1. Purpose

This record lists each way in which Zebrold Private Limited, as operator of Consult Your Doctor, handles personal data. It supports the company's duties under the General Data Protection Regulation and India's Digital Personal Data Protection Act, 2023, and is kept up to date by the data protection lead. Where the company acts for another controller, such as a hospital, that is noted in the last column.

2. Controller details

3. Register of processing activities

4. Special categories and children

Most of the data handled by the platform is health data, which the General Data Protection Regulation treats as a special category and which India's law treats as sensitive in practice. It is processed only for health care and the related purposes in the register, under the safeguards in the Information Security and Access Control Policy (CYD-SEC-01). Data about children is processed only with the consent of a parent or guardian, which is verified, and no child's data is used for advertising or tracking.

5. Processors and recipients

6. Requests from individuals

Requests to see, correct, erase or restrict data, to object, to move data or to withdraw consent are logged here and answered within the time that the law allows, normally within one month under the General Data Protection Regulation.

7. Security measures in summary

The technical and organisational measures that protect this data, including role-based access, multi-factor authentication, encryption, logging, backups, staff training and vendor review, are set out in CYD-SEC-01. This record must be updated if any of those measures changes in a way that affects the risk to individuals.

8. Purpose limitation and data minimisation

Each activity in the register has a stated purpose, and data may be used only for that purpose or for a purpose that is compatible with it and that the patient could expect. Before a new use is introduced, the data protection lead checks whether it is compatible and whether new consent or a new notice is needed. Only the data needed for the purpose is collected, and optional fields are clearly marked.

9. Roles and accountability

The directors are accountable for compliance. The data protection lead maintains this register, advises on assessments, trains staff and acts as the contact for regulators and individuals. Each department head is responsible for the accuracy of the entries in the register for his or her area and for telling the data protection lead of any new use of data.

10. Link to retention and deletion

The retention periods in the register are those in the Data Retention and Deletion Policy (CYD-DP-04). When data reaches the end of its period it is deleted or made anonymous, and the date and method are recorded in the quarterly deletion log.

11. Review log

12. Summary of individuals' rights

13. Review

The data protection lead reviews this record every six months and whenever a new use of personal data, a new vendor or a new country is introduced. The record is made available to a data protection authority on request.

1. Purpose

This record lists each way in which Zebrold Private Limited, as operator of Consult Your Doctor, handles personal data. It supports the company's duties under the General Data Protection Regulation and India's Digital Personal Data Protection Act, 2023, and is kept up to date by the data protection lead. Where the company acts for another controller, such as a hospital, that is noted in the last column.

2. Controller details

3. Register of processing activities

4. Special categories and children

Most of the data handled by the platform is health data, which the General Data Protection Regulation treats as a special category and which India's law treats as sensitive in practice. It is processed only for health care and the related purposes in the register, under the safeguards in the Information Security and Access Control Policy (CYD-SEC-01). Data about children is processed only with the consent of a parent or guardian, which is verified, and no child's data is used for advertising or tracking.

5. Processors and recipients

6. Requests from individuals

Requests to see, correct, erase or restrict data, to object, to move data or to withdraw consent are logged here and answered within the time that the law allows, normally within one month under the General Data Protection Regulation.

7. Security measures in summary

The technical and organisational measures that protect this data, including role-based access, multi-factor authentication, encryption, logging, backups, staff training and vendor review, are set out in CYD-SEC-01. This record must be updated if any of those measures changes in a way that affects the risk to individuals.

8. Purpose limitation and data minimisation

Each activity in the register has a stated purpose, and data may be used only for that purpose or for a purpose that is compatible with it and that the patient could expect. Before a new use is introduced, the data protection lead checks whether it is compatible and whether new consent or a new notice is needed. Only the data needed for the purpose is collected, and optional fields are clearly marked.

9. Roles and accountability

The directors are accountable for compliance. The data protection lead maintains this register, advises on assessments, trains staff and acts as the contact for regulators and individuals. Each department head is responsible for the accuracy of the entries in the register for his or her area and for telling the data protection lead of any new use of data.

10. Link to retention and deletion

The retention periods in the register are those in the Data Retention and Deletion Policy (CYD-DP-04). When data reaches the end of its period it is deleted or made anonymous, and the date and method are recorded in the quarterly deletion log.

11. Review log

12. Summary of individuals' rights

13. Review

The data protection lead reviews this record every six months and whenever a new use of personal data, a new vendor or a new country is introduced. The record is made available to a data protection authority on request.