MEDICOLEGAL TRAINING FOR PRACTISING DOCTORS
DoctorLawyer™ Academy. Version 1.20, 12 November 2026. In force. Text reference 0271f391663b5034. Issued by Dr. Rupal V. Rana, MBBS, DCH, LLB, LLM, Proprietor.
This notice tells you what we do with your personal data when you use DoctorLawyer™ Academy. It is written to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
1.1 The person responsible for your personal data is DoctorLawyer™ Medicolegal Consulting Services, a sole proprietorship, proprietor Dr. Rupal V. Rana, at 412, Bldg 2, Wing 4, Mandpeshwar Dham CHS, Laxman Mhatre Marg, SVP Road, Borivali (W), Mumbai 400103.
1.2 In the language of the Act we are the Data Fiduciary, which means the person who decides why and how your personal data is processed. You are the Data Principal, which means the person the data is about.
2.1 The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, the notifications themselves being dated 13 November 2025. The statute commences in phases from the date of publication.
2.2 The machinery and definitions came into force on 14 November 2025. Consent Manager registration comes into force on 14 November 2026. The substantive obligations, which include the notice and consent provisions, the duties of a Data Fiduciary, your rights as a Data Principal, and the provision about transfer of data outside India, come into force on 14 May 2027.
2.3 We are not waiting for that date. We apply the standards described in this notice now, as a matter of practice, and we will meet the statutory obligations as each comes into force. Where this notice describes a right, we will honour it now, whether or not the provision creating it has yet commenced.
2.4 Separately from that statute, we are bound by professional obligations of confidentiality that apply today and do not wait for 2027.
3.1 We collect the following, and no more, and the same list applies whether you have paid for a course or have only opened module one without paying:
(a) your name, as you give it to us and as it will appear on any certificate;
(b) your email address;
(c) your mobile number, which is optional, and which you do not have to give;
(d) your specialty or area of practice, which you give us so that we can pitch the material sensibly;
(e) your progress through a course, which means which modules you have opened and completed and when, and, where a course has a quiz, your score in each quiz, whether you passed it and how many attempts you took;
(f) your certificate record, which means the course, the date of completion and the certificate reference;
(g) your acceptance record, which means the version of the terms you accepted and the information listed in Part E;
(h) what you tell us about a module or the course, if you answer the question at the end of a lesson, the question on your certificate page, or the one question we ask a month after your certificate: your answer, the part of a lesson you marked as unclear, anything you write in the boxes, and whether you ticked the box allowing us to quote it. Separately, we count how often each quiz question is answered wrongly; that count carries no name and is not linked to you;
(h) for a paid course, a transaction reference and a confirmation from the payment service provider that payment succeeded or failed;
(i) any message you send us, and our reply;
(j) ordinary technical information the platform generates when you log in, such as the date and time and the internet protocol address of the session, which we use to keep the account secure and to identify misuse.
(jA) a record of each time your course is opened on a new device or moved to another device under clause 11.3A of Part A (by the button or by an emailed link): the date and time, the country the move came from and the type of browser. We do not record the device itself or its location beyond the country. We read this record only to keep the account secure and to detect an account being shared, and we delete each entry ninety days after it is made or, if later, when a dispute under clause 35 of Part A that it relates to is closed.
(jB) an invisible code in each lesson page you open. It is worked out from your enrolment by a calculation that needs a key only we hold, and it is written into the text as characters that cannot be seen and do not change what you read or hear. It is not your name, your email address or any identity number, and nothing about you can be read from it without our key. It is not stored anywhere: it is worked out afresh each time a page is shown, and matched against your enrolment only if text from a lesson is found somewhere it should not be. Once your enrolment record is erased, the code can no longer be matched to you. We use it only for the purpose in clause 5.1(d).
(jC) when you ask for Doctor All-Access, what your email address paid for the twelve doctor courses in the previous twelve months. We look it up only to work out the credit in clause 36.3 of the Terms, and we send the figures only to that email address, never to the page where the address was typed. We send that email at most three times a day to one address, and the link in it works for three days.
