Privacy Request

Last updated: 22 August 2026 · Requests: privacy@rxfolio.org

You can exercise your data rights either directly in the RxFolio application or by writing to us. Anything you can do yourself in the app happens immediately; anything you send us is handled by a person, within the period required by the law applicable to your request. Our internal target is to acknowledge within 3 business days and resolve within 30 days.

Do it yourself, immediately

See and correct your data

Every health record in RxFolio is editable in the app. Open the record and change or delete it. This is the fastest route for correction and erasure of individual entries.

Export your data

Account settings offers a data export containing your account metadata, preferences, care grants, clinical records, and document pointers.

Delete your account

In the app, or from this website after signing in. Deletion removes your records rather than disabling the account.

Delete account

Withdraw optional consent

Disconnect Drive or OneDrive, revoke a caregiver’s access, or stop generating visit-preparation reports at any time from the app. Revoke provider access in your Google or Microsoft account settings.

Requests you send to us

Email privacy@rxfolio.org from the address associated with your RxFolio account. Use one of these subject lines so we route it correctly.

Right	Subject line	What we do
Access / summary of processing	`Access request`	Confirm what categories of personal data we hold about you, the purposes, and who it has been shared with.
Correction, completion, updating	`Correction request`	Correct inaccurate, misleading, or incomplete data, including account fields you cannot edit yourself.
Erasure	`Erasure request`	Delete your account and associated data, or specific records where deletion in the app is not possible.
Data portability / export	`Export request`	Provide a machine-readable copy where the in-app export does not cover your need.
Withdrawal of consent	`Withdraw consent`	Stop the processing you identify. Withdrawing consent for core health-record storage means deleting your account.
Nomination	`Nomination`	Record a nominee who may exercise your rights in the event of your death or incapacity, where Indian law provides for it.
Grievance	`Grievance`	Escalate to our Data Protection / Grievance Officer if you are dissatisfied with our handling.

What to include

The subject line from the table above;
The email address of your RxFolio account, and the sign-in provider you use (Google or Microsoft);
A clear description of what you want;
For a correction, the record concerned and the correct value;
If you are acting for someone else, the basis of your authority.

Please do not send copies of medical records, identity documents, or other sensitive attachments unless we specifically ask for them. Describe the request instead; we will request only what is necessary.

Compose a privacy request

Verification

Before we act on a request about personal data we may need to verify that it really comes from you, because acting on an unverified request could disclose or destroy someone’s health information. Verification is usually satisfied by writing from the account email address; where the request is high-risk we may ask you to confirm through the application. Please provide accurate information and do not impersonate another person.

Timelines

We acknowledge requests promptly, and aim to do so within 3 business days;
Our internal target is to complete them within 30 days;
The binding deadline is the one set by the law applicable to your request and your location, which varies by request type; we do not apply a single universal period. Where Indian data-protection law applies, we act within the period prescribed under the Digital Personal Data Protection Act, 2023 and the rules made under it.
If we need more information, the clock effectively pauses until you reply;
Account deletion carried out by you in the app or on this site is immediate.

When we may decline

We may decline or partially decline a request where the law permits or requires it — for example where we must retain billing records for tax purposes, where security or audit logs must be kept to investigate unauthorized access, where a request would reveal another person’s personal data, or where we cannot verify your identity. If we decline, we tell you why and what you can do next.

Escalation

If our response does not resolve your concern, escalate to our Data Protection / Grievance Officer (see Contact). You may also approach the competent data-protection authority or another forum available to you under applicable law. Nothing on this page limits a right you have under law.