Data Protection

1. Overview

This policy outlines how CareQ protects personal data within its queue management platform. It applies to all deployments — hosted and on-premise — and is grounded in the principle that queue management requires minimal data.

2. Data controller and processor

When a hospital or clinic deploys CareQ, the organisation remains the data controller for all patient and staff information. CareQ acts as a data processor, handling ticket data, contact details and queue events on behalf of the controller. CareQ does not access or process data for its own purposes.

3. Categories of personal data

CareQ processes a narrow set of data categories:

• —Ticket identifiers — a number assigned to each patient, used on all public displays instead of names.
• —Contact information — a phone number or email provided at check-in for the sole purpose of sending queue notifications.
• —Queue timestamps — check-in time, time served, time completed, and time of each re-queue event.
• —Queue estimates — projected wait times and position in the queue.
• —Staff actions — staff identifier (from single sign-on), department assignment, and the action taken (call, reassign, restore).

4. Purpose and legal basis

Each category of data is processed for a specific, documented purpose. Ticket identifiers exist to track a patient through the queue. Contact information is processed to deliver time-sensitive queue notifications. Queue events and timestamps are used to calculate estimates and generate operational analytics. Legal basis for processing is the legitimate interest of the hospital in managing patient flow, and the performance of a service requested by the hospital.

5. Data residency

CareQ can be deployed in a customer's own environment or a managed one. Data residency follows the deployment — patient data stays in the region and infrastructure you choose. No queue data is transferred across borders without explicit configuration by the data controller.

6. Security

CareQ applies security controls proportional to the sensitivity of the data processed:

• —All data in transit is encrypted via TLS.
• —Data at rest is encrypted in the deployment environment.
• —Staff access is scoped to departments through single sign-on and is logged.
• —Every queue action records which staff member performed it.
• —The staff console continues operating locally during network interruptions and syncs when the connection is restored.

7. Subprocessors

CareQ engages a limited set of subprocessors to operate the service. Subprocessors are contractually bound to the same data protection obligations. Current subprocessors include SMS gateway providers, WhatsApp Business for queue notifications, email providers for correspondence and cloud hosting providers for platform deployment.

8. Breach notification

In the unlikely event of a personal data breach, CareQ notifies the data controller without undue delay and within the timeframes required by applicable data protection law. The notification includes the nature of the breach, the categories and approximate number of data subjects affected, and the measures taken to mitigate the impact.

9. Retention and deletion

Ticket data and queue events are retained for the duration of the active deployment. Contact details used for notifications are purged when a ticket expires. Upon contract termination, all customer data is deleted within 90 days unless the controller requests an export. Deletion is logged and available on request.

10. Your rights

Data subjects retain all rights under applicable data protection law, including the right to access, rectification, erasure, portability and objection. Requests should be directed through the hospital's CareQ administrator or to privacy@carequeues.in.

11. Data protection agreement

A formal data protection agreement (DPA) is available on request and forms part of the deployment contract. It covers the obligations of both the controller and processor, subprocessor terms, breach procedures and data subject rights.

12. Contact

For data protection enquiries, contact privacy@carequeues.in.