1. Plain-English summary
If you only read one paragraph, read this one. DrPenDown is built on a clear principle: the doctor owns the patient data. You decide what goes in, you can export it at any time, and you can delete it on request. We store it encrypted, we do not sell it, and we do not train any AI model on your medical notes.
- You (the doctor) are the data controller for your patients' clinical data.
- DrPenDown (the company) is the data processor — we handle the storage and infrastructure on your behalf.
- We do not sell, rent, or trade personal data — patient or doctor — to advertisers or third-party marketers. Ever.
- DrPenDown's autocomplete draws from your own previous notes and the dictionaries you have loaded. Dictation transcribes through a sub-processor (Groq) and rewrites using an LLM grounded in your personal phrase library; see sections 3.3 and 6 for the details.
- You can export or delete everything we hold for you at any time, from inside the app or by emailing us.
- We never train any AI model — ours or anyone else's — on your patient data. Sub-processors are bound by data-processing terms that forbid training on inputs.
2. Who we are and who this applies to
This policy applies to anyone who visits drpendown.com (and any subdomain), creates an account, or whose data we process in order to operate the DrPenDown service.
The DrPenDown service is operated by the DrPenDown team from India. For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and the India Digital Personal Data Protection Act, 2023 ("DPDP Act"), the entity that decides how your personal data is processed is the DrPenDown team, reachable at legal@drpendown.com.
We distinguish between two kinds of users:
- Account holders (doctors / clinic staff) — the medical practitioners and authorised staff who create a DrPenDown account to record consultations. We act as a processor on their behalf for the patient data they upload.
- Data subjects (patients) — the people whose clinical information is recorded inside a doctor's account. Patients do not have direct accounts on DrPenDown; they exercise their rights through the doctor who recorded them, or by contacting us directly.
3. What data we collect
3.1 Account data (doctor / clinic staff)
- Full name, email address, mobile number (optional).
- Password (stored only as a one-way cryptographic hash; we cannot read it).
- Professional credentials you choose to display on prescriptions: qualification, medical council registration number, clinic name, address, phone, website.
- Profile photo and clinic logo (if you upload them).
3.2 Patient data entered by the doctor
DrPenDown stores the structured consultation record the doctor authors. This is whatever the doctor chooses to enter, and may include:
- Patient demographics: name, age, sex, phone number, patient ID.
- Clinical content: chief complaints, history, examination findings, vitals, diagnosis, prescription, investigations, follow-up advice, discharge summary.
- Attached media: clinic letterhead logo, endoscopy video frames and source video, any other files you upload.
Patient data is processed only on the documented instructions of the account holder (the doctor). It is never used by us for marketing, profiling, advertising, or to train third-party AI models.
3.3 Usage and device data
- Log data: IP address, browser type and version, device type, operating system, referring page, pages visited, timestamps.
- Crash reports: when the application throws an unhandled exception, an error boundary reports the technical stack trace and browser context to our error-monitoring provider. We do not include patient clinical content in these reports.
- Aggregate, de-identified analytics — e.g. "Solo plan was activated 12 times today." We do not use third-party advertising trackers.
- Dictation audio. When you tap the microphone, your browser records a short audio clip (typically a few seconds) using your device microphone. The clip is sent over TLS to our backend, which forwards it to a sub-processor for transcription. Audio is processed in memory and is not stored on our servers or by the sub-processor after the transcript returns. If transcription fails, the audio is discarded. Dictation is opt-in: nothing is recorded until you press the mic button.
- Dictation transcripts and rewrites. The raw transcript returned by the speech-to-text sub-processor and the rewritten text returned by our rewrite model are sent back to your browser. They are not stored on our servers beyond the immediate request lifetime; only the final text you accept is saved into the consultation record.
3.4 What we do not collect
- We do not require patient identifiers like Aadhaar, ABHA, PAN, or any government ID. If you choose to record such identifiers, you do so at your own discretion and on your own legal basis.
- We do not collect biometric data, financial data, or genetic data.
- We do not record audio passively or in the background. The microphone is only active while you hold the dictation button (or while a single tap is in flight), and the audio buffer is discarded the moment transcription completes.
4. Why we collect it (legal bases)
We process the data described above for the following purposes:
- To provide the service you signed up for — store consultations, generate PDFs, sync across devices. (Contract performance.)
- To authenticate you and keep your account secure. (Contract performance / legitimate interest.)
- To bill you — currently handled by our payment processor, who acts as an independent controller for billing data. (Contract performance.)
- To detect abuse, debug, and prevent fraud. (Legitimate interest.)
- To comply with law — respond to lawful requests, maintain tax records, etc. (Legal obligation.)
- To communicate service changes — security notices, plan changes, outage reports. (Legitimate interest; you can opt out of non-essential messages.)
Where the GDPR applies, the legal basis for processing patient clinical data is the account holder's instructions — i.e. DrPenDown processes that data on the account holder's documented behalf, and the account holder is responsible for establishing their own lawful basis under Article 9(2) (most commonly, medical diagnosis, healthcare provision, or the explicit consent of the patient).
5. Where your data is stored and how it moves
All production data is currently stored on Convex, a managed-backend platform that holds SOC 2 Type II and ISO 27001 certifications. Convex hosts our deployment in a single cloud region today; we will notify account holders by email at least 30 days before any change of region or hosting provider.
Files you upload (clinic logos, endoscopy videos and frames) are stored on Cloudflare R2, in the region closest to your Convex deployment. We serve them to your browser using signed, short-lived URLs so only authenticated users in your DrPenDown account can fetch them.
If you require data residency in a specific jurisdiction — for example, an obligation to keep patient data inside India — please contact us at legal@drpendown.com before signing up so we can confirm what is currently possible and, where it is not, discuss alternatives.
