Safe & Secure

Privacy Policy

Protecting your information with care.

Last updated: 3 November 2026

At Dr. Zag (operated by Ambwani India LLP, “Dr. Zag”, “we”, “us” or “our”), we value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, share and safeguard the information shared by users while accessing our website https://www.drzag.co.in/ and our services, including our online shop and our online consultation service. By using our website, you agree to the practices described in this Privacy Policy.

This policy applies to visitors, customers, patients, and doctors who register with us. It also describes how we handle data received from Google APIs when an authorized Google account is connected to our website for scheduling online consultations.

Information We Collect

The information we collect depends on how you use our website. We collect it when you place an order, register an account, book or manage an online consultation, register as a doctor, submit a form, contact customer support, subscribe to newsletters, or simply browse our website.

Customers (online shop)
  • Full name, contact number and email address
  • Shipping and billing address
  • Payment-related information (see “Payment and transaction information” below)
  • Order history
  • Device and browser information
Patients (online consultation)
  • Full name, email address and WhatsApp / phone number
  • Age, gender and address
  • Optional profile photo, if you upload one
  • Account login details (your password is stored in protected, hashed form by
  • WordPress and is never visible to us)
  • Your consent to our terms and privacy policy at sign-up
  • Appointment and consultation details: the speciality or service and doctor you choose, the date and time of your appointment, the consultation mode, appointment status, and the Google Meet link for your consultation
  • Information you choose to share about your health concerns for the purpose of your consultation, and reviews you choose to submit about a doctor
Doctors (registration and professional information)
  • Full name, email address and WhatsApp / phone number
  • Professional information: speciality, qualification, medical registration number, years of experience, languages, and professional address
  • Profile photo and profile details shown on your public doctor profile page
  • Availability (days, working hours and slot duration) and consultation fees
  • Appointments booked with you

Doctor accounts are reviewed by our team before they can receive bookings. Only the profile details intended for the public profile (such as name, photo, speciality, qualification, experience, languages, availability and fee) are displayed publicly.

Email addresses and WhatsApp numbers

We collect your email address and WhatsApp number to create and secure your account, to verify them with one-time passwords (OTP), to send appointment confirmations, reminders and service notifications, and to contact you about your order or consultation.

Payment and transaction information

Payments are processed by our payment gateway (Razorpay). Card, UPI, net-banking and similar payment details are entered on the payment gateway’s secure systems; we do not store your full card number, CVV, UPI PIN or net-banking credentials. We receive and keep transaction records such as the order or appointment reference, amount, payment status and payment identifiers, so that we can confirm payment, issue refunds and maintain accounting records.

Information submitted through website forms

When you use our contact, enquiry, registration, login, booking or support forms, we collect the information you enter (for example your name, email, phone number and message) and use it to respond to you and provide the requested service.

Technical information and cookies

We may automatically collect technical information such as IP address, device and browser type, pages visited and the date and time of visit. Where applicable, this is collected using cookies and similar technologies (see Cookies & Tracking Technologies).

Google Account and Google API Data

Dr. Zag uses Google OAuth 2.0 to connect one Google account owned by Dr. Zag (the clinic’s own account) to our website. A Dr. Zag administrator connects it once from the website’s administration area. Patients, doctors and website visitors are never asked to sign in with Google or to grant Google permissions to our website. The connection is used only to create Google Calendar events with Google Meet links for online consultations.

Permissions (OAuth scopes) we request:

  • Google Calendar – calendar.events (“View and edit events on all your calendars”). We use this permission only to create, look up and delete the consultation events that our own website creates on the connected account’s primary calendar. Our website finds its events by their booking reference; it does not browse, list or read the clinic’s other calendar entries.
  • Basic account identity – openid and email. We read only the email address of the connected Google account, so that the administrator can see which account is connected.

