Privacy Policy
1. Who we are
River One OPD is an outpatient clinic management service operated by River One. Clinic staff use it to keep clinic, patient, appointment, visit, prescription, pharmacy, laboratory, wallet, and related WhatsApp records. Contact support@riverone.in for privacy requests.
The clinic that enters a patient’s information is responsible for that patient’s care and for deciding what is written in the clinical record. River One provides the software that stores and displays those records for the clinic.
2. Who this service is for
Accounts are for super admins, clinic owners, and receptionists. Patients do not create an account in this system. A patient may receive a WhatsApp message from their clinic when the clinic uses that feature and the patient has given consent.
This policy describes the data the software processes so the clinic can operate. It is not a medical disclaimer for treatment. The Terms and Conditions explain the limits of the service.
3. Information we collect
Clinic and staff accounts
- Clinic name, doctor name, specialty, email, phone, address, city, and registration date.
- Staff name, email, phone, role, account status, and approval status.
- Password. We store a hash of the password, not the password itself.
Patients and clinical work
- Identity and contact details the clinic enters, such as name and phone number.
- Appointment, visit, follow-up, prescription, pharmacy, and lab-request records.
- Specialty-specific fields and files the clinic uploads for a patient.
- The staff user who created or updated a record, where the system stores that audit information.
Wallet
- Prepaid balance, credits, and deductions for the clinic.
- The amount, payment reference (for example a UPI, NEFT, or receipt number), and notes the clinic owner enters when recording a top-up. We do not collect card numbers or UPI PINs in the app.
- The patient phone number used for a message, consent status, message type, and delivery status returned by WhatsApp.
- Message content needed to send an appointment reminder or a prescription or lab document the clinic asks the system to send.
Technical data
- A session cookie that keeps a staff member signed in.
- Standard server logs such as IP address, date, browser type, and the page requested. These logs are used to operate and protect the service.
We do not sell personal information. We do not use clinic or patient records to train public advertising profiles.
4. How we use information
- To create and approve clinic accounts and to sign staff into the correct panel.
- To store and show the clinic’s patients, appointments, visits, prescriptions, pharmacy items, lab requests, reports, and files.
- To apply wallet rules for patient registration fees and follow-up visit deductions, and to show the ledger to the clinic.
- To send WhatsApp messages the clinic initiates, where that feature is switched on and consent has been recorded.
- To keep security logs, investigate misuse, and support a clinic that contacts us.
- To meet a legal duty, such as a lawful request for records we are required to keep or disclose.
5. Health information
Clinical notes, prescriptions, lab requests, and uploaded reports are health information. They are visible to the super admin and to the clinic owner and receptionists of that clinic, according to the role signed in. They are not published on this website.
The software records what clinic staff enter. It does not diagnose a patient, choose a medicine, or provide emergency care.
6. WhatsApp and Meta
When a clinic sends a WhatsApp message, the message and the destination phone number are processed by WhatsApp / Meta under their own terms, using the clinic’s configured WhatsApp Business credentials. We store the status needed to show the clinic whether a message was accepted or failed. Do not use WhatsApp from the clinic panel unless the patient has agreed to that contact.
7. Who we share information with
- Staff of the same clinic, limited by their role.
- The platform super admin, for approval, support, and operation of the service.
- The hosting provider that runs this website and its database.
- WhatsApp / Meta, only when the clinic sends a WhatsApp message.
- An authority or adviser when disclosure is required by law.
A receptionist cannot top up the wallet. That action is limited to the clinic owner account.
8. How long we keep information
We keep clinic and patient records for as long as the clinic account is active, because the clinic uses them for ongoing care and administration. Wallet and audit entries may be kept longer where we need them for security, dispute handling, or a legal duty.
After we verify a deletion request, we delete or de-identify the account and clinic data described on the Delete account and data page, except for records we must retain.
9. Security
The public site is served over HTTPS. Staff passwords are hashed. Access to clinic records depends on the signed-in role. No method of storage or transmission is completely secure. Clinic staff should use a unique password and sign out on a shared computer.
10. Cookies
The service uses a session cookie so a signed-in user stays signed in while using the panel. The public pages do not use an advertising cookie. If you block cookies, sign-in will not work.
11. Children
The Android app and website are for clinic staff. We do not offer patient accounts to children. A clinic may store a pediatric patient’s record because the clinic treats that patient. The clinic is responsible for having a proper basis to record that child’s information.
12. Android app
The Play Store app is a window onto this website. Installing it does not create a second copy of your clinic data on a separate River One server. The app may request permission to post notifications. You can deny or later revoke that permission in Android settings. The app does not request your location, contacts, SMS, microphone, or camera for its own use.
13. Your requests
A clinic owner or receptionist may request access to, correction of, or deletion of their staff account and, for a clinic owner, the clinic’s stored records. Use the deletion page or email support@riverone.in from the account email if you can. A patient who wants a copy or correction of a clinical record should contact the clinic that created it. That clinic can then ask us to help with the stored copy.
Personal data in this service is handled in connection with clinics using the product. Where India’s Digital Personal Data Protection Act, 2023 applies, the clinic that decides what patient data is entered is the party responsible for that patient record, and River One processes it to provide the software. See DPDP compliance for how each right is handled.
14. Changes
If we change this policy, we will update this page and the effective date. Continued use of the website or Android app after the update means the clinic staff member accepts the updated policy for their account.
15. Contact
Email support@riverone.in or use the contact form. Please include the clinic name and the email on the account.