Data is encrypted in transit using TLS. Data is encrypted at rest by our infrastructure providers using industry-standard symmetric encryption (the specific algorithm is set by the provider and audited as part of their compliance certifications).
6. Sub-processors
To run DrPenDown, we rely on a small number of carefully chosen infrastructure providers. Each is bound by a data-processing agreement that restricts use to our documented purposes.
- Convex — primary database and real-time sync. SOC 2 Type II, GDPR-compliant.
- Cloudflare R2 — object storage for uploaded files. SOC 2 Type II, GDPR-compliant.
- Sentry — error-monitoring service. We use it to receive unhandled exception reports. We configure our integration to minimise personal data in the payload; what is sent is limited to technical stack traces and browser context.
- Groq — speech-to-text and chat-completion provider for the dictation feature. Audio bytes and the raw transcript are sent to Groq over TLS for the duration of a single dictation request. Groq processes the request and returns the result; we have configured our integration to discard inputs and outputs after the request completes and Groq's terms forbid training on inputs.
- Payment processor — subscription billing. They process card data under their own terms; we never see your full card number.
- Transactional email — account verification, password reset, security alerts. Minimal data: email address, message content.
An up-to-date list is available at legal@drpendown.com. We give at least 30 days' notice before adding a new sub-processor that handles personal data.
8. How long we keep your data
We keep your data for as long as your account is active. If you cancel, we hold your data in a recoverable state for a grace period of at least 90 days in case you change your mind. After that grace period we permanently delete the data from active systems, and within a further 30 days it is purged from our backups.
You can also delete any individual consultation, patient, or your entire account at any time from inside the app or by emailing legal@drpendown.com. Deletions are processed within 30 days.
We are required to retain certain financial records (e.g. invoices) for the period required by applicable tax law. Those records are kept in a separate accounting system with restricted access.
9. Your choices and rights
Depending on where you live, you may have some or all of the following rights:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — correct data that is inaccurate or incomplete.
- Erasure — ask us to delete your data, subject to legal retention obligations.
- Restriction — ask us to pause processing while a dispute is resolved.
- Portability — receive your data in a structured, machine-readable format (we support JSON and CSV).
- Objection — object to processing based on legitimate interest.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
- Complain — lodge a complaint with your local data protection authority.
Doctors (account holders) can act on most of these rights directly from inside the app. For anything else, or for patients who would like to exercise their rights through us, write to legal@drpendown.com.
11. How we protect data
Security is built into DrPenDown at three layers: our infrastructure, our code, and our team practices.
11.1 Infrastructure
- All production data is hosted on Convex, which holds SOC 2 Type II and ISO/IEC 27001 certifications.
- All uploads are stored on Cloudflare R2, encrypted at rest, and served only via signed, short-lived URLs bound to your session.
- All client and server traffic uses TLS. Plain HTTP is not accepted on any production endpoint.
- Convex encrypts stored data using industry-standard symmetric encryption managed by the underlying cloud provider.
11.2 Application
- Every database query and mutation is scoped to the signed-in doctor — patient data of one clinic is not visible to any other.
- Authentication is handled by Convex Auth with one-way password hashes.
- State-changing requests are protected against cross-site request forgery.
- Failed sign-in attempts are rate-limited.
11.3 Team
- Access to production data is restricted to a small number of named engineers on a need-to-know basis.
- Production access requires multi-factor authentication and is logged.
- All staff complete confidentiality training as a condition of employment.
- We do not access customer data except to investigate a specific support request you have raised or a confirmed security incident.
11.4 Reporting a vulnerability
If you have discovered a security issue in DrPenDown, please email security@drpendown.com. We acknowledge reports within two business days and aim to issue a fix or mitigation within 30 days for high-severity issues. Please do not include patient personal data in a vulnerability report; anonymise any specific consultation first.
12. Minors
DrPenDown is a tool used by licensed medical practitioners. The account is held by the practitioner; the service is not directed at children. Patient data of minors may be recorded inside an account by the responsible clinician — in which case the practitioner is the data controller and is responsible for obtaining any parental consent required by local law.
13. International transfers
DrPenDown is operated from India. If you sign up from outside India, your data may be transferred to and processed in the country where our hosting provider (Convex) and our sub-processors are located. We currently host in a single Convex region — see section 5 for how to reach us if you need data to remain in a specific jurisdiction.
Where personal data is transferred across borders, we rely on one of the following safeguards: (a) the destination is a jurisdiction recognised by the relevant authority as providing adequate protection; (b) the recipient is bound by Standard Contractual Clauses (SCCs) approved by the European Commission; or (c) you have given explicit consent.
14. India (DPDP Act 2023) notice
For users in India, the Digital Personal Data Protection Act, 2023 applies. Under that law:
- The DrPenDown entity identified in section 2 acts as the Data Fiduciary for the personal data of account holders and for any usage data described in section 3.3.
- For patient clinical data entered by an account holder, the account holder is the Data Fiduciary for their patients, and DrPenDown acts as a Data Processor.
- You may withdraw consent and request erasure of your personal data at any time, subject to the legal-retention carve-outs described in section 8.
- You may lodge a complaint with the Data Protection Board of India. We encourage you to contact us first so we can resolve any issue quickly.
15. Changes to this policy
We may update this policy from time to time. The "Last updated at" date at the top will reflect the current version. For material changes — anything that materially broadens what we collect or how we use it — we will notify account holders by email and give at least 30 days' notice before the change takes effect.
16. How to contact us
The fastest way to reach the team handling privacy requests is legal@drpendown.com. We do not currently maintain a postal correspondence address; if you need one, write to us by email first and we will arrange one. We aim to respond to all verifiable requests within 30 days.