The Google data our website handles through this connection is limited to:

  • Connected Google account information: the email address of the connected account.
  • Calendar event details we send to Google: an event title in the form “Dr. Zag online consultation” followed by the booking code; a description containing the booking code; the appointment start time, end time and time zone; and the email addresses of the assigned doctor and the patient, who are added as guests of the event. The event does not contain the patient’s name, address, age, gender or health concern. Guests cannot see each other’s email addresses through Google, and Google does not send its own invitation emails for these events.
  • Google Meet link: the unique Meet link that Google generates for each event, and the event’s identifier, which we store with the appointment record.
  • OAuth credentials: a refresh token and a short-lived access token issued by Google so that the connection keeps working.

Google data access is limited to what the connected account’s holder approves on Google’s consent screen and to the functionality described in this policy. We do not access your emails, Google Drive files, contacts or photos through this integration.

How We Use Google Data

We use Google data only to provide the online consultation feature of the Dr. Zag website. Specifically:

  • When an appointment is confirmed (a paid or a free consultation), we create a Google Calendar event with a Google Meet conference for it and store the resulting Meet link with the booking.
  • The Meet link is shown in the patient’s and doctor’s dashboards and is sent to them by email and WhatsApp, including in the reminder sent shortly before the appointment.
  • If an appointment is cancelled or expires, we delete its Google Calendar event so the meeting room is not left open.
  • Our website does not currently reschedule appointments, so it does not update events for that reason.

We do not use Google data for advertising, marketing, profiling or any purpose unrelated to these features. We do not sell it, we do not give it to data brokers, and we do not use it to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models.

Dr. Zag’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not allow humans to read Google data unless we have the affirmative agreement of the account holder for specific data, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and anonymized for internal operations.

Compliance with the Google API Services User Data Policy

Dr. Zag’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data only to provide or improve the user-facing consultation scheduling features described in this policy.
  • We do not transfer Google user data to others except as needed to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users.
  • We do not use or transfer Google user data for serving advertisements, including retargeting, personalized or interest-based advertising.
  • We do not allow humans to read Google user data unless we have your affirmative agreement for specific data, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and anonymized for internal operations.

Google Data Storage and Security

  • Refresh token: encrypted before it is stored in the website’s database, using a key derived from the website’s secret keys. It is kept in a setting that is not publicly accessible.
  • Access token: the short-lived access token is cached temporarily (about one hour) and then discarded and renewed using the refresh token.
  • OAuth client secret: kept in the website’s server configuration file, not in the database, and never shown on screen.
  • Who can access it: only authorized Dr. Zag administrators can connect, test or disconnect the Google account. Patients and doctors cannot see or use these credentials.
  • What we keep from Google: the Meet link, the event identifier and the connected account’s email address are stored in the website’s database together with the booking record or settings. We do not keep a copy of the clinic’s calendar.
  • In transit: all communication with Google uses encrypted HTTPS connections.
  • Limits: no online system can guarantee 100% security, but we apply the measures above and restrict access to people who need it to operate the service.

Google Data Sharing

  • We do not sell Google user data and we do not share it for advertising purposes.
  • The Meet link and appointment details are shared only with the patient and the doctor of that appointment, through their dashboards, by email and by WhatsApp. Our administrators also receive booking notifications.
  • The email addresses of the doctor and the patient are sent to Google as guests of the calendar event. Google processes them under its own terms and privacy policy.
  • Our email and WhatsApp service providers (see “Third-Party Services”) carry the messages that contain the Meet link only on our behalf and only to deliver them.
  • We may disclose information if required by law or a valid legal process.