4.1 We do not ask for, and you must not give us, any of the following:
(a) your medical registration number, or any registration or enrolment number of any kind;
(b) any identity number, including a permanent account number, an Aadhaar number, a passport number, a driving licence number or a voter number;
(c) any bank account number, card number or payment instrument detail. Payment is handled by a payment service provider and those details do not come to us;
(d) any patient data of any kind, including a patient's name, a record, an image, an investigation, a history or anything from which a patient could be identified;
(e) any information about your fees, your income, your earnings, your turnover or the value of anything you own.
4.2 If any of the above reaches us anyway, we will tell you, we will not use it, and we will delete it. If it is patient data we will delete it at once.
5.1 We use your personal data for these purposes and no others:
(a) to give you access to the course you enrolled in, and to keep that access working;
(b) to record and show your progress, and to let you resume where you left off;
(c) to issue a certificate where you complete a course, and to keep the public verification page working;
(d) to apply a marking to material that identifies the copy issued to you, so that a copy circulated in breach of the terms can be traced to its source. The marking is visible, your name and email address on every page, and invisible, the code described in clause 3.1(jB) in every lesson page;
(e) to answer your questions and deal with any complaint;
(f) to tell you about changes to a course you are enrolled in, about a session you have booked, and about changes to these instruments;
(g) to keep the record of your acceptance of the terms and of your consent, so that both are provable;
(h) to decide what to rewrite, what to film first and what the course is missing, which is what your answers to the questions at the end of a module are read for. They are not anonymous, and we say so on the page rather than implying otherwise, because every page you read already carries your name. They are deleted if you withdraw.
(h) to take payment for a paid course and to deal with a refund;
(i) to keep the platform and your account secure, and to detect and deal with misuse of the material;
(j) to meet an obligation that the law places on us, and to establish or defend a claim;
(k) to send you the emails described in clause 24 of Part A: the access email when you enrol, the module one email if you open module one without paying, the certificate email when you earn one, the answer to a question you ask inside a course, the email telling you what has changed in your course, the note of what is new in it (each with a way to stop those notes), the reminders about your course (at most four, each with a way to stop them), and a written confirmation if you withdraw your consent. These are not marketing. Clause 7 governs marketing, which is separate and optional.
5.2 We do not use your personal data to profile you, to score you, or to make any automated decision that affects you.
6.1 We process your personal data on the basis of your consent.
6.2 You give that consent by a clear affirmative action, separately from accepting the Terms of Enrolment. Accepting those terms is not by itself your consent to processing.
6.3 Your consent is limited to the purposes listed in clause 5. If we ever want to use your data for a purpose not listed there, we will ask you again.
6.4 You can withdraw your consent at any time. Clause 12 says how, and what follows.
7.1 We will not send you marketing about other courses or services unless you separately opt in to it.
7.1A If you open a module without paying and tick the optional box, we will also email you when that course changes: the same dated list of changes that buyers receive. That is the only thing the tick adds for a course you have not bought, and the unsubscribe link in each email stops it.
7.2 That opt in is a separate tick. You can decline it and still use the Academy in full.
7.3 You can withdraw it at any time, by clicking the unsubscribe link in any such email or by writing to us, and withdrawing it does not affect your access to any course.
7.4 We do not sell your personal data. We do not rent it. We do not share it with anyone for their own marketing, and we do not place it on any list.
7A.1 If you ask for the free 2027 calendar at doctorlawyeracademy.com/calendar, we collect your name, your email address, the edition you chose, the boxes you ticked and when, and the country the request came from. We do not ask for a mobile number, a registration number or anything else.
7A.2 We use them for these purposes and no others: to email you the link to your calendar; to open your calendar page and its files when that link is used; and, only if you ticked the separate box or turned it on from your calendar page, to email you each month's wallpaper and rule on or after the first day of each month of 2027; and, only if you ticked the third box or turned it on from your calendar page, for the purposes in clause 7A.6. The calendar is not a course. Asking for it does not enrol you in anything, and Part A does not apply to it.
