Deletion Request

Please provide:

  • Full name
  • Clinic/hospital name, if applicable
  • Registered email address or phone number
  • Doxmate account information, if available
  • Description of the information you want deleted
  • Relevant patient or appointment details, where necessary
  • Proof of identity or authorization where required

For clinic or hospital requests involving patient information, the requester must demonstrate that they are authorized to make the request.

6. Verification Process

To protect Personal Data from unauthorized deletion, Doxmate may verify deletion requests. Verification may include:

  • Confirmation from the registered email address
  • Confirmation using the registered phone number
  • Account verification
  • Identity verification
  • Clinic administrator or owner authorization
  • Patient appointment information
  • Additional documentation where reasonably necessary

Doxmate may refuse or delay a request where identity or authorization cannot be adequately verified.

7. Deletion Timeline

After receiving a valid and sufficiently verified request:

  • Initial acknowledgement: generally within 7 business days.
  • Deletion from active systems: generally within 30 days where deletion is legally permitted and technically applicable.
  • Backups: information may remain in encrypted backups for a limited additional period until the applicable backup retention cycle completes.
  • Confirmation: where appropriate, Doxmate will confirm completion of the deletion request by email.

Complex requests, requests involving multiple systems, third-party services, legal obligations, or Healthcare Organization authorization may require additional time. Where an extension is necessary, Doxmate will provide appropriate notice where required by applicable law.

8. WhatsApp Data Deletion

For WhatsApp-related information processed through Doxmate:

  • Doxmate may delete stored conversation information and messaging metadata where deletion is valid and legally permitted.
  • Deletion from Doxmate does not necessarily delete messages stored by Meta or on the patient's own WhatsApp device.
  • Meta may retain certain information under its own policies and legal obligations.
  • Doxmate cannot control information independently retained by Meta or WhatsApp.

Where applicable, Doxmate may also revoke WhatsApp-related credentials, tokens, or connections when a clinic terminates its Doxmate account.

9. Google Integration Data Deletion

When a user disconnects a supported Google integration:

  • Doxmate will stop accessing the relevant Google service through the revoked authorization.
  • Data already processed by Doxmate may be deleted according to this policy and applicable retention requirements.
  • Information independently retained within the user's Google Account is not deleted by Doxmate.
  • Users may separately delete information from their Google Account where appropriate.

Revoking Google authorization does not necessarily delete information previously entered into Doxmate.

10. Clinic Administrator Deletion Requests

Authorized clinic administrators may request:

  • Staff account deletion
  • Staff access removal
  • Patient information deletion
  • Appointment information deletion
  • WhatsApp conversation deletion
  • Clinic configuration deletion
  • Integration disconnection
  • Full clinic account deletion

For requests involving patient healthcare information, Doxmate may require confirmation from the clinic owner or another authorized representative.

11. Account Offboarding and Full Clinic Deletion

When a clinic or hospital permanently terminates its Doxmate account, the organization may request deletion of its Doxmate data. Subject to applicable legal and contractual requirements, the offboarding process may include:

  • Disabling user access
  • Removing staff access
  • Disconnecting supported integrations
  • Revoking relevant API credentials or tokens
  • Deleting active clinic data
  • Deleting stored appointment information
  • Deleting stored WhatsApp information
  • Deleting or anonymizing information where appropriate
  • Beginning applicable backup deletion cycles

Certain information may be retained where required for legal, financial, security, fraud-prevention, dispute-resolution, or regulatory purposes.

12. Data That May Be Retained

Doxmate may retain certain information when deletion is not legally or technically appropriate, including:

  • Financial and billing records required by law
  • Tax records
  • Records required to comply with legal obligations
  • Security and audit logs
  • Information necessary to investigate fraud or abuse
  • Information required to establish, exercise, or defend legal claims
  • Information required by applicable contractual obligations
  • Information that must be retained under applicable healthcare requirements
  • Information maintained in encrypted backups until the scheduled backup-retention period ends

Retained information will be limited to what is reasonably necessary for the applicable purpose.

13. Deletion Does Not Always Mean Immediate Erasure Everywhere

A deletion request applies to information under Doxmate's control. Doxmate cannot directly delete information independently controlled by third parties, including:

  • Meta/WhatsApp
  • Google
  • Payment providers
  • Healthcare Organizations
  • Other third-party services

Where appropriate, users may need to submit separate deletion requests directly to those third parties.

