Privacy Policy

1Who we are

Derrick ("we", "us") operates this website and connects patients in India with verified women's health doctors. For any privacy question, or to exercise any right described below, write to info@derrickgynohub.com.

2What we collect

If you are a patient

• Account: your name, email address and a password you choose.
• Contact: a mobile number, so a clinic can call you back. It is not used to sign in.
• Enquiries and appointment requests: your city, the doctor or speciality you asked about, and whatever you write in the message.
• Community questions: anything you post on Ask a Doctor. These are shown publicly and are not attached to your name.
• Optional profile photo, if you upload one.

If you are a doctor

• Professional identity: name, qualifications, medical council registration number and council, year of registration, years of experience.
• Verification documents: degree and post-graduate certificates, council registration proof and a government photo ID.
• Practice details: clinic name, address, timings, contact number, specialities and services.
• Photographs you upload of yourself and your clinic.

Automatically

• IP address, used only to rate-limit sign-in attempts and one-time codes so accounts cannot be attacked by brute force.
• Approximate location, only if you grant browser permission, and only to sort doctors by distance. It is not stored on our servers.

We do not build advertising profiles of you, and we do not buy personal data from anyone. If you accept advertising cookies we measure how well our own adverts work — see Advertising measurement below for exactly what is and is not shared.

3How your credentials are protected

• Passwords are hashed with bcrypt (cost factor 12) before they are stored. We hold the hash, not your password. Nobody at Derrick can read it, and it cannot be reversed — which is why a forgotten password must be reset rather than recovered.
• One-time email codes are hashed too, expire after ten minutes, are single-use, and are destroyed after five incorrect attempts. Requests are rate-limited per address and per network.
• Sessions are signed tokens held in httpOnly, secure,sameSite=laxcookies, so page scripts cannot read them. Patients, doctors and administrators each get a separate cookie — one role can never reach another's area.
• All traffic is encrypted in transit over HTTPS.

4Where it is stored

• Database: MongoDB Atlas, on access-controlled managed infrastructure, reachable only by this application with credentials that are never exposed to your browser.
• Images: profile and clinic photographs are held on Cloudinary and served publicly, because they appear on public profiles anyway.
• Verification documents are treated differently.They are stored with authenticated delivery, so a direct link returns an error rather than the file. They are streamed only through a route that re-checks an administrator's session on every single request. No shareable link to a doctor's ID or certificate is ever produced.
• Email is sent over an authenticated SMTP connection for verification codes, password resets and account notices.

5What we never do

• We do not sell, rent or trade your personal data. Not to advertisers, insurers, pharmaceutical companies, data brokers or anyone else.
• We do not charge patients for anything, and we never ask a patient for card or bank details. Any message claiming otherwise is not from us.
• We do not share a patient's enquiry with doctors other than the one it is routed to.
• We do not publish a doctor's verification documents, and other doctors never see them.
• We do not use your health questions to train advertising or recommendation profiles.

6Who can see what

• The doctor an enquiry is assigned to sees your name, city, phone number and message — that is how they call you back.
• Our verification team sees doctors' documents, solely to run the 5-step check.
• The public sees a doctor's professional profile and approved patient reviews. Reviews show only the display name given.
• Service providers — our database, image storage and email providers — process data strictly to run the service, and cannot use it for their own purposes.
• Authorities, only where the law requires it.

7Cookies

Four cookies are set whatever you choose, and none of them track you:

• Session cookie — keeps you signed in. Removed when you log out.
• Language preference — remembers the language you picked.
• Cookie choice — remembers whether you accepted or declined the cookies below.
• Location — only if you use “search near me”, and only in your own browser.

Only if you press Accept on the cookie banner:

• Meta advertising cookies (_fbp, and _fbc if you arrived from one of our adverts) — set by Meta Platforms so we can tell which of our adverts brought someone to the site.

Press Declineand none of these are set: the Meta script is never loaded and nothing is sent to Meta from your browser or from our servers. You can change your mind by clearing this site's cookies, which brings the banner back.

7bAdvertising measurement

When you accept advertising cookies, we tell Meta Platforms that certain actions happened — a page was viewed, an enquiry was sent, an appointment was requested, a doctor signed up. This lets us see which adverts work and stop paying for the ones that do not. It is sent from your browser and, for the same action, from our servers, so that it is counted once rather than twice.

What is never included, whatever you choose:

• The speciality or condition you searched for.
• Which doctor you viewed, enquired about or booked.
• Anything you wrote — enquiry messages, questions, reviews or notes.
• The full address of the page. A doctor's profile page names a gynaecologist, so the address is shortened before it is sent.

Where we send your name, email address or phone number to match a conversion to an advert, it is hashed with SHA-256 before it leaves our server — Meta receives a fingerprint it can compare against, never the address or number itself. Meta is a separate controller for what it receives; its handling is governed by Meta's Privacy Policy.

8How long we keep it

• One-time codes: ten minutes, then deleted automatically.
• Accounts: for as long as the account exists. Ask us to delete it and we will.
• Enquiries and appointment records: kept while they are needed for the clinic relationship, then removed.
• Verification documents: kept while a doctor is listed, so their status can be re-checked, and deleted when the listing ends.

9Your rights

You can ask us to show you what we hold about you, correct anything wrong, delete your account and its data, or stop using it in a particular way. Write to info@derrickgynohub.com and we will respond within 30 days. You do not need an account to make a request, and asking costs nothing.

10Children

Derrick is intended for adults. If you are under 18, please use it with a parent or guardian. We do not knowingly create accounts for children, and we delete any we find.

11Changes

If this policy changes we will update the date at the top, and for anything significant we will say so on the site. Continuing to use Derrick after a change means you accept it.