Privacy policy
Effective 17 October 2026. Replaces the policy of 15 May 2026 that applied to the previous website. Marketing website only.
How the Docran marketing website collects, uses, shares and protects the personal data you submit. Aligned with India's Digital Personal Data Protection Act 2023, the IT Act 2000 and IT Rules 2011, and, for visitors in the EU, EEA, Switzerland and the United Kingdom, the GDPR and UK GDPR.
1. Scope
This policy describes how Docran ("Docran", "we", "us") handles personal data collected through our marketing website. It explains what we collect, the legal basis on which we process it, who we share it with, how long we keep it, and the rights you have over it.
Scope note. This policy covers only the marketing website. It does not cover the Docran hospital management system or the patient-facing applications used by hospitals and their patients. Those applications process patient health data under separate notices and under a Data Processing Addendum signed between Docran and each hospital. The marketing website does not store patient health records.
2. Who we are
Codran Technologies Private Limited is a healthcare technology company incorporated in India and based in Hyderabad, Telangana. We build the Docran hospital management system. Docran is the product name; Codran Technologies Private Limited is the legal entity behind it, and in this policy "Docran", "we", "us" and "our" refer to Codran Technologies Private Limited.
- Under the DPDP Act, Codran Technologies Private Limited is the Data Fiduciary for data you submit through this website.
- Under the GDPR and UK GDPR, Codran Technologies Private Limited is the data controller.
- For the hospital management system itself, Codran Technologies Private Limited acts as a Data Processor to the hospital, which is the Data Fiduciary for patient records. That relationship is governed by a separate Data Processing Addendum and is not covered by this policy.
3. Key terms used in this policy
- Personal data
- Any data about an individual who is identifiable by or in relation to such data (DPDP Act 2023, Sec 2(t)).
- Data Principal
- The individual to whom personal data relates, that is, you (DPDP Act, Sec 2(j)).
- Data Fiduciary
- The entity that determines the purpose and means of processing personal data. Codran Technologies Private Limited is the Data Fiduciary for data you submit through this website.
- Data Processor
- An entity that processes personal data on behalf of a Data Fiduciary, under contract. Our hosting and email providers act as Data Processors.
- Sub-processor
- A third party engaged by a Data Processor, or by Docran directly, to support processing. See the named list in section 6.
- Processing
- Any operation performed on personal data: collection, storage, use, disclosure, deletion (DPDP Act, Sec 2(x)).
- Consent
- A free, specific, informed, unconditional and unambiguous agreement to a defined purpose, given by clear affirmative action (DPDP Act, Sec 6).
- Legitimate use
- A narrowly defined non-consent ground for processing, for example the security of a service (DPDP Act, Sec 7).
- Cross-border transfer
- Movement of personal data outside India. Permitted by default under the DPDP Act unless restricted by the Central Government (Sec 16).
- Grievance Officer
- A designated officer for redressal of complaints relating to personal data handling (DPDP Act, Sec 8(9); IT Rules 2011, Rule 5(9)).
- Data Protection Board of India
- The statutory body constituted under DPDP Act Chapter V to adjudicate complaints and impose penalties.
- Controller and processor (GDPR)
- The GDPR equivalents of Data Fiduciary and Data Processor (GDPR Art 4(7) and 4(8)).
4. What we collect
4.1 Data you provide through forms
When you submit the demo-request or contact form, we collect what you type in it: your first and last name, work email address, hospital name, your role, your phone number, the approximate number of beds and branches, the topic you choose, your message, the form type, and the time of submission.
We do not ask for, and the website is not designed to receive, sensitive personal information such as health records, government identifiers (Aadhaar, PAN) or payment-card data. If you include such information in a free-text field we will not use it for any purpose and will delete it from the relevant inbox.
4.2 Data collected automatically
- Request logs. Our hosting provider, Cloudflare, records standard request metadata (IP address, browser user-agent, path, status, timestamp) for security and abuse prevention. We do not keep a copy of these logs.
- Font requests. Pages load the Public Sans typeface from Google Fonts, so your browser sends its IP address and user-agent to Google when the font loads.
4.3 Data collected with your consent
None. This website runs no analytics, sets no cookies and stores nothing in your browser.
