Privacy Policy

Dr. Mohan (“we”) is a medical and general education platform operated by Dr. Mohan Gayen, India. For anything in this policy, write to [email protected].

To be confirmed: A registered business name, address and — under the DPDP Act 2023 — a named Data Protection Officer or grievance contact should appear here. Indian law expects a person, not just an inbox.

When you create an account: your email address and a password. We never store the password itself — only an argon2id hash, which cannot be reversed back into your password.

Your profile, if you fill it in: display name, and optionally a bio, mobile number, country, state, city, qualification, institution and specialisation. All of it is optional. The site works without any of it.

When you sign in: the time, your IP address and your browser’s user-agent string, attached to that session. This exists so that a stolen session can be detected and cut off — sessions are rotated and reuse is treated as theft.

When you buy something: what you bought, the amount, and a reference from the payment gateway. We do not receive or store your card number, UPI PIN or bank credentials — those go directly to the gateway and never touch our servers.

When you read or study: which book or lesson you opened and where you stopped, so that “resume” works and so that access to paid material can be audited.

When you use the AI assistant: your messages and its replies are stored, so you can return to a conversation.

When you write to us: your name, email, subject, message and IP address.

If and when consultations open, anything clinical is treated differently from everything else here. Consultation notes, your stated reason for a visit, messages with a doctor and any report you upload are encrypted before they are written to disk (AES-256-GCM), and the system is built to refuse rather than store them unprotected — if the encryption key is missing, it will not write them at all.

Every time a record of yours is opened, it is written to an access log with who opened it and when. That log includes the doctor, and it cannot be edited.

The AI assistant is a study tool. It is not part of clinical care, it does not diagnose, and your consultation records are not fed into it.

The public pages of this site (the home page, book and course listings, articles and similar) show ads through Google AdSense. Google and its partners use cookies and similar technologies to serve and measure those ads and, unless you opt out, to personalise them based on your earlier visits to this and other sites.

You can review or switch off ad personalisation any time in your Google Ad Settings, and read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. Third-party vendors’ own ad-cookie choices are at aboutads.info/choices.

Ads appear on public pages only. There are no ads — and no advertising cookies from us — on the book reader, your account and dashboards, checkout and orders, any clinical or teleconsultation page, or Risita’s Classroom, which teaches children. Your consultations, clinical records and reading are never used for advertising and are never shared with advertisers.

We do not sell your personal data, and apart from the advertising described here we do not share it with other companies. Fonts are self-hosted from our own servers, so normal browsing (outside the ad frames) is not reported to Google.

We set one cookie: DR_MOHAN_LOCALE, which remembers the language you chose so the site does not keep resetting to English. It lasts a year and carries nothing but a language code.

Your sign-in token and your dark/light preference are kept in your browser’s local storage, not in cookies, and are never sent to anyone but us.

On public pages that show ads, Google and its partners set their own cookies to serve and measure advertising (see Advertising above). In regions that require it, such as the EEA and the UK, you will be asked to consent to personalised advertising before those cookies are used.

The app is this same platform, not a separate one. You sign in with the account you already have; there is no second account system, and books you bought on the website are simply there. What follows is what the app does that a browser does not.

Kept on your device, never sent to us: your Digital Library sign-in tokens, held in Android’s Keystore-backed encrypted storage; books you save for offline reading, encrypted with AES-256-GCM inside the app’s private storage, where other apps and file managers cannot reach them and which is never the public Downloads folder; and small preferences such as night reading and whether you turned on biometric unlock. The website session itself lives in the app’s own cookie store, exactly as it would in a browser.

Biometric unlock is performed by Android. The app is told only whether it succeeded. No fingerprint or face data reaches the app, and none of it reaches our servers.

Sent to Google, because the app uses Firebase: a messaging token, so announcements can reach this installation — it identifies the install, not you; usage analytics, collected automatically by the Firebase SDK, covering which screens are opened, the app version, your device model and Android version, and an app-instance identifier; and, if the app crashes, a stack trace with the state of the device at that moment, so the fault can be found and fixed.

Permissions the app asks for are requested by the page you are on, not held open in the background: the camera and microphone for a video consultation, photos for an upload you start, and location only if a page you opened asks for directions. Declining any of them leaves the rest of the app working.

Screenshots and screen recording are blocked on the reader, presentation and consultation screens. This protects authors’ copyright and other people’s clinical information; it is why a recording of those pages comes out black.

To be confirmed: There is no in-app switch to turn analytics or crash reporting off. Uninstalling stops both, and notifications can be turned off in Android’s own settings, but a per-user choice inside the app is the thing that should exist and does not yet.

To be confirmed: There is currently no automatic deletion: records are kept indefinitely until someone asks us to remove them. The DPDP Act 2023 expects personal data to be erased once its purpose is served, and medical records carry their own retention rules. Dr Mohan needs to set a retention period for each kind of record — account, order, AI conversation, clinical — and it should be stated here in plain numbers.

Some records cannot be deleted on request: an invoice must be kept for tax law, and a clinical access log is deliberately unalterable, because a log a person can edit is not a log.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and its data. Write to [email protected] and we will act on it.

To be confirmed: These requests are handled by hand today — there is no self-service export or delete button, and no stated turnaround. The DPDP Act expects a defined grievance process and a response window.

Risita’s Classroom teaches school-age students, so we expect children to use this site. We ask for as little as possible from anyone, and a learner’s data is never sold or used to build an advertising profile.

The classroom carries no advertising at all. This is not a setting on the ad script — the script is never fetched on those pages, so no advertising cookie is set and no profile is built while a child is learning here. Nothing about a child’s lessons is available to advertise against, personalised or otherwise.

To be confirmed: Two things remain. The DPDP Act 2023 requires verifiable parental consent for users under 18, and there is no parental-consent step at signup. And course and book LISTING pages — which show the classroom’s courses alongside everything else — are ordinary public pages and do carry ads: the exclusion covers the classroom itself, not every page that mentions it.

If this policy changes in a way that matters, the date at the top changes with it. We do not quietly rewrite it.

Ask us anything about this policy through the contact page. A person reads those.