Revoking Google Account Access

  • Disconnecting from our website. A Dr. Zag administrator can click “Disconnect” in the Google Meet settings of the consultation system. This asks Google to revoke the stored token and deletes the stored credentials from our database.
  • Revoking from your Google Account. You can remove Dr. Zag’s access at any time at https://myaccount.google.com/permissions: select Dr. Zag, then choose “Remove access” or “Delete all connections”. After this, our website can no longer create or delete Google Calendar events or Meet links, and the stored credentials stop working.
  • What happens to existing data. Meet links already issued keep working and remain in the appointment records. Calendar events are deleted automatically when an appointment is cancelled or expires; the event of a completed appointment stays in the clinic’s Google Calendar until the clinic deletes it. If you want us to delete Google-related data or need help, email drzagambwani@gmail.com.

Gmail (sending emails)

Our website sends its emails (verification codes, booking confirmations, reminders and notifications) through the Gmail account of Dr. Zag, which is connected to our email plugin using Google OAuth. We use this permission only to send emails. We do not read, search, list or delete the contents of any mailbox. These emails can contain the information described in this policy, including names, contact details, appointment details and Google Meet links. Copies of sent emails may remain in the Sent folder of the Dr. Zag Gmail account. This use also follows the Google API Services User Data Policy, including the Limited Use requirements.

  • Email delivery: our emails (verification codes, order and appointment emails) are sent through the Gmail service of Dr. Zag’s Google account via our SMTP plugin, and newsletters may be sent through our email marketing plugin.
  • WhatsApp messaging: we use the official WhatsApp Business Platform (Cloud API) provided by Meta Platforms to send verification codes, booking confirmations, reminders and cancellation notices to the WhatsApp number you provide. These messages contain the booking details needed for the consultation (for example the booking ID, doctor, date and time and, in reminders, the consultation link). Messages to doctors can also include the patient’s name, age and gender, and contact number so that the doctor can conduct the consultation. Meta processes these messages under its own terms.

To make a request, email drzagambwani@gmail.com from the email address registered with us, or call 9265406191. We may need to verify your identity first. You can update many account details yourself from your dashboard. For deletion, our administrators can delete a patient’s account record on request and can also remove the website login account. Appointment and payment records are kept for legal, tax, accounting and medical-record purposes and retain the contact details that were used for that booking. We will tell you if we cannot delete certain information and why.

Google User Data & OAuth Compliance

When you log in, register, or use our online consultation and appointment services via Google Sign-In or Google OAuth on  DrZag  (https://www.drzag.co.in), our application accesses and collects specific data from your Google Account.

Data We Access and Collect

Depending on the features you use on our website, we access the following Google user data with your explicit consent:

  • Basic Profile Information: Your name and profile picture (used to personalize your user account and patient consultation records).
  • Email Address: Your primary Google email address (used for account authentication, appointment confirmations, consultation notifications, and medical communication).
  • Calendar Access (If Applicable): If you enable appointment syncing, we access your Google Calendar to schedule, update, or sync consultation appointments.
How We Use Google User Data

Google User Data is used exclusively to provide and improve user-facing features within the DrZag platform, specifically for authenticating your identity, scheduling online consultations, managing appointment details, and facilitating direct communications regarding your health services.

Data Sharing and Third-Party Transfer

We do not sell, rent, or trade your Google user data to third parties, advertisers, or data brokers. Google user data is never shared with external services except where necessary to perform patient consultation services or as required by law.

Data Storage and Security

All Google user data accessed by DrZag is securely stored using industry-standard encryption protocols. We implement strict access controls to ensure your health and account information remains confidential.

Data Retention and Deletion

We retain your Google account information only for as long as your DrZag user account remains active. You may request the immediate deletion of your account and associated Google user data at any time by contacting us at drzagambwani@gmail.com. Additionally, you can revoke DrZag’s access to your Google account at any time via your Google Account Security Settings.