14. Anonymization

Where deletion is not required or where appropriate for legitimate operational purposes, Doxmate may anonymize information so that it can no longer reasonably be associated with an identifiable individual. Properly anonymized information may be retained and used for legitimate purposes such as:

  • Aggregated analytics
  • System performance analysis
  • Capacity planning
  • Security analysis
  • Service improvement

15. Legal and Regulatory Exceptions

Doxmate may refuse, restrict, or delay deletion where retaining information is necessary to:

  • Comply with applicable law
  • Comply with a court order or lawful government request
  • Meet financial or tax requirements
  • Protect the security of Doxmate
  • Investigate fraud or abuse
  • Resolve disputes
  • Establish, exercise, or defend legal claims
  • Comply with applicable contractual obligations
  • Protect the rights or safety of users or other persons

Where deletion is restricted, Doxmate will retain only the information reasonably necessary for the applicable purpose.

16. Your Privacy Rights

Depending on your location and applicable law, you may have rights including:

  • Right to access Personal Data
  • Right to correction
  • Right to deletion
  • Right to restriction of processing
  • Right to data portability
  • Right to object to certain processing
  • Right to withdraw consent where processing is based on consent
  • Right to lodge a complaint with an applicable regulatory authority

Where Doxmate processes information on behalf of a clinic or hospital, some requests may need to be directed to that Healthcare Organization.

17. India Data Protection

Doxmate is committed to complying with applicable Indian privacy and data-protection requirements, including the Digital Personal Data Protection Act, 2023, to the extent applicable to our processing activities. Data deletion requests will be handled in accordance with applicable law, contractual obligations, and the role of Doxmate and the relevant Healthcare Organization in processing the information.

18. Security During Deletion

Doxmate applies reasonable security measures during the deletion process to prevent unauthorized access, alteration, or disclosure. Deletion may include:

  • Removal from active databases
  • Removal from application storage
  • Revocation of access credentials
  • Removal of account permissions
  • Secure deletion or anonymization where technically applicable
  • Eventual removal from backups according to the applicable backup-retention cycle

19. Changes to This Data Deletion Policy

Doxmate may update this Data Deletion Policy when:

  • Our live services change
  • Our deletion procedures change
  • Privacy laws or regulations change
  • Third-party integrations change
  • Security practices are updated

The latest version will be published on the Doxmate website.

20. Contact Information

For data deletion requests, privacy questions, or concerns:

Doxmate

Operated by: Brainox Tech

Business Owner: Pratyaksh Gautam

Email: hello@doxmate.in

Phone: +91 76654 27777

Website: www.doxmate.in

Address: A-43, New Mansarovar Colony, Chittor Road, Bundi, Rajasthan, India – 323001

Subject for deletion requests: Data Deletion Request

For patient healthcare-record deletion requests, we recommend contacting the relevant clinic, hospital, or healthcare professional first, as they generally determine the retention and deletion requirements for those records.

© 2026 Brainox Tech. All rights reserved.

Medical Disclaimer

Effective Date: 23 August 2026 · Last Updated: 23 August 2026

Doxmate is an AI-powered healthcare technology and clinic operations platform operated by Brainox Tech. Doxmate provides healthcare organizations with tools for appointment management, patient records, prescriptions, billing, queue management, patient communication, WhatsApp automation, AI-powered administrative workflows, patient engagement, and related healthcare-management functions.

Doxmate is a technology platform. It does not replace qualified healthcare professionals, clinical judgment, or emergency medical services.

This Medical Disclaimer explains the limitations and responsibilities associated with using Doxmate.

1. Doxmate Is Not a Substitute for a Healthcare Professional

Doxmate provides software tools that may assist healthcare organizations with administrative and operational activities. Doxmate does not replace:

  • Doctors
  • Nurses
  • Pharmacists
  • Therapists
  • Psychologists
  • Dentists
  • Other licensed healthcare professionals

Healthcare professionals remain responsible for professional medical judgment, diagnosis, treatment, prescriptions, patient monitoring, and patient care.

