DocDesk helps a doctor run a clinic's front desk: give patients daily tokens, run the OPD
queue, show the queue on a waiting-room screen, collect consultation fees and share receipts.
This page says exactly what we store, why, who else handles it, and how to get it deleted. It
covers the Android app (com.rslabs.docdesk) and the web app at
docdesk-rslabs.web.app.
Who is responsible for what
DocDesk has one kind of user: the doctor (clinic owner). The doctor decides
which patient details to enter and is responsible for having their patients' permission to do so.
RS Labs stores and processes that information only on the doctor's behalf, to provide the app.
What we collect about the doctor
- Mobile number — used only to sign you in with a one-time code (OTP). The SMS
is sent by Google Firebase Authentication.
- Clinic profile — clinic name, doctor's name and qualification, clinic
address and phone, consultation fee and receipt settings. These appear on receipts.
- Subscription status — your free-trial dates and, if you subscribe, the
Razorpay reference for each DocDesk payment.
What the doctor stores about patients
- Patient details — name, and optionally mobile number, age, gender and
address.
- Visit and fee records — visit dates, token numbers, whether the patient was
seen, fees, payments received (amount, cash / UPI / card, an optional reference) and receipt
numbers.
DocDesk does not store medical records. There are no fields for symptoms,
diagnoses, prescriptions, test results, vitals, attachments or clinical notes. DocDesk never
stores full card numbers, UPI PINs or bank details.
The waiting-room display
If the doctor turns on the TV queue display, DocDesk creates a private, hard-to-guess link that
shows the clinic name, the doctor's name, the current and upcoming token numbers and
patient names, and the list of missed tokens. Phone numbers and fees are never shown
there. Anyone who has the link can see that screen, so the doctor controls who gets it (for
example, a TV in the waiting room, or patients who receive it with their token). The doctor can
reset the link at any time, which stops the old link from working immediately.
App usage (analytics)
From app version 1.2.0 we use Google Analytics for Firebase to understand how doctors
get started with DocDesk — for example which screens are opened, whether sign-in succeeded or failed (with
the error type), and whether the first patient, token, payment and TV display were set up. This tells us where
new doctors get stuck so we can fix it.
- It uses an app-instance identifier generated by Firebase, basic device information (model, OS
version, language) and an approximate location (city or region level, derived by Google from the
network address — never GPS). It does not use the advertising ID.
- The events never contain names, phone numbers, addresses, amounts or any patient details.
- The data is used only to improve DocDesk; it is not used for advertising and is not sold.
Demo clinic
"Explore a demo clinic" lets anyone try DocDesk without a phone number. It creates a temporary clinic with
made-up sample patients (and its own temporary waiting-room display link) under an anonymous login. Anything
entered in the demo is deleted when you leave it, and automatically within 3 days otherwise.
What we do not do
- No advertising, no ad identifiers, and no selling or renting of data.
- No tracking across other apps or websites. The only analytics is the app-usage measurement
described above.
- We do not message patients. Token numbers and receipts are sent by the doctor from their
own WhatsApp or share sheet; DocDesk only prepares the message or PDF.
Where it is stored and who can see it
- Records are stored in Google Cloud Firestore in Mumbai, India, encrypted in
transit and at rest by Google.
- Each clinic's records can be read only by that doctor's signed-in account; this is enforced
by server-side security rules. The only exception is the waiting-room display described above.
- RS Labs can see account, clinic and patient records through an internal, access-controlled
admin console. We use it only to run and support the service — for example account and trial
status, usage statistics, fixing problems you report, preventing abuse and handling deletion
requests. Every access is logged, and we never use patient details to contact patients or for
marketing.
Service providers
- Google Firebase (Authentication, Firestore, Cloud Functions, Hosting, Google
Analytics for Firebase) — to run the app and measure how it is used. Firebase privacy.
- Razorpay — only if the doctor buys a DocDesk subscription. Razorpay collects
the payment details on its own page; we receive only the payment status and reference.
Razorpay privacy.
How long we keep it
- Everything is kept while the account exists, so the clinic can see its full history.
- When the doctor deletes the account, all clinic data, patient records and the display link
are deleted immediately.
- We keep a one-way hash of the doctor's phone number and the free-trial end
date after deletion, only to stop the free trial being claimed again. It cannot be
turned back into the phone number.
- Payment records that Razorpay must keep by law are retained by Razorpay under its own
policy.
Deleting data
- Doctors: in the app, open More → Settings → Delete account. This
permanently deletes the clinic, all patients, visits and receipts, the display link, cancels any
DocDesk subscription, and removes the login. See how to delete your
account for the other options.
- Patients: ask your doctor to remove your details. If you cannot reach them,
email us (below) with the clinic's name and your mobile number and we will pass the request to
the doctor.
- Doctors can export all their data at any time from Reports → Export all data.
Children
DocDesk is a tool for doctors and is not directed at children. A clinic may register patients
under 18; the doctor is responsible for having a parent or guardian's consent.
Changes
If this policy changes in a way that affects what we collect, we will update the date at the
top of this page and mention it in the app's release notes.
Contact
RS Labs, Pune, India · riyazshaikh16in@gmail.com