MEDICOLEGAL TRAINING FOR PRACTISING DOCTORS
DoctorLawyer™ Academy. Version 1.3, 18 September 2026. In force. Text reference 2d162ca56289f2fe. Issued by Dr. Rupal V. Rana, MBBS, DCH, LLB, LLM, Proprietor.
This notice tells you what we do with your personal data when you use DoctorLawyer™ Academy. It is written to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
1.1 The person responsible for your personal data is DoctorLawyer™ Medicolegal Consulting Services, a sole proprietorship, proprietor Dr. Rupal V. Rana, at 412, Bldg 2, Wing 4, Mandpeshwar Dham CHS, Laxman Mhatre Marg, SVP Road, Borivali (W), Mumbai 400103.
1.2 In the language of the Act we are the Data Fiduciary, which means the person who decides why and how your personal data is processed. You are the Data Principal, which means the person the data is about.
2.1 The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, the notifications themselves being dated 13 November 2025. The statute commences in phases from the date of publication.
2.2 The machinery and definitions came into force on 14 November 2025. Consent Manager registration comes into force on 14 November 2026. The substantive obligations, which include the notice and consent provisions, the duties of a Data Fiduciary, your rights as a Data Principal, and the provision about transfer of data outside India, come into force on 14 May 2027.
2.3 We are not waiting for that date. We apply the standards described in this notice now, as a matter of practice, and we will meet the statutory obligations as each comes into force. Where this notice describes a right, we will honour it now, whether or not the provision creating it has yet commenced.
2.4 Separately from that statute, we are bound by professional obligations of confidentiality that apply today and do not wait for 2027.
3.1 We collect the following, and no more, and the same list applies whether you have paid for a course or have only opened module one without paying:
(a) your name, as you give it to us and as it will appear on any certificate;
(b) your email address;
(c) your mobile number, which is optional, and which you do not have to give;
(d) your specialty or area of practice, which you give us so that we can pitch the material sensibly;
(e) your progress through a course, which means which modules you have opened and completed and when, and, where a course has a quiz, your score in each quiz, whether you passed it and how many attempts you took;
(f) your certificate record, which means the course, the date of completion and the certificate reference;
(g) your acceptance record, which means the version of the terms you accepted and the information listed in Part E;
(h) for a paid course, a transaction reference and a confirmation from the payment service provider that payment succeeded or failed;
(i) any message you send us, and our reply;
(j) ordinary technical information the platform generates when you log in, such as the date and time and the internet protocol address of the session, which we use to keep the account secure and to identify misuse.
4.1 We do not ask for, and you must not give us, any of the following:
(a) your medical registration number, or any registration or enrolment number of any kind;
(b) any identity number, including a permanent account number, an Aadhaar number, a passport number, a driving licence number or a voter number;
(c) any bank account number, card number or payment instrument detail. Payment is handled by a payment service provider and those details do not come to us;
(d) any patient data of any kind, including a patient's name, a record, an image, an investigation, a history or anything from which a patient could be identified;
(e) any information about your fees, your income, your earnings, your turnover or the value of anything you own.
4.2 If any of the above reaches us anyway, we will tell you, we will not use it, and we will delete it. If it is patient data we will delete it at once.
5.1 We use your personal data for these purposes and no others:
(a) to give you access to the course you enrolled in, and to keep that access working;
(b) to record and show your progress, and to let you resume where you left off;
(c) to issue a certificate where you complete a course, and to keep the public verification page working;
(d) to apply a marking to material that identifies the copy issued to you, so that a copy circulated in breach of the terms can be traced to its source;
(e) to answer your questions and deal with any complaint;
(f) to tell you about changes to a course you are enrolled in, about a session you have booked, and about changes to these instruments;
(g) to keep the record of your acceptance of the terms and of your consent, so that both are provable;
(h) to take payment for a paid course and to deal with a refund;
(i) to keep the platform and your account secure, and to detect and deal with misuse of the material;
(j) to meet an obligation that the law places on us, and to establish or defend a claim.