7A.3 You give your consent by ticking the first box on the calendar form. The second box, for the monthly email, and the third box, for emails from DoctorLawyer under clause 7A.6, are each separate and optional. Not ticking them changes nothing about your calendar. You can turn the monthly email off from your calendar page or with the unsubscribe link in any of those emails. It stops by itself after December 2027.
7A.4 If the link is not opened within 30 days, we delete your details. Your calendar page has a button that deletes them at once. Whether or not you use it, we delete them all on 31 January 2028. The record of emails sent to you is kept as clause 10.2A says.
7A.5 We count how often the calendar page is viewed and each file is downloaded, by day. The count carries no name, email address or cookie and is not linked to you.
7A.6 If you tick the third box ("Keep me posted with useful updates from DoctorLawyer for my practice. Important emails only; I can stop any time."), or turn it on from your calendar page, we copy your name, email address, edition, the date you agreed and the source tag of the link you came through (clause 7B) into the enquiry register DoctorLawyer keeps in Google Workspace, marked as coming from the 2027 calendar. If you also take the free medicolegal risk check at check.doctorlawyer.in with the same email address, the register notes the date you took it and your result band, so that we do not invite you to take it again and can send what fits your result. DoctorLawyer may then email you, from time to time, about medicolegal updates, the free risk check, free tools and checklists, courses, talks and services that help your practice. We send only emails we think will help you, and not often. Each one tells you how to stop them. You can stop them at any time from your calendar page or by replying "Stop"; we then stop within 7 days and remove you from the register. If you do not, we remove you from it on 31 January 2028 with everything else in clause 7A.4.
7B.1 Some of our links carry a short tag naming where the link was posted, for example ?src=yt on the links in our free YouTube course. If you arrive through such a link, we keep the tag in a cookie on your browser for 30 days. If you open a course or pay within that time, we record the tag with that record. The tag names the channel, not you, and we use it only to count which channels bring learners to the Academy. It is kept with that record for as long as clause 10 keeps the record.
7C.1 If you fill in the short form on the learning page (/learn), we hold your first name, your email address, the answer you choose to "Who are you?", the topic you choose, the date you agreed, the version of this notice you agreed to, and the country your connection comes from. We do not record your city. We ask for nothing else. The form is for adults: by ticking the box you confirm that you are eighteen or over. Please do not send us your own story, any health details or anyone else's details.
7C.2 We use these details only to email you when a course on the topic you chose opens and about live classes, and for nothing else. They are kept on a list of their own. They are never used by DoctorLawyer's consulting services, by anyone who advises on a person's situation, or by any lawyer, and they are never used to contact you about a consultation, a review, a will or any other service of DoctorLawyer.
7C.3 You can stop these emails with the unsubscribe link in any of them, or by writing to us. If you ask, we delete your details from this list. If a course on your topic has not opened within eighteen months of the date you agreed, we delete your details from this list. Once we have emailed you that a course on your topic is open, we keep your details on this list for twelve months after that email and then delete them, unless you have stopped the emails sooner. Your rights under clauses 11 to 13 apply to this list as to any other data we hold.
8.1 Dr. Rupal V. Rana.
8.2 A small number of people engaged by the practice who need it to run the Academy, each under a written obligation of confidentiality, and each only to the extent needed.
8.3 Service providers who process data on our instructions and under contract: the platform or hosting provider, the email service provider, and the payment service provider. They may use it only to provide their service to us.
8.3A As at the date of this version those providers are these. The categories in clause 8.3 are the operative statement, because a provider can change. We name them anyway, because a doctor asking us where their data goes deserves the actual answer rather than a category.
| What | Who | What they hold |
|---|---|---|
| Platform, hosting and the database | Cloudflare | Your name, email address, mobile number if given, specialty, progress, quiz results, certificate record and acceptance record |
| Resend | Your name and email address, and the content of the emails we send you | |
| Enquiry register (clause 7A.6 only) | Google (Google Workspace) | Your name, email address, calendar edition, the date you agreed and the source tag, only if you ticked the third box on the calendar form |
| Payment | Razorpay | What they need to take a payment. We never receive or hold your card number or bank details, and they do not come to us |
8.3B If we change a provider we will update this clause, and clause 18 applies to that change.