5. Lawful basis and purposes
Under DPDP Act Sec 4, personal data may be processed only for a lawful purpose for which the Data Principal has given consent (Sec 6) or for certain enumerated legitimate uses (Sec 7).
| What we process | Purpose | Basis (DPDP) | Basis (GDPR) |
|---|---|---|---|
| Demo-request and contact form fields | Respond to your enquiry and arrange a walkthrough | Sec 6 (consent, by submitting the form) | Art 6(1)(b) pre-contractual steps |
| Request logs held by our hosting provider | Prevent abuse of the website and its forms | Sec 7 (legitimate use: security) | Art 6(1)(f) legitimate interest |
6. Sub-processors
We use the following sub-processors to operate the website. Each acts under contractual confidentiality obligations and processes only the data necessary to perform its function.
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting and delivery of the website pages, and execution of the form handler | Global network, including data centres in India | TLS in transit; request logs held by Cloudflare under its own retention policy; form data passes through and is not stored |
| Resend, Inc. | Transactional email delivery of form submissions to our team inbox | Global infrastructure | TLS in transit; processes the email content only |
| Google LLC (Google Fonts) | Delivery of the website typeface | Global infrastructure | Receives only the font request (IP address and user-agent) |
| Slack Technologies | Optional internal notification of form submissions | Global infrastructure | Internal channel only; access restricted to the Docran team |
We do not use advertising networks, social-media tracking pixels, fingerprinting or session-recording tools on this website.
7. Sharing and disclosure
What we do share
- With the sub-processors above, under written instructions
- Where required by binding law or court order
- To investigate fraud, abuse or threats to service integrity
- With your explicit, additional consent
What we never do
- Sell, rent or trade your personal data
- Share it with advertising networks
- Use it to build ad-targeting profiles
- Disclose it to recruitment lists or data brokers
8. Retention
We keep website data only for as long as needed for the purposes above.
| Category | Retention |
|---|---|
| Demo-request and contact submissions in our inbox | Up to 24 months after last contact, then deleted or anonymised |
| Optional Slack notification of a submission | Up to 24 months |
| Request logs | Held by Cloudflare under its retention policy; we keep no copy |
Where Indian law requires us to retain a record for longer, for example evidence of correspondence under the Information Technology Act, we retain it for that period and then delete it.
9. Your rights as a Data Principal
Under DPDP Act Chapter III you have the following rights. For EU, EEA and UK visitors, the equivalent GDPR rights are listed in section 18.
Right to access DPDP Sec 11
How: Email privacy@docran.in from the address you used with us and ask for a summary of the personal data we hold about you and how we use it.
When: Within 30 calendar days.
What you receive: A summary of the data we hold, the purposes we process it for, and the categories of recipients.
Right to correction DPDP Sec 12
How: Email privacy@docran.in with the inaccurate detail and the correction.
When: Within 30 calendar days, sooner where reasonable.
What you receive: Confirmation that the correction is made.
Right to erasure DPDP Sec 12
How: Email privacy@docran.in asking us to delete the personal data we hold about you. We delete unless retention is required by law or to resolve a dispute.
When: Within 30 calendar days. Where deletion is partial we explain what we kept and why.
What you receive: Confirmation of deletion and any residual retention.
Right to withdraw consent DPDP Sec 6(4)
How: Email privacy@docran.in. Withdrawal takes effect for the future; processing already done remains lawful.
When: Immediate for the future.
What you receive: We stop the processing and confirm by email.
Right to nominate DPDP Sec 13
How: Email privacy@docran.in nominating another individual to exercise your rights in the event of your death or incapacity.
When: Recorded on receipt.
What you receive: Acknowledgment of the nomination.
Right to grievance DPDP Sec 13
How: Raise a complaint with our Grievance Officer at grievance@docran.in. See section 12 if you are not satisfied.
When: Acknowledgment within 48 hours; substantive response within 30 calendar days.
What you receive: The investigation outcome and any remedial action.
10. What happens in practice
You submit a demo request
- Your form data is sent over HTTPS to a small function running on Cloudflare's network.
- The function checks the data and the size of the request, and stores nothing.
- It calls Resend's API to deliver one email to our team inbox. Resend processes the email content only.
- If our Slack notification is configured, a short note is posted to an internal channel.
- A team member replies from our inbox. The email thread is kept for up to 24 months after last contact.
You ask us to delete your data
- You email privacy@docran.in from the address you used with us.
- We confirm receipt within 48 hours and may ask one or two questions to verify your identity.
- We search our inbox and records for messages associated with your email address.
