Legal

Privacy policy

Last updated 4 November 2026

This policy explains what personal data MyTokenLive ("MyTokenLive", "we") handles when clinics use our token and queue service, and when anyone visits this website. We follow India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Who is responsible

For clinics and their staff, we decide how their account data is used, so we are the data fiduciary.

For patients, the clinic decides to collect their name and mobile number to run its queue, so the clinic is the data fiduciary and we process that data on the clinic's behalf. Patients can ask the clinic, or us, about their data.

What we collect

Clinic owners and staff

  • Name, mobile number and, if given, email address
  • Clinic name, town and language, doctors' names and timings
  • A password, stored only in scrambled (hashed) form
  • Plan, payments and WhatsApp credit history. Card, UPI and bank details are handled by Razorpay; we never see or store them.

Patients

  • Name and mobile number, entered by the clinic or by the patient when booking
  • Token details: doctor, date, token number and times
  • Messages the patient sends to the MyTokenLive WhatsApp number to book a token, or to stop messages

We do not collect medical records, symptoms or diagnoses. Please don't enter them in MyTokenLive.

Website visitors

Our web server keeps short-term technical logs (address, browser, page) for security. The app sets a sign-in cookie for staff.

Measuring our ads (Meta Pixel)

We advertise on Facebook, Instagram and WhatsApp. To see which ads bring clinics to us, this website and the sign-up screen use the Meta Pixel, and our server tells Meta when a clinic that came from an ad signs up or pays for its first plan (Meta's Conversions API).

  • On this website, small first-party cookies remember the ad or page that brought you here and your choice below. The Pixel sets Meta's own cookies (_fbp, _fbc).
  • When a clinic signs up, we save that ad information with the clinic, and keep the device's internet address and browser name to send with the sign-up and first-payment events.
  • We send Meta the owner's mobile number only in scrambled (hashed) form, so it can match the event to an ad view.
  • The Pixel never runs on patients' queue pages, the waiting-room TV or the clinic's working screens, and nothing about patients is ever sent to Meta.

You can opt out at any time. The Pixel then stops loading on this website and the sign-up screen, and we send no events about your sign-up.

Ad measurement is on for this browser.

How we use it

  • To run each clinic's queue: give tokens, show the live queue, update the TV
  • To send WhatsApp messages about a patient's token: the token number, "come now", delays and cancellations. We never send offers or promotions to patients.
  • To sign staff in, including one-time codes on WhatsApp
  • To bill clinics, and to send them service messages about their plan and credit
  • To give support, keep the service secure and fix problems

We never sell personal data, and we never use one clinic's patients for anything except that clinic's queue.

Who we share it with

Only the service providers we need to run MyTokenLive, each bound to protect the data:

  • Meta (WhatsApp Business Platform) to deliver WhatsApp messages
  • Meta (Pixel and Conversions API) to measure our ads, as described above, unless you opt out
  • Razorpay to take online payments
  • DigitalOcean for servers in Bangalore, India, where the data is stored
  • Cloudflare to deliver the website securely

We may also share data when the law requires it.

Patients' pages and the TV

The patient's live queue link and the waiting-room TV show only token numbers, waiting estimates and doctor names, never patient names or phone numbers. These pages are kept out of search engines.

How long we keep it

We keep clinic data while the clinic has an account, and after a plan lapses so the clinic can come back. A clinic can ask us to delete its account and data at any time. Patients' details are kept as part of the clinic's queue history; a patient or clinic can ask us to delete a patient's details.

Your rights

Under the DPDP Act you can ask to see your data, correct it, delete it, or withdraw consent, and you can name someone to act for you. Patients can reply STOP to our WhatsApp number to stop messages at any time. To use any of these rights, contact us at the contact details on our about page. We reply within 30 days.

Security

Data travels over encrypted connections (HTTPS). Staff see only their own clinic's data, and each role sees only what it needs. Passwords are hashed, and we keep regular backups in India.

Grievances

If you have a complaint about how we handle your data, contact our grievance officer at the contact details on our about page. If you are not satisfied with our reply, you can complain to the Data Protection Board of India.

Changes

If we change this policy, we update the date at the top and tell clinic owners in the app or on WhatsApp when the change matters to them.