SureMedico is a verified-only network for licensed dental and medical professionals (18+). This policy explains what information we collect, how we store it, who can see it, and your rights under the Digital Personal Data Protection Act 2023 (India), which governs our processing as an Indian company. Where the law of your own country also gives you data-protection rights, those apply in addition and you can exercise them at the same address in section 13.
1. Who we are
SureMedico is operated by SureMedico Services, a sole proprietorship registered in Mumbai, Maharashtra, India. SureMedico Services owns and publishes this website, suremedico.com, and the SureMedico mobile applications. Reach us at suremedicomail@gmail.com for any privacy question, grievance, or data-rights request; our registered business address is available on request.
2. What information we handle
Identity & verification (server-side)
- Full name, phone number, specialty, qualifications
- Medical registration number, council, year of registration
- Verification documents (medical degree, registration certificate, clinic permit) — uploaded by you, reviewed by the SureMedico admin team, and retained as proof of verification
- Profile photo (optional)
Clinic & location
- Clinic name and address as you enter them
- Clinic latitude/longitude — captured once when you tap "Set clinic location" using your device's GPS. Used for SOS radius calculation, consultant find-nearby, and circle auto-suggest. Not tracked in the background.
- Live location at the moment you tap SOS or open the find-nearby map. Sampled on demand only.
Communication & activity
- Posts, comments, and reviews you write inside circles, consultant bookings, vendor entries, and marketplace listings
- SOS alerts you send (category, time, location, recipients) and your responses to others' alerts
- Brownie Points awarded automatically when you respond to an SOS or accept a coverage request
Device data
- FCM push token — used to deliver SOS, verification status, and circle notifications to your device
- Crash reports (release builds only) via Firebase Crashlytics — stack trace + device model + OS version + app version. No name, phone, or registration number is logged.
Stored on this device only (encrypted at rest)
Local Hive storage (AES-256, key in Android Keystore) holds:
- JWT access & refresh tokens
- Cached profile fields, current FCM token, draft posts, consent flag
Never collected
- SMS, contacts, call logs, calendar, or microphone
- Advertising identifiers
- Biometric data
- Background location
- Patient information (SureMedico is for doctor-to-doctor use; patient PHI is intentionally out of scope)
The SureDealers app (dental dealers and suppliers)
A separate Android app, SureDealers (package com.suremedico.suremedico_dealer), is used by dental material and equipment dealers, distributors and labs — businesses, not medical professionals — to manage their listing on SureMedico. For a dealer account we handle:
- Business phone number (verified by a one-time code on WhatsApp), the contact person's name, and an optional email address used only for order, approval and price-confirmation notices
- Business details — name, address, city, category, brands and products carried, website — as already listed in our public dealer directory or as the dealer enters them
- Prices, delivery terms and product submissions the dealer enters; prices are shown to signed-in verified dentists, never publicly
- Orders placed by dentists with that dealer — items, quantities, the ordering clinic's name, delivery address and phone (shared with the dealer so the order can be fulfilled), status changes, return or replacement requests, and the dealer's private timeliness rating of a buyer (visible to SureMedico staff only)
- Device data — an FCM push token and the app version, used to deliver order and approval notifications. The Dealer app does not use Crashlytics or any analytics or advertising SDK.
SureDealers collects no location (foreground or background), no contacts, no SMS, no photos other than a product image the dealer chooses to upload, and no advertising identifiers. Dealers are never automatically added to WhatsApp messaging: the only WhatsApp messages a dealer receives from SureMedico are the sign-in code and, once, an invitation to install the app, which carries a "Never Message Me Again" button. A dealer can delete their account — with every price, delivery term, inbox message and device token it holds — at once from the app (More → Delete account), on the web at suremedico.com/dealer/delete-account/, or by emailing suremedicomail@gmail.com (done within 7 days). The business listing stays in the dealer directory as it was before the dealer joined, and orders dentists already placed stay in those dentists' records; that page lists exactly what is deleted and what is kept.
3. Information about clinics and practitioners who have not signed up
Most of the records in SureMedico belong to clinics and practitioners who have
not created an account. We hold roughly 85,000 such records, and you are
entitled to know this whether or not you are a user.
- Where it comes from. Publicly listed business information — a
clinic's name, practice address, public telephone number, website and public rating —
taken from public business listings and directories, from public posts in professional groups,
and from what people send us directly on WhatsApp. We do not buy contact lists, and we do not
collect patient information at any point.
