Bbrok

Privacy Policy

Last updated: 4 August 2026

This Privacy Policy explains how Velswift (trading as "Bbrok", "we", "us") collects, uses, and protects personal data when patients interact with clinics that use our WhatsApp appointment-booking service. This policy is published in compliance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and Meta's WhatsApp Business Platform requirements.

1. Who we are

Data Fiduciary: Velswift (sole proprietorship registered under GST in India). Trade name: Bbrok.

Service: A WhatsApp-based appointment booking assistant offered to clinics in India. When you message a participating clinic on WhatsApp, your messages are routed through our software to help schedule, reschedule, or cancel appointments.

Contact: contact@bbrok.in · +91 81223 66242

2. What data we collect

When you send a WhatsApp message to a participating clinic, we collect:

  • Your WhatsApp phone number (provided to us by Meta when you initiate contact)
  • Your WhatsApp profile name (if you have set one)
  • The text of your messages exchanged with the clinic's bot, together with the delivery details WhatsApp sends us with each message (message ID, timestamp, and message type)
  • Appointment details you provide: chosen slot and status
  • Consent records: the date, time, and language of your consent under the DPDP Act
  • Optional consultation notes (health data): if your clinic chooses to use the dashboard's patient-records feature, the doctor may record clinical details from your visit — for example a diagnosis, prescribed medicines, or notes. This is sensitive personal data under the DPDP Act. It is entered by the clinic on its own secured dashboard, is visible only to that clinic, and is never sent back to you over WhatsApp. Many clinics don't use this feature at all — a booking never requires it.

We do not collect financial information, government identifiers, location data, or contents of media files unless you voluntarily send them.

3. Why we collect it (purpose)

  • To schedule, modify, and cancel your appointment with the clinic you contacted
  • To send you booking confirmations, appointment reminders (including a reminder a few hours before your visit), and status updates via WhatsApp
  • To allow the clinic to view your booking and contact you about your appointment
  • To let your clinic keep its own record of your consultation, where it chooses to use that feature, as part of providing your care
  • To maintain a record required for regulatory compliance and dispute resolution

We do not use your data for advertising, profiling, or selling to third parties.

4. Legal basis (DPDP Act § 6)

We process your personal data only after you have given specific, informed, and unambiguous consent by tapping "I agree" in response to the consent prompt sent by the clinic's bot at first contact. You can withdraw consent at any time by sending STOP to the clinic's WhatsApp number.

5. Who we share data with

  • The clinic you booked with: full access to your phone number, name, and appointment details via their secured dashboard. Each clinic acts as an independent Data Fiduciary for their own use of your data.
  • Meta Platforms Ireland Ltd.: WhatsApp message delivery is operated by Meta. Meta processes message metadata under their own privacy policy.
  • MongoDB Inc. (Atlas): our database host. Data is encrypted at rest and in transit, and stored in the Mumbai (India) region.
  • DigitalOcean LLC: hosts the server that runs our software, in the Bangalore (India) region.
  • Government authorities: only when compelled by valid Indian law.

We do not transfer your data outside India except as necessary for the above processors and as permitted under DPDP § 16.

6. How long we keep it (retention)

  • Appointment records, conversation messages, and consent records: retained for as long as the clinic you contacted continues to use Bbrok. They are needed to show the clinic your booking history, to prove your consent was lawfully obtained, and to resolve any dispute about an appointment.
  • Consultation notes (where a clinic uses them): retained with the appointment record for as long as the clinic uses Bbrok, and deleted when the clinic closes its account — the same lifecycle as your booking history. The clinic may also keep its own separate medical records under its professional obligations.
  • When a clinic closes its Bbrok account: all of that clinic's patient data — appointments, messages, consultation notes, and consent records — is permanently deleted from our systems.
  • If you withdraw consent (send STOP): we stop messaging you immediately and keep only a minimal record that you opted out, so that we do not contact you again. We do not delete your past appointment records automatically, because the clinic may still need them for its own medical and financial recordkeeping.
  • If you want your data erased: email us (see section 7) and we will delete it within 30 days, except anything we or the clinic are required by law to retain.

We are working towards shorter automatic retention of message logs. Until that is in place, the periods above describe exactly what we do today.

7. Your rights (DPDP Act § 11–14)

You have the right to:

  • Access a copy of the personal data we hold about you
  • Correct inaccurate data
  • Erase your data (subject to legal retention)
  • Withdraw consent at any time (send STOP to the clinic's WhatsApp number)
  • Nominate another individual to exercise your rights in the event of death or incapacity
  • Lodge a grievance with our Grievance Officer (below)
  • Escalate to the Data Protection Board of India if unresolved

To exercise any right, email contact@bbrok.in with the subject "Data Request". We respond within 30 days.

8. Security

We protect your data using:

  • TLS 1.2+ encryption for all data in transit (including via WhatsApp and our dashboard)
  • Encryption at rest on the database
  • Role-based access: only the clinic you booked with, and authorised Velswift personnel, can see your data
  • Webhook signature verification (HMAC-SHA256) to ensure messages originate from Meta
  • Bcrypt-hashed passwords for all clinic dashboard logins

9. Children

The service is intended for adults booking on their own behalf. Where a child's appointment is booked, the booking adult is responsible for providing consent under DPDP § 9 and ensuring lawful processing on the child's behalf.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated via the clinic's WhatsApp channel where reasonable.

11. Grievance Officer

As required by the DPDP Act: