Privacy

Last updated 8 October 2026.

Drapto is software a clinic or hospital uses to run itself, sold as a service by XDQ Labs Private Limited, a private limited company incorporated in India. Most of the data in it is put there by the clinic about its own patients. The clinic decides what to collect; we hold it for them and do not sell it, trade it, or use it to build anything else.

Where it lives

On servers in India, for every clinic, wherever the clinic is. Backups are encrypted before they leave the machine and a restore is rehearsed monthly — an untested backup is not a backup.

Clinics outside India

A clinic in the US, the UK, Switzerland or the European Economic Area that keeps patient records in Drapto is transferring them to India, and is told so before the first record goes in: its owner accepts the patient-data terms inside Drapto, once, on behalf of the clinic. Under HIPAA the practice is the covered entity; under the GDPR, the controller; we process records on its instructions and for nothing else. India has no adequacy decision, so for Europe we offer a Data Processing Agreement with the EU Standard Contractual Clauses, and for the US a Business Associate Agreement — on request, from the same page.

Who else sees it

Only these, and only the part each one needs to do its job:

• Brevo — sends email on a clinic's behalf. Receives the recipient's address and the message.
• Razorpay — takes payment for a clinic's subscription, in rupees, US dollars, euros, pounds or dirhams. Receives the amount and the payer's own details; card numbers never reach us.
• WhatsApp (Meta) — delivers appointment messages where a clinic has turned it on. Receives the phone number and the message.
• An AI provider — only where a clinic has switched on a feature that uses one, and only the text of that question. It is off unless somebody turns it on.
• Amplitude — product analytics: which screens of the console are opened and which features are used, counted per clinic, hospital or company. It receives the organisation's id, plan and country and the name of the screen or action — never a patient, a staff member's name or email, or anything typed into Drapto. It is sent from our server, so nothing of it runs in your browser and no cookie is set. Held in Amplitude's US or EU data centre; used only to see which parts of Drapto are used, so we know what to fix.

Nobody else. There is no advertising network, no data broker and nothing that follows a person anywhere in this product — the analytics above count what organisations do, and set no cookie, which is why you were not asked to accept cookies.

A patient's own record

A patient's record is theirs. It spans every clinic on Drapto they have been to, opens to them by a link confirmed against their own mobile, and they can hide a clinic from it or pause it entirely. A clinic sees the patients it has treated; it does not see somebody else's.

Staff health schemes

Where an employer pays for its staff to be seen, that employer is shown who attended, how often, and what it cost. It is never shown a diagnosis, a finding, a prescription or a result. That line is enforced in the software rather than promised in a policy, and it is the reason the arrangement is safe to enter.

What is deleted, and when

• Identity documents uploaded to verify a clinician are purged once verification is finished; the finding is kept, the document is not.
• Security logs of refused requests are kept for seven days.
• A clinic can export everything it holds and ask for its data to be erased. The erase sweeps every table keyed to that clinic and then verifies nothing remains. Backups already taken still contain it until they age out.

Asking us

Write to hello@drapto.com and a person will answer. If you are a patient rather than a clinic, ask the clinic first — they hold the record and can act on it faster than we can.

XDQ Labs Private Limited, a private limited company incorporated in India · Spaze iTech Park, Sector 49, Gurugram, Haryana 122018, India · hello@drapto.com
D-U-N-S 581612662 · DPIIT DIPP271804
Home · Privacy · Terms · Refunds · Contact