Privacy Policy

Tokeno is a queue management tool used inside clinics. Some of what passes through it — the fact that you saw a doctor, and what that doctor wrote down — is information about your health. This page explains, in plain terms, what we hold, why, who can see it, and what you can ask us to do about it.

1. Who is responsible for your information

Two different organisations have a role, and the difference matters when you want something done.

Role	Who	What they decide
The clinic	The clinic or hospital you visited	Your medical record. They decide what is written about you, how long it is kept, and who on their staff may see it. For anything about the content of your record, they are the right people to ask.
Tokeno	The operator of tokeno.in	The software that stores and displays it. We hold the data on the clinic's behalf and act on their instructions, and we are directly responsible for your account and for keeping the system secure.

In the language of India's data protection law, the clinic is the Data Fiduciary for your clinical record and Tokeno is a Data Processor acting for them. For your Tokeno account itself — your login, your phone number, your list of visits — Tokeno is the fiduciary.

2. What we collect

If you are a patient

• Your name and mobile number. Used to identify you at the desk and to sign you in.
• Your bookings. Which clinic, which day, your token number, the time you booked, whether you arrived, and whether you were seen, skipped, or did not turn up.
• Clinical notes and prescriptions that the doctor records against your visit. This is information about your health.
• Payment records, where the clinic uses Tokeno to note that a consultation was paid for — the amount and the method. We do not process payments and never see card, UPI or bank details. The clinic collects money directly; Tokeno only records that they did.
• Your approximate location, only if you allow it, and only to sort nearby clinics by distance. It is used in your browser and is not stored on our servers.

If you are clinic staff

• Your name, mobile number, email address where you were invited by one, your role, and which clinics you work at.
• A record of which account made which change to a token, so that a correction can be traced to a person.

Collected automatically

• Authentication data handled by Google Firebase: your phone number, the one-time codes used to verify it, and the time you last signed in.
• Technical logs — the time of a request, the page, and error diagnostics. We keep these to spot faults and detect misuse, and because the CERT-In Directions of 28 April 2022 require us to.

3. Why we collect it

Information	Purpose
Name, mobile number	Identify you in the queue; sign you in; let the clinic call the right person
Booking and token	Run the queue and estimate your waiting time
Clinical notes, prescription	Your medical record, kept by the clinic, and visible to you in your visit history
Payment record	Let the clinic reconcile what was collected
Technical and security logs	Keep the service working; detect, investigate and report security incidents

We do not use your information for any purpose beyond those listed here without asking you first.

4. Consent, and withdrawing it

We ask for your agreement to this policy when you create an account, and again — specifically for the clinic you are booking with — when you join a queue for the first time. Booking a token means agreeing that the clinic may record your visit and any clinical notes arising from it.

You can withdraw consent at any time by writing to the Grievance Officer below. Withdrawing it means we close your Tokeno account and stop processing your information for the purposes above. It cannot undo a consultation that already happened: the clinic may be required to keep its own medical record independently of Tokeno, under rules that apply to them as a medical practitioner. See section 8.

5. Who can see your information

• You. Your own bookings, and the notes and prescriptions from your completed visits.
• The clinic you booked with. Its doctors see your clinical notes. Its reception staff see your name, number and queue position, but cannot see or write clinical notes or prescriptions — the system prevents it, not merely by policy but in the access rules themselves.
• Other clinics: no. A clinic can only see the patients who booked with it.
• The clinic's administrator can correct queue and payment details and manage staff. Administrators cannot write or alter clinical notes or prescriptions, because those are the doctor's record.

Service providers

We use Google Firebase (Google Cloud India) to host the database, run the application, and verify phone numbers by SMS; and ZeptoMail (Zoho, India) to send staff invitation emails. Invitation emails contain a name, role and clinic name — never patient or clinical information.

Disclosure required by law

We may disclose information where we are compelled to by a court order, or by a lawful demand from a government agency or from CERT-In. We will tell you when we are permitted to.

The waiting room screen

If your clinic uses the Tokeno display board, it shows your token number and a shortened form of your name — your first name and the initial of your last, so that "Priya S." appears rather than your full name. It never shows your phone number, your notes, or your prescription.

6. Where it is stored

All patient and clinic data is stored and processed in India, in Google Cloud's Mumbai region (asia-south1). Our application servers run in the same region. Security logs are retained within Indian jurisdiction as required by the CERT-In Directions of 28 April 2022.

7. How it is protected

• Encrypted in transit (HTTPS) and encrypted at rest by the hosting platform.
• Sign-in by one-time code to your mobile number; we never store a password you have chosen.
• Access rules enforced by the database itself rather than by the app, so a modified or malicious client cannot read records it is not entitled to. Receptionists and administrators are blocked from clinical notes at this level.
• Point-in-time recovery and daily backups, so data can be restored after an accident or an attack.
• Deletion protection on the production database.

No system is perfectly secure. We do not claim otherwise, and section 10 tells you what happens if we are wrong.

8. How long we keep it

Information	Kept for
Queue and booking records	While your account is open, then deleted with it
Clinical notes and prescriptions	Held for the clinic. The clinic decides, subject to the rules that apply to medical practitioners and to the clinical establishment rules of its State
Account details	Until you ask us to delete them
Security and access logs	180 days, as required by the CERT-In Directions

Where the clinic is legally required to keep a medical record, deleting your Tokeno account does not delete the clinic's obligation to retain it.

9. Your rights

You may ask us to:

• Show you what we hold about you.
• Give you a copy of your visit records. Where the request is for medical records, the clinic is required to make them available within 72 hours of your request.
• Correct anything inaccurate. Corrections to a clinical note are made by the treating doctor.
• Delete your account and the personal information tied to it, subject to the retention rules above.
• Withdraw consent, as described in section 4.
• Complain to the Grievance Officer, and if unsatisfied, to the relevant authority.

Write to the Grievance Officer below. We acknowledge requests within 48 hours and aim to resolve them within 30 days; requests for medical records are handled within the 72-hour rule.

10. If something goes wrong

If your information is exposed by a security incident, we will notify the affected clinic and affected users without undue delay, and report the incident to CERT-In within 6 hours of becoming aware of it, as the Directions of 28 April 2022 require.

11. Children

Tokeno accounts are for adults. A parent or guardian may book on behalf of a child using their own account; the clinical record then belongs to the child and is handled by the clinic accordingly.

12. Changes to this policy

If we change this policy in a way that affects you, we will show a notice in the app before the change takes effect. The date at the top always reflects the current version.

13. Grievance Officer and contact

In accordance with the Information Technology Act, 2000 and the rules made under it:

For anything else: hello@tokeno.in

If your concern is about what a doctor wrote, or about your treatment, please raise it with the clinic first — they hold that record. We will help you reach them.