8.4 Where you separately instruct the practice on a matter of your own, and that matter needs it, a High Court advocate. That does not happen because you enrolled in a course. It happens only if you separately instruct us and the matter requires it.
8.5 Where the law requires disclosure, or a court, tribunal, commission or other competent authority orders it. Where we are permitted to tell you that this has happened, we will.
8.6 Nobody else.
9.1 The statute imposes no data localisation requirement. It does not require your data to be stored on servers in India.
9.2 Transfer of personal data outside India is permitted by default. It is subject only to the following, and nothing else:
(a) the Central Government may by notification restrict transfer to a particular country or territory. No country or territory has been notified.
(b) the Central Government may by general or special order specify requirements about making personal data available to a foreign State, or to a person or entity under the control of or an agency of such a State. No such requirement has been specified.
(c) any other Indian law that provides a higher degree of protection or a greater restriction on transfer continues to apply. We check whether any such law applies to us.
9.3 Neither the statute nor the Rules require this notice to tell you about a transfer outside India. We tell you anyway, because you should know where your data sits.
9.4 Some of the service providers named in clause 8.3 may hold or process data on servers outside India. Wherever your data is held, our obligations to you under this notice are the same, and we remain answerable to you for it.
9.4A Specifically, as at this version. Our platform provider operates a distributed network and your data may be held or processed at locations outside India. Our email provider processes in its Asia Pacific region, which is outside India. Our payment provider is an Indian company. None of this changes anything we owe you under this notice, and clause 9.2 is why the transfer is permitted.
9.5 The provision of the statute about transfer outside India does not itself commence until 14 May 2027. Clause 9.2 describes the position as it will operate, and the position we apply now.
10.1 While you are enrolled. We keep the data in clause 3 for as long as you have access to a course.
10.2 After access ends. We keep your name, email address, specialty, progress and messages for twelve months after your access ends, so that we can deal with a question, a complaint or a refund, and then we delete them.
10.2A The record of emails we sent you. We keep a record of each email we sent you: the address, the subject, the date and time, and whether the email provider accepted it. We keep it for twelve months. It exists for one reason: so that if you tell us you never received your access link, we can answer that question with a record instead of a guess. It does not contain the body of the email.
10.3 The certificate record. If you have earned a certificate, we keep the name on the certificate, the course, the date of completion and the certificate reference for as long as the certificate remains capable of verification on the public page, because a certificate that cannot be checked is worth nothing. If you want that record removed, tell us, and we will remove it and mark the certificate as no longer verifiable.
10.4 The acceptance record. We keep the record described in Part E for as long as it may be needed to prove what you agreed and when, and for the period during which a claim about it could still be brought.
10.5 Payment records. We keep what the tax and accounting law requires us to keep, for the period it requires.
10.6 What overrides deletion. Where a law in force requires us to keep something, we keep it for that period even if you have asked us to delete it, and we will tell you which category that is. We do not use it for anything else in the meantime.
11.1 You have the right to access your data: a summary of the personal data of yours we are processing, what we are doing with it, and the identities of those with whom we have shared it.
11.2 You have the right to correction, completion and updating of your data where it is inaccurate, incomplete or out of date. You can do most of this yourself in your account.
11.3 You have the right to erasure of your data, subject to clause 10.6.
11.4 You have the right to grievance redressal, which means a right to complain to us and to have the complaint answered. Clause 13 gives the contact and the timeline.
11.5 To exercise any of these, write to the grievance contact in clause 13, from the email address on your account. We may ask one question to satisfy ourselves that it is you.
11.6 We answer a request within fifteen working days. Where a request is complex we will tell you within that time why we need longer and when to expect the answer.
11.7 We do not charge for any of this.
11.8 Once the relevant provisions commence, you may also complain to the Data Protection Board of India if you are not satisfied with how we have dealt with your grievance. Complaining to us first is the quicker route and we would rather you did.
12.1 You can withdraw your consent at any time by writing to the grievance contact in clause 13, or by using the withdrawal option in your account.