- We delete them, or anonymise them where a reference is needed as evidence of a transaction.
- We confirm the deletion in writing within 30 days, saying what was deleted and what, if anything, was retained and why.
11. Grievance Officer
In accordance with DPDP Act Sec 8(9) and IT Rules 2011 Rule 5(9), Codran Technologies Private Limited has designated a Grievance Officer to address complaints relating to personal data handling on this website.
- Grievance Officer (role contact): grievance@docran.in
- Postal address: Codran Technologies Private Limited, Hyderabad, Telangana, India
- Acknowledgment: within 48 hours of receipt
- Resolution: within 30 calendar days
We use a role address until a named officer is designated. Counsel review is in progress; this section will be updated when the named officer and full address are confirmed.
12. If we cannot resolve it
If your concern is not resolved to your satisfaction at one step, you may escalate to the next.
- Privacy team. Email privacy@docran.in for any data-rights request.
- Grievance Officer. Email grievance@docran.in for a formal complaint. Acknowledgment within 48 hours; resolution within 30 days.
- Data Protection Board of India. If our resolution is unsatisfactory, complain to the Board constituted under DPDP Act Chapter V.
- EU, EEA and UK visitors. Lodge a complaint with the supervisory authority in your member state (GDPR Art 77).
- Consumers. Approach the appropriate consumer forum under the Consumer Protection Act 2019, where applicable.
13. Cross-border transfers
This website is delivered from Cloudflare's global network, which includes data centres in India; a request is served from the location closest to you. Form submissions are delivered by Resend, and optional notifications by Slack, through infrastructure operated outside India. In each case the data transferred is limited to what the service needs. Under DPDP Act Sec 16 the Central Government may restrict transfers to specified countries; we will adjust our sub-processors if such a restriction applies. For EU, EEA and UK visitors, transfers outside the EU and UK rely on the safeguards offered by the relevant provider, typically Standard Contractual Clauses approved by the European Commission.
14. Children
This website is intended for adults working in or with hospitals. Under DPDP Act Sec 9 we will not knowingly process the personal data of a child (under 18) without verifiable parental or guardian consent. If you believe a child has submitted personal data through our forms, contact privacy@docran.in and we will delete it. For EU and EEA visitors, GDPR Art 8 applies with the age of consent set by your member state.
15. Security
We implement reasonable security practices in line with IT Rules 2011 Rule 8. For this website:
- HTTPS and TLS on all traffic.
- Form submissions validated on the server, with size limits and email header-injection checks.
- A hidden field that automated submissions fill in, which causes them to be discarded.
- No cookies, no accounts and no browser storage, so there is no session to steal.
- Email credentials held only in the hosting provider's encrypted secret store, never in the website's files.
See our Security and trust page for how the Docran product itself protects hospital data.
16. Breach notification
If a personal-data breach affects you, we will notify you and the Data Protection Board of India without undue delay, in accordance with DPDP Act Sec 8(6) and the rules notified under it. For EU, EEA and UK visitors we will also comply with GDPR Art 33 (notification to the supervisory authority within 72 hours, where applicable) and Art 34 (communication to affected individuals where the breach is likely to result in a high risk to their rights and freedoms). Notifications describe the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures we have taken or propose to take.
17. Cookies
This website sets no cookies and stores nothing in your browser's local storage.
18. Jurisdiction-specific notices
- India. Primary jurisdiction. The DPDP Act 2023, IT Act 2000, IT Rules 2011 and Consumer Protection Act 2019 apply. The Data Protection Board of India is the regulator. The Grievance Officer is designated above.
- EU and EEA. The GDPR applies in addition to the DPDP Act. You have the rights in Art 15 to 22 (access, rectification, erasure, restriction, portability, objection). Lawful bases under Art 6 apply. You may complain to your local supervisory authority (Art 77).
- United Kingdom. The UK GDPR and Data Protection Act 2018 apply, with rights equivalent to those above. The Information Commissioner's Office is the supervisory authority.
19. Changes to this policy
We may update this policy to reflect changes in our practices or in applicable law. When we make material changes we update the effective date at the top of this page and, where appropriate, notify you by reasonable means, such as email if you have an open enquiry with us.
20. Contact
- Grievance Officer: grievance@docran.in
- Privacy queries: privacy@docran.in
- Security disclosures: security@docran.in
- General: info@docran.in
Codran Technologies Private Limited, Hyderabad, Telangana, India.