Privacy policy

This policy explains how Gully System Pvt. Ltd. (“GullyMed”, “we”) handles personal data on gullymed.com, app.gullymed.com and practice websites hosted on our platform.

Two roles

For practice owners and staff who create accounts, we are the data fiduciary. For patient data that a practice records in GullyMed, the practice is the data fiduciary and we act as its data processor under our Data Processing Agreement.

Cookies and analytics

On gullymed.com we use Google Analytics, which sets cookies, to see which pages are useful. It loads only if you choose Accept in the cookie notice, and you can change your choice any time from Cookie settings in the footer. Declining does not limit what you can do on the site. Practice websites use our own analytics, which does not use cookies or identify visitors.

Contact form

If you send a message through the contact form we email it to our team and use your details only to reply to you. We do not store the form on our servers.

What we collect

• Account data: name, email address (used for one-time-code sign-in), optional contact number, practice details.
• Patient data entered by a practice: name, phone, age/sex, visit notes, prescriptions, files, invoices, payments. Health data is sensitive personal data under the DPDP Act 2023 and is processed only on the practice's instructions.
• Patient booking data entered on a practice website: name, email address, phone, chosen appointment, and the one-time code used to confirm.
• Technical data: IP address, device and browser information, audit logs.

Why

To provide the service: appointments, reminders by email, billing, records, websites. To keep accounts secure. To support practices (support access is logged and visible to the practice). We do not sell personal data and we do not run a patient marketplace.

Where

Patient data and media are stored in India (AWS Mumbai region). Messages are delivered through MSG91; payments through Razorpay on the practice's own account.

Your rights

Practices can export or delete their data from the console. Patients should contact their practice; we assist the practice in honouring access, correction and erasure requests. Grievance officer: privacy@gullymed.com.

Retention

Account data for the life of the account plus 90 days. Patient records for as long as the practice keeps them, subject to medical record-keeping rules. Audit logs for 3 years.