12.1A When you withdraw, we confirm it to you by email, and the page you withdrew on also confirms it on screen. The confirmation says what was removed and, if you had a certificate, what a person checking it will now be told.
12.2 Withdrawing is as easy as giving consent was.
12.3 Withdrawal ends your access to the course. We cannot run the course for you without processing your name, your email address and your progress. So when consent is withdrawn, access stops.
12.4 Withdrawal does not undo processing that was lawful before you withdrew.
12.5 On withdrawal we delete your data, except what clause 10.6 requires us to keep, and except the certificate record if you ask us to keep the verification working. We will ask you which you want.
12.5A If you ask us to remove the certificate record, the public verification page for that certificate will say that the record was removed at the request of the person it was issued to, that nothing about their completion of the course is in question, and that the certificate was not withdrawn. We word it that way deliberately: withdrawal under clause 13.6 of Part A is something we do for cause, and asking us to delete your data is not that, so the page must not let the two be confused.
7.2A We never quote you in public unless you have ticked the box that says we may. The box sits beside the comment field, it is never ticked for you, and leaving it unticked has no effect on anything else. A kind remark is not permission, a reply to an email is not permission, and we will not treat either as one. Where you do give it, we quote what you wrote and the name on your enrolment, and if you later tell us to stop we take it down.
12.5B What "delete your data" covers, in terms. When you withdraw, we remove your name, your email address, your mobile number, your specialty, your progress and your quiz results from the course register, from our enquiry records, from any unfinished checkout, and from the record described in clause 10.2A of what we emailed you, which is kept but no longer carries your address. The certificate record follows clause 12.5. The acceptance record described in clause 10.4 is kept, and it carries the name and address you gave at the time, because that is what makes it proof of who agreed and when. We say this here rather than leave you to discover it.
12.6 If you have paid for a course and you withdraw consent, clause 15 of Part A decides what happens to the fee. Withdrawal of consent is not by itself a ground for a refund outside those provisions, and does not take away any statutory right.
13.1 Grievances about your personal data go to Dr. Rupal V. Rana, DoctorLawyer™ Medicolegal Consulting Services, 412, Bldg 2, Wing 4, Mandpeshwar Dham CHS, Laxman Mhatre Marg, SVP Road, Borivali (W), Mumbai 400103.
13.2 Email doctorlawyerofficial@gmail.com with the words "Data grievance" in the subject line. Telephone +91 88509 78548.
13.3 We acknowledge within three working days and answer within fifteen working days.
14.1 You may nominate another individual to exercise your rights under this notice on your behalf in the event of your death or of your becoming incapable of exercising them yourself.
14.2 To nominate, write to the grievance contact with the nominee's name and a contact address or email address for them. We will record it and confirm.
14.3 You may change or cancel a nomination at any time in the same way.
14.4 We act on a nomination only on satisfactory proof of the event that triggers it.
15.1 A personal data breach means any unauthorised processing of your personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises its confidentiality, integrity or availability.
15.2 If one happens and your data is affected, we will tell you without delay, and in any event as soon as we have enough to tell you anything useful. We will tell you:
(a) what happened, described fairly and in plain words;
(b) what data of yours was affected, and the extent and timing so far as we know it;
(c) the likely consequences for you;
(d) what we have done and are doing about it;
(e) what you should do, if there is anything sensible for you to do;
(f) who to contact for more.
15.3 We will notify the Data Protection Board of India as and when the law requires it, in the form and within the time it requires.
15.4 We keep a written record of any breach, what caused it, what was affected and what we did.
16.1 The Academy is for adults: practising doctors and other professionals, lawyers and law students, and, on its learning page, members of the public. It is not intended for anyone under eighteen. We do not knowingly collect the personal data of a child. If we learn that we hold any, we delete it.
17.1 The platform uses only what is needed to keep you logged in, to remember your place in a course, and to keep the account secure. We do not use advertising cookies and we do not allow third party tracking for advertising.