2. AI Disclaimer

Certain Doxmate features use Artificial Intelligence to support healthcare organizations and their administrative workflows. Depending on the feature enabled, AI may assist with:

  • Patient conversations
  • Appointment booking and rescheduling
  • Appointment enquiries
  • Reminders
  • Follow-ups
  • Queue-related communication
  • Administrative information
  • Patient summaries
  • Review-related workflows
  • Other supported operational tasks

AI-generated information may contain errors, omissions, or inaccuracies. Users should therefore:

  • Review important AI-generated information where appropriate.
  • Verify important patient and appointment information.
  • Avoid relying solely on AI output for clinical decisions.
  • Escalate medical questions to qualified healthcare professionals.

AI-generated content is not automatically a substitute for professional medical judgment.

3. No Independent Diagnosis or Treatment

Unless a specific Doxmate feature is expressly documented and legally permitted for the applicable use case, Doxmate should not be relied upon to independently:

  • Diagnose a medical condition.
  • Select a treatment.
  • Determine medication or dosage.
  • Interpret a patient's condition as a substitute for professional assessment.
  • Make clinical decisions.
  • Determine whether a patient requires emergency treatment.
  • Replace a consultation with a qualified healthcare professional.

Any clinical information entered into or managed through Doxmate remains subject to review and responsibility of the relevant healthcare professional.

4. Patient Records and Healthcare Information

Depending on the features enabled by a Healthcare Organization, Doxmate may be used to manage healthcare-related information, including:

  • Patient profiles
  • Patient history
  • Vitals
  • Prescriptions
  • Clinical notes
  • Appointment information
  • Billing information
  • Queue information
  • Other information entered into the healthcare-management system

The healthcare organization and its authorized healthcare professionals are responsible for the accuracy, appropriateness, and lawful use of such information. Doxmate provides technology for storing, organizing, displaying, and managing information. The platform does not independently verify that healthcare information entered by users is medically accurate.

5. Responsibility of Healthcare Providers

Clinics, hospitals, doctors, and other healthcare organizations using Doxmate remain responsible for:

  • Medical assessments.
  • Diagnosis.
  • Treatment decisions.
  • Prescriptions.
  • Patient safety.
  • Emergency response.
  • Clinical documentation.
  • Accuracy of information entered into the system.
  • Configuration of appointment and operational workflows.
  • Appropriate review of AI-generated information.
  • Ensuring that authorized staff have appropriate access.

Doxmate does not assume responsibility for the clinical decisions of healthcare professionals.

6. Patient Responsibility

Patients using Doxmate's communication or booking functionality should understand that:

  • Appointment information may be generated or communicated automatically.
  • AI-assisted responses may not always be accurate.
  • Automated messages should not be treated as medical advice unless expressly identified otherwise.
  • Medical questions should be directed to an appropriate healthcare professional.
  • Patients should verify important appointment information where necessary.

Patients should not delay seeking professional medical care because of an automated Doxmate response.

7. Emergency Situations

Doxmate is not an emergency medical service.

Doxmate may not be able to:

  • Detect a medical emergency.
  • Determine the severity of symptoms.
  • Provide emergency treatment.
  • Contact emergency services automatically.
  • Guarantee immediate human intervention.

If you believe you or another person is experiencing a medical emergency, seek immediate assistance from the appropriate local emergency service or qualified healthcare professional. Do not rely on Doxmate, WhatsApp, an AI response, or an automated appointment workflow as an emergency-response system.

8. Appointment and Communication Disclaimer

Doxmate may automate:

  • Appointment booking.
  • Appointment rescheduling.
  • Appointment cancellation.
  • Appointment confirmations.
  • Reminders.
  • Follow-ups.
  • Queue notifications.
  • Patient communication.

Automated systems may occasionally experience:

  • Incorrect user input.
  • Configuration errors.
  • Communication delays.
  • Message delivery failures.
  • Third-party service interruptions.
  • Technical errors.

Healthcare organizations should maintain appropriate operational processes for situations where automated communication is unavailable.

9. WhatsApp and Third-Party Services

Doxmate may use Meta WhatsApp Cloud API and other third-party services to provide communication and integration functionality. Message delivery may be affected by:

  • Meta/WhatsApp service availability.
  • WhatsApp account restrictions.
  • Internet or telecommunications failures.
  • Third-party API changes.
  • User device connectivity.
  • Other technical circumstances outside Doxmate's reasonable control.

Doxmate does not guarantee that every WhatsApp message will be delivered immediately or successfully. Healthcare organizations should not rely on automated WhatsApp messaging as their only method of communicating critical medical information.