5.2 We do not use your personal data to profile you, to score you, or to make any automated decision that affects you.
6.1 We process your personal data on the basis of your consent.
6.2 You give that consent by a clear affirmative action, separately from accepting the Terms of Enrolment. Accepting those terms is not by itself your consent to processing.
6.3 Your consent is limited to the purposes listed in clause 5. If we ever want to use your data for a purpose not listed there, we will ask you again.
6.4 You can withdraw your consent at any time. Clause 12 says how, and what follows.
7.1 We will not send you marketing about other courses or services unless you separately opt in to it.
7.2 That opt in is a separate tick. You can decline it and still use the Academy in full.
7.3 You can withdraw it at any time, by clicking the unsubscribe link in any such email or by writing to us, and withdrawing it does not affect your access to any course.
7.4 We do not sell your personal data. We do not rent it. We do not share it with anyone for their own marketing, and we do not place it on any list.
8.1 Dr. Rupal V. Rana.
8.2 A small number of people engaged by the practice who need it to run the Academy, each under a written obligation of confidentiality, and each only to the extent needed.
8.3 Service providers who process data on our instructions and under contract: the platform or hosting provider, the email service provider, and the payment service provider. They may use it only to provide their service to us.
8.4 Where you separately instruct the practice on a matter of your own, and that matter needs it, an empanelled advocate of the High Court of Bombay. That does not happen because you enrolled in a course. It happens only if you separately instruct us and the matter requires it.
8.5 Where the law requires disclosure, or a court, tribunal, commission or other competent authority orders it. Where we are permitted to tell you that this has happened, we will.
8.6 Nobody else.
9.1 The statute imposes no data localisation requirement. It does not require your data to be stored on servers in India.
9.2 Transfer of personal data outside India is permitted by default. It is subject only to the following, and nothing else:
(a) the Central Government may by notification restrict transfer to a particular country or territory. No country or territory has been notified.
(b) the Central Government may by general or special order specify requirements about making personal data available to a foreign State, or to a person or entity under the control of or an agency of such a State. No such requirement has been specified.
(c) any other Indian law that provides a higher degree of protection or a greater restriction on transfer continues to apply. We check whether any such law applies to us.
9.3 Neither the statute nor the Rules require this notice to tell you about a transfer outside India. We tell you anyway, because you should know where your data sits.
9.4 Some of the service providers named in clause 8.3 may hold or process data on servers outside India. Wherever your data is held, our obligations to you under this notice are the same, and we remain answerable to you for it.
9.5 The provision of the statute about transfer outside India does not itself commence until 14 May 2027. Clause 9.2 describes the position as it will operate, and the position we apply now.
10.1 While you are enrolled. We keep the data in clause 3 for as long as you have access to a course.
10.2 After access ends. We keep your name, email address, specialty, progress and messages for twelve months after your access ends, so that we can deal with a question, a complaint or a refund, and then we delete them.
10.3 The certificate record. If you have earned a certificate, we keep the name on the certificate, the course, the date of completion and the certificate reference for as long as the certificate remains capable of verification on the public page, because a certificate that cannot be checked is worth nothing. If you want that record removed, tell us, and we will remove it and mark the certificate as no longer verifiable.
10.4 The acceptance record. We keep the record described in Part E for as long as it may be needed to prove what you agreed and when, and for the period during which a claim about it could still be brought.
10.5 Payment records. We keep what the tax and accounting law requires us to keep, for the period it requires.
10.6 What overrides deletion. Where a law in force requires us to keep something, we keep it for that period even if you have asked us to delete it, and we will tell you which category that is. We do not use it for anything else in the meantime.
11.1 You have the right to access your data: a summary of the personal data of yours we are processing, what we are doing with it, and the identities of those with whom we have shared it.
11.2 You have the right to correction, completion and updating of your data where it is inaccurate, incomplete or out of date. You can do most of this yourself in your account.
11.3 You have the right to erasure of your data, subject to clause 10.6.
11.4 You have the right to grievance redressal, which means a right to complain to us and to have the complaint answered. Clause 13 gives the contact and the timeline.
11.5 To exercise any of these, write to the grievance contact in clause 13, from the email address on your account. We may ask one question to satisfy ourselves that it is you.
11.6 We answer a request within fifteen working days. Where a request is complex we will tell you within that time why we need longer and when to expect the answer.
11.7 We do not charge for any of this.
11.8 Once the relevant provisions commence, you may also complain to the Data Protection Board of India if you are not satisfied with how we have dealt with your grievance. Complaining to us first is the quicker route and we would rather you did.
12.1 You can withdraw your consent at any time by writing to the grievance contact in clause 13, or by using the withdrawal option in your account.
12.2 Withdrawing is as easy as giving consent was.
12.3 Withdrawal ends your access to the course. We cannot run the course for you without processing your name, your email address and your progress. So when consent is withdrawn, access stops.
12.4 Withdrawal does not undo processing that was lawful before you withdrew.
12.5 On withdrawal we delete your data, except what clause 10.6 requires us to keep, and except the certificate record if you ask us to keep the verification working. We will ask you which you want.
12.5A If you ask us to remove the certificate record, the public verification page for that certificate will say that the record was removed at the request of the person it was issued to, that nothing about their completion of the course is in question, and that the certificate was not withdrawn. We word it that way deliberately: withdrawal under clause 13.6 of Part A is something we do for cause, and asking us to delete your data is not that, so the page must not let the two be confused.
12.6 If you have paid for a course and you withdraw consent, clause 15 of Part A decides what happens to the fee. Withdrawal of consent is not by itself a ground for a refund outside those provisions, and does not take away any statutory right.
13.1 Grievances about your personal data go to Dr. Rupal V. Rana, DoctorLawyer™ Medicolegal Consulting Services, 412, Bldg 2, Wing 4, Mandpeshwar Dham CHS, Laxman Mhatre Marg, SVP Road, Borivali (W), Mumbai 400103.
13.2 Email doctorlawyerofficial@gmail.com with the words "Data grievance" in the subject line. Telephone +91 88509 78548.
13.3 We acknowledge within three working days and answer within fifteen working days.
14.1 You may nominate another individual to exercise your rights under this notice on your behalf in the event of your death or of your becoming incapable of exercising them yourself.
14.2 To nominate, write to the grievance contact with the nominee's name and a contact address or email address for them. We will record it and confirm.
14.3 You may change or cancel a nomination at any time in the same way.
14.4 We act on a nomination only on satisfactory proof of the event that triggers it.
15.1 A personal data breach means any unauthorised processing of your personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises its confidentiality, integrity or availability.
15.2 If one happens and your data is affected, we will tell you without delay, and in any event as soon as we have enough to tell you anything useful. We will tell you:
(a) what happened, described fairly and in plain words;
(b) what data of yours was affected, and the extent and timing so far as we know it;
(c) the likely consequences for you;
(d) what we have done and are doing about it;
(e) what you should do, if there is anything sensible for you to do;
(f) who to contact for more.
15.3 We will notify the Data Protection Board of India as and when the law requires it, in the form and within the time it requires.
15.4 We keep a written record of any breach, what caused it, what was affected and what we did.
16.1 The Academy is for practising doctors and is not intended for anyone under eighteen. We do not knowingly collect the personal data of a child. If we learn that we hold any, we delete it.
17.1 The platform uses only what is needed to keep you logged in, to remember your place in a course, and to keep the account secure. We do not use advertising cookies and we do not allow third party tracking for advertising.
17.2 Logs of the kind described in clause 3.1(j) are kept for a short period for security purposes and then deleted.
18.1 This notice carries a version number and a date. The current version is always on the Academy.
18.2 If we change it in a way that matters to you, we will tell you by email and by a notice on the Academy before the change takes effect, and where the change requires a fresh consent we will ask for it.
18.3 We keep every superseded version and will give you a copy on request.
End of Part B. 18 clauses.
Terms of Enrolment · Refunds and Cancellation · What the Courses Cost · No Recording and Intellectual Property Notice · Contact and Grievances