17.2 Logs of the kind described in clause 3.1(j) are kept for a short period for security purposes and then deleted.
18.1 This notice carries a version number and a date. The current version is always on the Academy.
18.2 If we change it in a way that matters to you, we will tell you by email and by a notice on the Academy before the change takes effect, and where the change requires a fresh consent we will ask for it.
18.3 We keep every superseded version and will give you a copy on request.
Version 1.20 replaces version 1.19 (12 November 2026). What changed in 1.20: new clause 7C for the short form on the new learning page (/learn): what it holds (the country your connection comes from, not your city), that the form is for adults, how long it is kept, that it is used only to tell you when a course on your topic opens and about live classes, that it is never used by DoctorLawyer's consulting services or any lawyer, and when it is deleted; clause 16.1 now says who the Academy is for. Nothing else changed.
Version 1.19 replaced version 1.18 (12 November 2026). What changed in 1.19: the third box on the calendar form now reads "Keep me posted with useful updates from DoctorLawyer for my practice. Important emails only; I can stop any time.". What it covers is unchanged and set out in clause 7A.6. Nothing else changed.
Version 1.18 replaced version 1.17 (12 November 2026). What changed in 1.18: the third box and clause 7A.6 name the free risk check among the emails, and clause 7A.6 says the enquiry register notes the date and result band if you take the risk check with the same email address. Nothing else changed.
Version 1.17 replaced version 1.16 (12 November 2026). What changed in 1.17: new clause 7A.6 and a third, optional box on the free 2027 calendar form and calendar page: if you tick it, DoctorLawyer may email you about medicolegal updates, the free risk check, free tools and checklists, courses, talks and services that help your practice, and your details are copied to its enquiry register (Google Workspace, clause 8.3A) until you stop them or 31 January 2028. Clauses 7A.2 and 7A.3 now mention the box. Nothing changes for anyone who does not tick it; nothing else changed.
Version 1.16 replaced version 1.15 (7 November 2026). What changed in 1.16: new clause 3.1(jC): the look-up of past payments for the Doctor All-Access credit, with the figures sent only to the buyer's own email address. Nothing else changed.
Version 1.15 replaced version 1.14 (7 November 2026). What changed in 1.15: clause 3.1(jA) now also covers a course opened on a second device and a move made with the button on the sign-in page, under the two-device rule in clause 11.3A of Part A, and an entry is kept longer only while a dispute under clause 35 of Part A that it relates to is open. Nothing else changed.
Version 1.14 replaced version 1.13 (7 November 2026). What changed in 1.14: new clause 7B, on links that carry a source tag such as ?src=yt: the tag is kept in a cookie for 30 days and recorded with an enrolment or payment, only to count which channels bring learners. Nothing else changed.
Version 1.13 replaced version 1.12 (24 October 2026). What changed in 1.13: new clause 7A, on the free 2027 calendar: what we collect when you ask for it (name, email address, edition, the boxes ticked), what it is used for, the optional monthly email, and deletion after 30 days if the link is not opened, at once from your calendar page, and in any case on 31 January 2028. Nothing else changed.
Version 1.12 replaced version 1.11 (16 October 2026). What changed in 1.12: the list of emails in clause 5.1(k) now includes the email telling you what has changed in your course and the note of what is new in it, as clause 24.1A(g) and (j) of Part A provide. Nothing else changed.
Version 1.11 replaced version 1.10 (16 October 2026). What changed in 1.11: new clause 7.1A. The optional box on the enrolment and free module forms now reads "You may also write to me when a new course opens, or when this course changes", and a person who opens a module without paying and ticks it is emailed the dated list of changes to that course. Nothing changes for anyone who ticked the box before; nothing else changed.
Version 1.10 replaces version 1.9 (4 October 2026). What changed in 1.10: the item on what you tell us about a module now covers the question at the end of a lesson, the part of a lesson you mark as unclear and the one question a month after your certificate, and says that quiz answers are counted without names; the list of emails in clause 5 now includes the answer to your question and the reminders. Nothing else changed.
End of Part B. 18 clauses.
Terms of Enrolment · Refunds and Cancellation · What the Courses Cost · No Recording and Intellectual Property Notice · Contact and Grievances