Bbrok

Privacy Policy

Last updated: 6 September 2026

This Privacy Policy explains how Velswift (trading as "Bbrok", "we", "us") collects, uses, and protects personal data when patients interact with clinics that use our WhatsApp booking and clinic-management service — appointment booking, and, where a clinic chooses to use them, consultation records, digital prescriptions and visit receipts. This policy is published in compliance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and Meta's WhatsApp Business Platform requirements.

1. Who we are

Data Fiduciary: Velswift (sole proprietorship registered under GST in India). Trade name: Bbrok.

Service: A WhatsApp booking and clinic-management platform offered to clinics in India. Bookings run on a WhatsApp number that we operate — it appears as “Bbrok Appointments” and the WhatsApp Business Account is ours, not the clinic’s. Clinics do not connect a number of their own.

Because one of our numbers serves several clinics, each clinic has a short clinic code printed beside the QR code on its poster. Scanning that QR opens WhatsApp with the code already filled in; sending it tells us which clinic you mean. We record which clinic you are booking with on that number so you don’t have to send the code again — that record is what routes your later messages to the right clinic.

Everything you send is handled by an automated assistant; nobody at the clinic answers messages on this number by hand. Your booking details are visible to the clinic you booked with, in its own dashboard. Clinics cannot see each other’s patients: if you book at two clinics on the same number, neither can see the other’s appointments, notes or records. Clinics may also use our dashboard to run their day-to-day operations — multiple doctors, patient records, consultations, digital prescriptions and visit receipts — where they choose to (see section 2).

Contact: contact@bbrok.in · WhatsApp +91 81223 66242

2. What data we collect

When you send a WhatsApp message to a participating clinic, we collect:

  • Your WhatsApp phone number (provided to us by Meta when you initiate contact)
  • Your WhatsApp profile name (if you have set one)
  • The text of your messages exchanged with our booking number, together with the delivery details WhatsApp sends us with each message (message ID, timestamp, and message type)
  • Which clinic you are booking with on that number, remembered so you don’t have to send the clinic code again
  • Appointment details you provide: chosen slot and status
  • Consent records: the date, time, and language of your consent under the DPDP Act
  • A clinic patient reference: a simple number (such as K12) the clinic’s dashboard assigns to you, so that two people sharing one phone are not mixed up. It is used inside that clinic only and is never sent to you.
  • Optional consultation notes (health data): if your clinic chooses to use the dashboard's patient-records feature, the doctor may record clinical details from your visit — for example a diagnosis, vitals (such as height, weight, blood pressure, pulse or temperature), prescribed medicines, or advice notes. This is sensitive personal data under the DPDP Act. It is entered by the clinic on its own secured dashboard, is visible only to that clinic, and is never sent back to you over WhatsApp. Many clinics don't use this feature at all — a booking never requires it.
  • Optional visit charges: if your clinic uses the dashboard’s receipt feature, it may record what it charged you for a visit — a description of each item and the amount — so that it can print you a receipt. These are figures typed in by the clinic; no payment is taken through Bbrok.

We never collect or store your payment details — no card, UPI, or bank information — because Bbrok never takes a payment from a patient. You pay the clinic directly, by whatever means the clinic accepts. We also do not collect government identifiers, location data, or the contents of media files unless you voluntarily send them.

3. Why we collect it (purpose)

  • To schedule, modify, and cancel your appointment with the clinic you contacted
  • To send you booking confirmations, appointment reminders (including, where possible, a reminder a few hours before your visit), and status updates via WhatsApp
  • To allow the clinic to view your booking and contact you about your appointment
  • To let your clinic keep its own record of your consultation, where it chooses to use that feature, as part of providing your care
  • To let your clinic record what it charged for a visit and print you a receipt for it
  • To maintain a record required for regulatory compliance and dispute resolution

We do not use your data for advertising, profiling, or selling to third parties.

4. Legal basis (DPDP Act § 6)

We process your personal data only after you have given specific, informed, and unambiguous consent by tapping "I agree" in response to the consent prompt sent at first contact. You can withdraw consent at any time by sending STOP to our booking number.

5. Who we share data with

  • The clinic you booked with: full access to your phone number, name, and appointment details via their secured dashboard. Each clinic acts as an independent Data Fiduciary for their own use of your data.
  • Meta Platforms Ireland Ltd.: WhatsApp message delivery is operated by Meta, through our WhatsApp Business Account. Meta processes message metadata under their own privacy policy.
  • MongoDB Inc. (Atlas): our database host. Data is encrypted at rest and in transit, and stored in the Mumbai (India) region.
  • DigitalOcean LLC: hosts the server that runs our software, in the Bangalore (India) region.
  • Government authorities: only when compelled by valid Indian law.

We do not transfer your data outside India except as necessary for the above processors and as permitted under DPDP § 16.

6. How long we keep it (retention)

  • Appointment records, conversation messages, and consent records: retained for as long as the clinic you contacted continues to use Bbrok. They are needed to show the clinic your booking history, to prove your consent was lawfully obtained, and to resolve any dispute about an appointment.
  • Consultation notes and visit charges (where a clinic uses them): retained with the appointment record for as long as the clinic uses Bbrok, and deleted when the clinic closes its account — the same lifecycle as your booking history. The clinic may also keep its own separate medical records under its professional obligations.
  • When a clinic closes its Bbrok account: all of that clinic's patient data — appointments, messages, consultation notes, visit charges, and consent records — is permanently deleted from our systems.
  • If you withdraw consent (send STOP): we stop messaging you immediately and keep only a minimal record that you opted out, so that we do not contact you again. We do not delete your past appointment records automatically, because the clinic may still need them for its own medical and financial recordkeeping.
  • If you want your data erased: email us (see section 7) and we will delete it within 30 days, except anything we or the clinic are required by law to retain.

We are working towards shorter automatic retention of message logs. Until that is in place, the periods above describe exactly what we do today.

7. Your rights (DPDP Act § 11–14)

You have the right to:

  • Access a copy of the personal data we hold about you
  • Correct inaccurate data
  • Erase your data (subject to legal retention)
  • Withdraw consent at any time (send STOP to the clinic's WhatsApp number)
  • Nominate another individual to exercise your rights in the event of death or incapacity
  • Lodge a grievance with our Grievance Officer (below)
  • Escalate to the Data Protection Board of India if unresolved

To exercise any right, email contact@bbrok.in with the subject "Data Request". We respond within 30 days.

8. Security

We protect your data using:

  • TLS 1.2+ encryption for all data in transit (including via WhatsApp and our dashboard)
  • Encryption at rest on the database
  • Role-based access: only the clinic you booked with, and authorised Velswift personnel, can see your data. A clinic may have more than one doctor under one account — each doctor's login sees only their own patients and bookings, while the clinic owner can see the whole clinic
  • Webhook signature verification (HMAC-SHA256) to ensure messages originate from Meta
  • Bcrypt-hashed passwords for all clinic dashboard logins

9. Children

The service is intended for adults booking on their own behalf. Where a child's appointment is booked, the booking adult is responsible for providing consent under DPDP § 9 and ensuring lawful processing on the child's behalf.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be published here and, where reasonable, notified to the clinics using the Service.

11. Grievance Officer

As required by the DPDP Act: