Privacy Policy

Effective date: May 25, 2026 · Last updated: May 25, 2026

Who we are

Doctalink ("Doctalink," "we," "us") is an end-to-end encrypted messaging service for verified United States healthcare providers. Doctalink is operated as a sole proprietorship by Nithin Jay Dodla, an individual based in Texas, USA.

This Privacy Policy explains what information we collect, how we use and protect it, who we share it with, and the choices and rights you have. It applies to the Doctalink mobile app and the doctalink.com website. Questions? Email doctalinksupport@gmail.com.

Doctalink is currently offered in a limited beta/pilot. During the pilot, you should not transmit real Protected Health Information (PHI) unless you have signed a Business Associate Agreement (BAA) with us.

Information we collect

We collect only what is needed to verify you as a healthcare provider, run the messaging service, and meet our security and legal obligations:

Account & identity data: your name, National Provider Identifier (NPI), institutional email address, and phone number, collected to verify that you are a licensed provider.
Authentication data: credentials managed by our cloud authentication provider, and optional biometric settings stored only on your device.
Message content: messages are end-to-end encrypted on your device using the Signal Protocol. We store only ciphertext that we cannot decrypt or read.
Message metadata: sender and recipient identifiers, conversation identifiers, and timestamps, used to deliver messages and render your inbox.
Device & push tokens: a push-notification service token so we can notify you of new messages. Notifications never contain message content.
Audit and security logs: records of access events, sign-ins, and message send/delivery events, kept to meet HIPAA Security Rule requirements.
Limited technical data: app version and basic operational data needed to keep the service running and secure.

We do not use advertising or third-party analytics SDKs, and we do not track you across other apps or websites.

How we use your information

To verify your provider status and create and secure your account.
To deliver messages and push notifications.
To protect the service, detect abuse, and maintain HIPAA-required audit trails.
To respond to your support requests.
To comply with applicable law.

We never sell your information, and we do not use your messages for advertising, training, or profiling.

End-to-end encryption & PHI

Message content is encrypted end-to-end with the Signal Protocol. Encryption and decryption happen on your device; the keys never leave it in usable form. As a result, neither Doctalink nor our cloud providers can read your messages. Lock-screen notifications display only the sender's name and a generic "New message" — never message content.

Because Doctalink may carry PHI when used by covered entities, we will sign a Business Associate Agreement (BAA) with provider customers before any real PHI is exchanged.

How we share information

We share information only with the categories of service providers ("subprocessors") needed to operate Doctalink, and only as necessary:

HIPAA-compliant U.S. cloud infrastructure — hosting, database, authentication, and notification routing. Covered by a signed Business Associate Agreement.
Push-notification services — delivery of mobile push notifications (no message content).
National Provider Identifier (NPI) registry — used to verify the NPI you provide against public provider records.

We may also disclose information if required by law, to comply with legal process, or to protect the rights, safety, and security of users and the public. We do not sell or "share" (as defined by California law) your personal information for advertising. Named subprocessor details are available to enterprise / health-system reviewers under NDA — contact us.

Data retention

We keep account and message data for as long as your account is active. You can delete your account at any time from within the app (Settings → Delete Account) or by emailing us. Upon deletion, your personal data and message history are permanently removed from our systems within 30 days, except audit logs, which are retained for six years as required by HIPAA §164.316(b)(2)(i).

Your rights & choices

You may request to access, correct, or delete your personal information, and you may object to or restrict certain processing. Depending on your state (for example, California's CCPA/CPRA, Texas's TDPSA, and similar laws), you may also have the right to know what we collect, to delete it, to correct it, to opt out of sale or sharing, and to not be discriminated against for exercising these rights.

We do not sell or share your personal information, so there is nothing to opt out of for advertising purposes. To exercise any right, email doctalinksupport@gmail.com; we will verify your request and respond within the timeframe required by applicable law.

How we protect your information

We apply administrative, technical, and physical safeguards including end-to-end encryption, encryption in transit and at rest, access controls, optional biometric unlock, session timeouts, app-attestation checks, and audit logging. No system is perfectly secure, but we work to protect your information consistent with the HIPAA Security Rule. If you believe your account has been accessed without authorization, contact us immediately at doctalinksupport@gmail.com.

Data location

Doctalink is operated in the United States, and your information is stored and processed on U.S.-based HIPAA-compliant cloud infrastructure.

Your California privacy rights

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA").

Categories of personal information we collect.

Identifiers — name, professional and personal email, mobile phone number, and the National Provider Identifier (NPI) you provide for verification.
Professional or employment-related information — professional credentials and affiliations you choose to enter.
Internet or other electronic network activity information — device, app, and session metadata needed to operate the service and maintain HIPAA-required audit logs.
Communications content — your messages are end-to-end encrypted; we hold only ciphertext that we cannot read.

We do not collect government IDs, biometric data (any biometric unlock stays on your device), precise geolocation, race, religion, sexual orientation, or other sensitive categories beyond those listed.

Sources of personal information. Directly from you; from the public CMS NPI Registry for verification only.

Business purposes. Providing and securing the service, verifying healthcare provider eligibility, delivering messages, maintaining audit logs, responding to support requests, and complying with law.

Categories of third parties we share with. HIPAA-compliant cloud infrastructure providers, push-notification providers, communication-verification providers (email / SMS), and government authorities when compelled by law. We do not share with advertising networks, data brokers, or analytics vendors.

Sale or sharing for cross-context behavioral advertising. We do not sell personal information and we do not share personal information for cross-context behavioral advertising.

Sensitive personal information. We do not use sensitive personal information to infer characteristics about you.

Retention. Account data while your account is active; HIPAA consent records and audit logs for six years (HIPAA §164.316(b)(2)(i)); deleted-account data removed within 30 days except where the law requires longer retention.

Your rights. You have the right to know, delete, correct, opt out of sale/sharing, and limit our use of sensitive personal information, and the right not to be discriminated against for exercising those rights. To submit a verifiable request, email doctalinksupport@gmail.com. We will verify your identity using information already on file. Authorized agents may submit a request on your behalf with written authorization and verification of identity.

Children

Doctalink is intended only for licensed healthcare providers and is not directed to, or intended for use by, anyone under 18. We do not knowingly collect information from children.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new effective date and, for material changes, provide notice in the app or by email. Your continued use of Doctalink after an update means you accept the revised policy.

Contact us

For any privacy question or request, contact:
Nithin Jay Dodla (operator of Doctalink)
Email: doctalinksupport@gmail.com