10. No Guarantee of Medical Outcomes

Doxmate does not guarantee:

  • A particular medical outcome.
  • Successful treatment.
  • Patient recovery.
  • Appointment attendance.
  • Patient response to communication.
  • Clinical accuracy of information entered by users.
  • Accuracy of AI-generated information.
  • Prevention of missed appointments or no-shows.

The use of Doxmate does not create any guarantee regarding the outcome of a patient's healthcare.

11. No Doctor-Patient Relationship

Use of Doxmate's website, AI Agent, WhatsApp communication, appointment tools, or other software does not itself create a doctor-patient relationship between:

  • Doxmate and a patient; or
  • Brainox Tech and a patient.

Any doctor-patient relationship exists between the patient and the relevant healthcare professional or healthcare organization, subject to applicable law.

12. Healthcare Organization Configuration

Doxmate provides configurable tools that healthcare organizations can use according to their workflows. Healthcare organizations are responsible for configuring:

  • Doctor availability.
  • Appointment slots.
  • Appointment durations.
  • Clinic timings.
  • Services.
  • Fees.
  • Patient communication.
  • Staff access.
  • Operational workflows.

Doxmate is not responsible for incorrect information resulting from inaccurate or outdated configuration by the healthcare organization.

13. Limitation of Responsibility

To the maximum extent permitted by applicable law, Brainox Tech and Doxmate are not responsible for medical decisions, treatment outcomes, or harm resulting from:

  • A healthcare professional's clinical decision.
  • Incorrect information entered by a user.
  • Incorrect clinic configuration.
  • Patient failure to follow professional medical advice.
  • Reliance on AI-generated information where professional review was required.
  • Third-party service interruptions.
  • WhatsApp delivery failures.
  • Internet or telecommunications failures.
  • Patient no-shows or missed appointments.
  • Delays caused by information supplied incorrectly by users.

Nothing in this Disclaimer excludes liability that cannot legally be excluded or limited.

14. Relationship With Other Doxmate Policies

This Medical Disclaimer should be read together with Doxmate's:

  • Terms of Use
  • Privacy Policy
  • Data Deletion Policy
  • Data Protection & Security Policy
  • Data Protection Agreement
  • Ethical AI Use Policy
  • Refund & Cancellation Policy

These policies collectively govern use of the Doxmate platform.

15. Changes to This Disclaimer

Doxmate may update this Medical Disclaimer when necessary to reflect:

  • New products or features.
  • Changes to AI functionality.
  • Changes to healthcare-management functionality.
  • Regulatory developments.
  • Changes to third-party integrations.
  • Changes to our services or operating practices.

The latest version will be published with the applicable “Last Updated” date.

16. Contact Information

For questions regarding this Medical Disclaimer, healthcare-related platform functionality, AI use, privacy, or compliance:

Doxmate

Registered Business Name: Brainox Tech

Business Owner: Pratyaksh Gautam

Email: hello@doxmate.in

Medical / Compliance Queries: hello@doxmate.in

Privacy & Data Protection: hello@doxmate.in

Support: hello@doxmate.in

Phone: +91 76654 27777

Website: https://www.doxmate.in

Address: A-43, New Mansarovar Colony, Chittor Road, Bundi, Rajasthan, India – 323001

© 2026 Brainox Tech. All rights reserved.

Refund & Cancellation Policy

Effective Date: 23 August 2026 · Last Updated: 23 August 2026

This Refund & Cancellation Policy explains the cancellation, subscription, refund, trial, promotional-offer, and account-termination terms applicable to customers using Doxmate.

Doxmate is operated by Brainox Tech (“we”, “our”, “us”).

These terms apply to clinics, hospitals, healthcare organizations, healthcare professionals, and other customers using paid Doxmate services.

By purchasing or using a paid Doxmate service, you agree to this Refund & Cancellation Policy.

1. Subscription Plans

Doxmate may offer different types of plans, including:

  • Free plans
  • Paid monthly plans
  • Paid annual plans
  • Promotional or introductory plans
  • Trial plans
  • Custom or enterprise plans

The features, usage limits, pricing, billing period, and eligibility requirements may differ between plans.

The applicable price and plan conditions presented at the time of purchase will govern the relevant subscription.

Promotional offers may have separate terms, eligibility requirements, validity periods, or usage limits.

