Privacy Policy

Dr. Mohan (“we”) is a medical and general education platform operated by Dr. Mohan Gayen, India. For anything in this policy, write to drmohangayenofficial@gmail.com.

To be confirmed: A registered business name, address and — under the DPDP Act 2023 — a named Data Protection Officer or grievance contact should appear here. Indian law expects a person, not just an inbox.

When you create an account: your email address and a password. We never store the password itself — only an argon2id hash, which cannot be reversed back into your password.

Your profile, if you fill it in: display name, and optionally a bio, mobile number, country, state, city, qualification, institution and specialisation. All of it is optional. The site works without any of it.

When you sign in:the time, your IP address and your browser’s user-agent string, attached to that session. This exists so that a stolen session can be detected and cut off — sessions are rotated and reuse is treated as theft.

When you buy something: what you bought, the amount, and a reference from the payment gateway. We do not receive or store your card number, UPI PIN or bank credentials — those go directly to the gateway and never touch our servers.

When you read or study:which book or lesson you opened and where you stopped, so that “resume” works and so that access to paid material can be audited.

When you use the AI assistant: your messages and its replies are stored, so you can return to a conversation.

When you write to us: your name, email, subject, message and IP address.

If and when consultations open, anything clinical is treated differently from everything else here. Consultation notes, your stated reason for a visit, messages with a doctor and any report you upload are encrypted before they are written to disk (AES-256-GCM), and the system is built to refuse rather than store them unprotected — if the encryption key is missing, it will not write them at all.

Every time a record of yours is opened, it is written to an access log with who opened it and when. That log includes the doctor, and it cannot be edited.

The AI assistant is a study tool. It is not part of clinical care, it does not diagnose, and your consultation records are not fed into it.

The public pages of this site (the home page, book and course listings, articles and similar) show ads through Google AdSense. Google and its partners use cookies and similar technologies to serve and measure those ads and, unless you opt out, to personalise them based on your earlier visits to this and other sites.

You can review or switch off ad personalisation any time in your Google Ad Settings, and read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. Third-party vendors’ own ad-cookie choices are at aboutads.info/choices.

Ads appear on public pages only. There are no ads — and no advertising cookies from us — on the book reader, your account and dashboards, checkout and orders, or any clinical or teleconsultation page. Your consultations, clinical records and reading are never used for advertising and are never shared with advertisers.

We do not sell your personal data, and apart from the advertising described here we do not share it with other companies. Fonts are self-hosted from our own servers, so normal browsing (outside the ad frames) is not reported to Google.

We set one cookie: DR_MOHAN_LOCALE, which remembers the language you chose so the site does not keep resetting to English. It lasts a year and carries nothing but a language code.

Your sign-in token and your dark/light preference are kept in your browser’s local storage, not in cookies, and are never sent to anyone but us.

On public pages that show ads, Google and its partners set their own cookies to serve and measure advertising (see Advertising above). In regions that require it, such as the EEA and the UK, you will be asked to consent to personalised advertising before those cookies are used.

To be confirmed: There is currently no automatic deletion: records are kept indefinitely until someone asks us to remove them. The DPDP Act 2023 expects personal data to be erased once its purpose is served, and medical records carry their own retention rules. Dr Mohan needs to set a retention period for each kind of record — account, order, AI conversation, clinical — and it should be stated here in plain numbers.

Some records cannot be deleted on request: an invoice must be kept for tax law, and a clinical access log is deliberately unalterable, because a log a person can edit is not a log.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and its data. Write to drmohangayenofficial@gmail.com and we will act on it.

To be confirmed: These requests are handled by hand today — there is no self-service export or delete button, and no stated turnaround. The DPDP Act expects a defined grievance process and a response window.

Risita’s Classroom teaches school-age students, so we expect children to use this site. We ask for as little as possible from anyone, and a learner’s data is never sold or used to build an advertising profile.

To be confirmed: The DPDP Act 2023 requires verifiable parental consent for users under 18 and prohibits tracking or targeted advertising directed at them. Two gaps remain: there is no parental-consent flow at signup (needed before enrolling minors); and now that the site shows Google AdSense on public pages, ads on child-directed sections must be served as NON-personalised (and/or those sections excluded from ads) so no targeted advertising reaches minors.

If this policy changes in a way that matters, the date at the top changes with it. We do not quietly rewrite it.

Ask us anything about this policy through the contact page. A person reads those.