Compliance with Google Limited Use Requirements

DrZag’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How We Use Your Information

Dr. Zag uses your information for the following purposes:

  • Processing and delivering orders
  • Creating and managing patient and doctor accounts
  • Verifying your email address and WhatsApp number using one-time passwords
  • Booking, scheduling, managing and conducting online consultations
  • Providing customer support
  • Managing payments, refunds and returns
  • Improving website performance and user experience
  • Sending order updates, appointment confirmations, reminders and service notifications
  • Informing users about new products, offers and promotions (you can opt out at any time; see User Rights). We do not use
  • Google user data for this purpose.
  • Preventing fraud, unauthorised access and misuse of services
  • Conducting analytics and internal research
  • Complying with legal and regulatory obligations

We may also use anonymised data for business analysis and website optimisation.

Cookies & Tracking Technologies

Our website may use cookies and similar technologies to:

  • Enhance website functionality, such as
  • keeping you logged in and remembering your cart
  • Remember user preferences
  • Analyze traffic and visitor behavior
  • Improve marketing performance

Our consultation login and booking pages ask caching systems not to store pages that contain your personal information. Fonts and similar resources may be loaded from third-party services such as Google Fonts, which may receive your IP address and browser information when the page loads. You can choose to disable cookies through your browser settings, though certain features of the website (such as logging in or booking a consultation) may not function properly.

Third-Party Services

We may share limited information with trusted third-party service providers, only as needed to provide the specific service. These include:

  • Payment gateway: Razorpay, to process payments securely.
  • Shipping partners: including Shiprocket and courier partners, to deliver and track orders.
  • Email services: to deliver OTP, order, appointment and support emails.
  • WhatsApp messaging: to send OTP verification codes and appointment or order notifications to the WhatsApp number you provide.
  • Google services: Google Calendar and Google Meet for online consultations, and Google Fonts for website fonts.
  • Analytics tools and marketing platforms: to understand website usage and measure marketing performance, using non-Google-API data only.
  • Website tools and hosting: our WordPress hosting provider and the plugins used to run the website, forms and online shop.

These third parties are authorised to use your information only for providing specific services related to Dr. Zag operations, and they have their own privacy policies. We do not sell or rent your personal information to any third party. Third-party websites linked from our website are not covered by this policy.

Data Protection & Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, misuse, loss or disclosure. Our website security systems are regularly updated to maintain a safe and secure experience. Access to personal information is limited to people who need it to provide our services.

However, while we strive to protect your information, no online platform can guarantee 100% security. Please keep your password confidential and contact us immediately if you suspect unauthorised use of your account.

Data Retention

We keep personal information only for as long as needed for the purposes described in this policy, including providing our services, resolving disputes, maintaining business and accounting records, and meeting legal and regulatory requirements. When information is no longer needed, we delete or anonymise it, unless we are required by law to keep it. Order and payment records may be retained for the periods required by applicable tax and accounting laws.

User Rights and Data Deletion

Patients, doctors, customers and authorized Google account holders may:

  • Access their personal information
  • Update or correct account details
  • Delete their account
  • Withdraw consent for promotional communication
  • Request deletion of data associated with a Google account connection (including stored OAuth tokens)

To make a request, email drzagambwani@gmail.com from the email address registered with us, or call 9265406191. We may need to verify your identity before acting on a request. Requests are handled subject to applicable legal and business requirements: for example, we may need to keep certain order, payment, or consultation records where the law requires it. We will tell you if we cannot delete certain information and why.

Children's Information

Our consultation service is intended for use by adults. Where a consultation is for a child, it should be booked and attended by a parent or legal guardian, who is responsible for the information provided.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. The “Last updated” date at the top shows when it was last revised. If we make material changes to how we handle Google user data, we will update this page before the change takes effect.

Contact Us

For questions about this Privacy Policy, your information, or help with Google account access and data requests, please contact us.

Dr. Zag | Ambwani India LLP

Who we are

Suggested text: Our website address is: https://www.drzag.co.in.

Comments

Suggested text: When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

Suggested text: If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Cookies

Suggested text: If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Suggested text: Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

Suggested text: If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

Suggested text: If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

Suggested text: If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where your data is sent

Suggested text: Visitor comments may be checked through an automated spam detection service.