2. Free Plans

Where Doxmate provides a free plan:

  • No subscription fee is charged for the applicable free features.
  • Free usage may be subject to feature, appointment, messaging, account, or other usage limits.
  • Doxmate may modify or discontinue promotional/free offerings where permitted by applicable law.
  • Additional paid features or usage may require upgrading to a paid plan.

A free plan does not automatically create any refund entitlement because no subscription fee has been paid for the free service.

3. Free Trials and Promotional Offers

Doxmate may provide free trials or promotional offers from time to time.

Unless otherwise stated:

  • Trial access is provided for the period communicated at signup.
  • A trial does not guarantee continued access after the trial period.
  • Promotional offers may be available only to eligible new customers.
  • Promotional pricing may not be combined with other offers unless expressly permitted.
  • Doxmate may limit one promotional offer per clinic, organization, account, or customer.
  • Promotional services may be subject to separate usage limits.

If a trial or promotional period expires, the account may move to the applicable paid or free plan depending on the offer terms.

4. Subscription Cancellation

Customers may request cancellation at any time by contacting: hello@doxmate.in

Where subscription-management functionality is available, customers may also use the cancellation option provided within their Doxmate account.

Cancellation generally takes effect at the end of the current paid billing period.

Unless otherwise stated in the applicable plan:

  • Your access remains available until the end of the paid period.
  • No new subscription charge will be made after cancellation.
  • Cancellation does not automatically create a refund for the unused portion of the current billing period.

For custom or enterprise agreements, cancellation terms may be governed by the applicable written agreement.

5. Monthly Subscription Refunds

Monthly subscription payments are generally non-refundable once the subscription period has started.

This applies even if:

  • The platform is used infrequently.
  • The customer stops using Doxmate during the billing period.
  • The customer changes their mind.
  • Some available features are not used.

Customers may cancel their subscription to prevent future billing.

6. Annual Subscription Refunds

Annual subscription payments are generally non-refundable after the applicable subscription has commenced.

However, Doxmate may consider a refund request made shortly after the initial purchase where:

  • The request is made within 14 days of purchase or renewal; and
  • The service has not been materially used in production; and
  • The account has not substantially consumed paid services or usage; and
  • The request otherwise qualifies under this Policy.

Approval of such a refund is subject to verification.

After the applicable refund window, annual subscription payments are generally non-refundable.

7. Technical Issues

If a verified technical problem substantially prevents a customer from using a paid Doxmate service, the customer should first contact: hello@doxmate.in

Doxmate will investigate the reported issue.

Where:

  • The issue is caused by Doxmate;
  • The issue materially affects the purchased service; and
  • Doxmate is unable to reasonably resolve the issue,

Doxmate may, at its reasonable discretion, provide:

  • Service extension;
  • Account credit;
  • Partial refund; or
  • Full refund.

The remedy will depend on the nature, duration, and impact of the issue.

8. Third-Party Service Interruptions

Doxmate may depend on third-party services, including:

  • Meta / WhatsApp Cloud API
  • Google services and APIs
  • Cloud infrastructure providers
  • Payment providers
  • Internet and telecommunications networks
  • Other third-party technology services

A third-party outage, restriction, policy decision, API change, account suspension, or network failure does not automatically qualify for a refund.

Where a third-party issue materially affects Doxmate functionality, Doxmate may provide a reasonable service remedy at its discretion where appropriate.

9. No Refund for Customer-Side Issues

Refunds will generally not be provided for:

  • Change of mind.
  • Low usage.
  • Failure to use available features.
  • Failure to configure the account correctly.
  • Incorrect information supplied by the customer.
  • Failure to train or authorize staff appropriately.
  • Failure to connect required third-party accounts.
  • Failure to complete required Meta/WhatsApp verification.
  • WhatsApp/Meta account restrictions caused by customer activity.
  • Customer internet or device problems.
  • Customer-side configuration errors.
  • Failure to respond to required verification requests.
  • Suspension resulting from violation of Doxmate policies.

10. WhatsApp / Meta Restrictions

Doxmate may use Meta's WhatsApp Cloud API for WhatsApp-based functionality.

Customers are responsible for complying with applicable Meta and WhatsApp policies.

No refund is automatically available where service limitations result from:

  • WhatsApp account restrictions;
  • WABA suspension;
  • Meta policy violations;
  • Unauthorized messaging;
  • Spam;
  • Missing or invalid opt-in;
  • Customer business verification issues;
  • Customer misuse of WhatsApp;
  • Meta-imposed limitations.