- What we do with it. We use it to tell clinics and practitioners about
SureMedico, to match a vacancy with someone looking for work nearby, and to send professional
messages on WhatsApp. These are business contact details used for business-to-business
communication. We do not profile individuals, and we do not sell or rent this data to anyone.
- How to stop the messages. Reply STOP to any WhatsApp
message from us. It takes effect immediately, applies to every kind of message and every
number we send from, and we do not ask you to confirm it.
- How to be removed entirely. Email
suremedicomail@gmail.com, or reply to any message
from us, and ask for erasure. We delete the record and keep only the minimum needed to make
sure we do not contact you again.
- If you later create an account on the same telephone number, that record
becomes your profile and the rest of this policy applies to it.
4. Why we handle this information
- Verification — confirming you are a licensed medical professional before granting access
- Authentication — verifying it's really you signing in (WhatsApp OTP for +91 phones, Firebase Phone Auth otherwise)
- Core features — SOS routing within 1 km radius, consultant find-nearby, circle auto-suggest, marketplace and pool memberships
- Safety & trust — moderating violating content, removing fraudulent vendors, blocking misuse of SOS
- Stability — anonymous crash reports and aggregate usage trends
5. Who can see your data
- You — full access through the app
- Other verified doctors — your name, specialty, clinic name and approximate location, profile photo, and any content you post inside circles or consultant listings. Your phone number is not shown to other doctors unless you explicitly include it in a post or accept a consultant booking that exchanges contact details.
- The SureMedico admin team — full record (including verification documents) for the verification gate, abuse moderation, and grievance response
- Service providers (Google Firebase for auth/FCM/Crashlytics, Meta WhatsApp for OTP delivery, Google Maps for map rendering) — only the minimum required to provide that service. Bound by their respective platform-data terms.
- Nobody else. We do not sell, rent, share, or trade your data with advertisers, brokers, recruiters, or any third party.
6. How long we keep it
- Account & profile — kept while your account is active. Deleted within 30 days of your written request to suremedicomail@gmail.com.
- Verification documents — retained as proof of verification for the lifetime of the account; deleted on account deletion.
- Posts, comments, SOS history — retained for the lifetime of the account; you can delete individual items where the app supports it.
- Crash reports — 90 days at Firebase Crashlytics' default retention.
- OTP codes — 5 minutes in Redis, then expired or deleted on first successful use.
7. Your rights
Under the Digital Personal Data Protection Act 2023 (India), you have the right to:
- Access — request a copy of all data we hold about you
- Correct — edit your profile, clinic details, qualifications inside the app
- Erase — request full account deletion via email
- Withdraw consent — log out from Profile (clears local data) and email us to delete server-side data
- Raise a grievance — write to suremedicomail@gmail.com with the word Privacy in the subject line. Acknowledged within 7 days; full response within 30 days.
8. Verified-only access
SureMedico is gated by manual admin verification. Your account exists in a "pending verification" state until our admin team reviews your registration certificate. During that period no features are reachable; if verification is rejected, your data is deleted within 30 days unless you appeal in writing.
9. Third-party services
SureMedico uses these services as data processors:
- Google Firebase Authentication — phone-number verification (non-+91)
- Google Firebase Cloud Messaging — push notifications
- Google Firebase Crashlytics — crash diagnostics (release builds only)
- Meta WhatsApp Business Cloud API — OTP delivery to +91 phones via the approved medunity_login_otp Authentication template
- Google Maps Platform — map tiles for SOS, consultant, and circles screens
No advertising SDKs, analytics SDKs, or data brokers are used.
10. Security
- API traffic uses HTTPS / TLS 1.2 or higher
- JWT tokens on device are stored in Android Keystore-backed secure storage
- Hive cache is encrypted at rest with AES-256 (key in Keystore)
- Server access is restricted to a small number of admin accounts
- The app is signed with a developer-controlled key; tampered APKs are rejected by Android
11. Children
SureMedico is for adults aged 18 or over who are licensed medical professionals. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, write to suremedicomail@gmail.com and we will delete the account within 7 days.
12. Changes to this policy
The Last updated date at the top changes whenever we revise this policy. Material changes are announced in-app before they take effect.
13. Contact & grievance officer
For email, please include in the subject line:
- Privacy — for data-rights requests (access / correct / delete)
- Grievance — for complaints under the DPDP Act
- Verification — for verification-status questions
Acknowledgement within 7 days; full response within 30 days.