Doxmate cannot guarantee that Meta will approve, maintain, or continuously support a customer's WhatsApp Business Account.

11. Account Suspension or Termination

Doxmate may suspend or terminate an account where reasonably necessary because of:

  • Violation of the Terms of Use.
  • Illegal activity.
  • Fraudulent activity.
  • Abuse of the platform.
  • Unauthorized access.
  • Security threats.
  • Misuse of patient or Personal Data.
  • Spam or prohibited messaging.
  • Violation of Meta/WhatsApp policies.
  • Repeated payment failures.
  • Other material violations of Doxmate policies.

Where suspension or termination results from the customer's violation of applicable terms or policies, subscription fees already paid are generally non-refundable.

This does not limit any rights that cannot legally be excluded.

12. Duplicate or Incorrect Charges

If you believe you have been charged:

  • Twice for the same subscription;
  • For a subscription you did not authorize; or
  • An incorrect amount due to a verified billing error,

contact: hello@doxmate.in as soon as reasonably possible.

After verification, Doxmate may correct the billing error or issue an appropriate refund.

13. Refund Request Process

To request a refund, cancellation-related review, or billing correction, email: hello@doxmate.in

Subject: Refund Request – [Clinic/Hospital Name]

Please provide:

  • Clinic/hospital/organization name;
  • Registered email address;
  • Registered phone number, where applicable;
  • Subscription plan;
  • Payment date;
  • Transaction/payment reference, if available;
  • Reason for the refund request;
  • Relevant screenshots or technical information where applicable.

Doxmate may request additional information to verify the request.

14. Refund Review Timeline

Refund requests are normally reviewed within 7–10 business days.

If a refund is approved:

  • The refund will normally be initiated within 10–15 business days after approval.
  • Refunds will generally be made to the original payment method.
  • The actual time for the amount to appear may depend on the payment provider or bank.

Additional verification may be required for suspected fraudulent or unauthorized transactions.

15. Cancellation Does Not Automatically Delete Data

Cancelling a subscription does not necessarily mean that all customer or patient data is immediately deleted.

Data will be handled according to the applicable:

  • Privacy Policy
  • Data Deletion Policy
  • Data Protection Agreement
  • Data Protection & Security Policy

Customers may submit a valid data-deletion or account-offboarding request through: hello@doxmate.in

Applicable legal, security, billing, or regulatory retention requirements may apply.

16. Account Offboarding

After cancellation or termination, customers may request account offboarding.

Depending on the applicable service and data-retention requirements:

  • Account access may be disabled.
  • Third-party integrations may be disconnected.
  • WhatsApp connections may be revoked.
  • Customer data may be deleted or returned where applicable.
  • Backup copies may remain temporarily according to applicable retention periods.
  • Legally required records may be retained for the required period.

Customers should request any required data export before account termination where export functionality is available.

17. Taxes and Payment Provider Charges

Where applicable:

  • Taxes, GST, or other statutory charges may apply.
  • Payment-provider processing charges may be subject to the applicable payment provider's rules.
  • Any refund will generally be calculated against the amount actually eligible for refund under this Policy and applicable law.

18. Enterprise and Custom Agreements

Enterprise, hospital, institutional, or custom customers may have separately negotiated:

  • Billing terms;
  • Minimum commitments;
  • Cancellation periods;
  • Refund provisions;
  • Service credits;
  • Contract termination rights.

Where a signed written agreement contains specific refund or cancellation terms, those terms will govern to the extent of any conflict with this Policy.

19. Policy Changes

Doxmate may update this Refund & Cancellation Policy from time to time to reflect:

  • New products or plans;
  • Changes in pricing;
  • Changes in payment infrastructure;
  • Changes in applicable laws;
  • Changes in refund practices;
  • Changes in Doxmate services.

The latest version will be published with a revised “Last Updated” date.

20. Contact Information

For cancellation, refund, billing, or subscription-related questions:

Doxmate

Registered Business Name: Brainox Tech

Business Owner: Pratyaksh Gautam

Email: hello@doxmate.in

Billing & Refund Support: hello@doxmate.in

General Support: hello@doxmate.in

Phone: +91 76654 27777

Website: https://www.doxmate.in

Registered Business Address: A-43, New Mansarovar Colony, Chittor Road, Bundi, Rajasthan, India – 323001

© 2026 Brainox Tech. All rights reserved.