Privacy Policy

Docranka (“we”, “us”) operates Docranka.com. We are committed to handling your data carefully, lawfully and transparently, in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022. By using the site you agree to this policy. If you do not agree, please do not use the site.

Docranka is an independent platform. We are not a government service and are not affiliated with, or endorsed by, the Sri Lanka Medical Council, the Ministry of Health, or any hospital, unless we say so explicitly.

1. Information we collect

• Account information: when you sign up, we collect your email address and a display name. Authentication is handled by our provider (Supabase Auth); we do not store your password ourselves.
• Review and engagement data: the content of reviews you write (ratings, title, body, optional visit month and hospital), your “helpful” votes, and any reports you submit. You can choose to display your full name or initials only.
• Doctor claim data: if you claim a profile, we collect your SLMC registration number, a work contact, and any verification documents you provide.
• Technical and usage data: basic information such as device and browser type, approximate location, and pages viewed, collected through cookies and analytics to keep the site secure and improve it.

We deliberately do not collect a diagnosis or medical-condition field. The review form forbids third-party health details, and we ask you not to include private medical information anywhere on the site.

2. How we use your information

• To create and manage your account and, if applicable, your doctor profile.
• To publish, moderate and display reviews in line with our Review Policy.
• To verify doctor claims against the SLMC register and protect against impersonation.
• To detect spam, fraud and abuse, and to keep the platform safe and genuine.
• To respond to your messages and support requests.
• To understand usage and improve our features and content.

3. Reviews and moderation

Reviews are health-adjacent personal data and are treated with care. Each review is checked by our team before publishing. We store moderation information, such as the status of a review and any reports, to keep the system fair and to detect patterns of abuse. Visit dates are intended and shown at month-and-year granularity, not as an exact date. We never sell review data.

4. Cookies and analytics

We use essential cookies to keep you signed in and the site secure, and a limited set of analytics cookies to understand how the site is used. You can control cookies through your browser settings; disabling some cookies may affect how the site works.

5. Storage and security

Account data, reviews and uploaded files (such as profile photos and verification evidence) are stored with our infrastructure provider using access controls and row-level security. We restrict access to personal data to the team members who need it. No system is perfectly secure, but we take reasonable steps to protect your information.

6. Sharing your information and the providers we use

We do not sell your personal data. We share it only with the service providers who help us run the platform, and only as far as each one needs to do its job:

• Hosting, database, authentication and file storage: our infrastructure provider, Supabase, stores accounts, reviews and uploaded files under access controls and row-level security.
• Analytics: a limited, privacy-respecting set of analytics that helps us understand usage and improve the site.
• When the law requires it, or where needed to protect the rights, safety and property of our users and the public.

These providers act as our processors and are required to protect your data and use it only on our instructions. Published reviews are, by their nature, visible to the public and clearly attributed to a patient using your chosen display name or initials.

7. Your rights under the Personal Data Protection Act

Sri Lanka's Personal Data Protection Act, No. 9 of 2022 gives you rights over your personal data. We support them as follows:

• Access: you can view your account details and your own reviews, including those awaiting moderation, from your account area.
• Correction: you can edit your review and profile information at any time. Doctors can request a correction to a claimed profile from their dashboard.
• Deletion: you can delete your own reviews, and you can delete your account, and the personal data linked to it, from your account settings or by asking us.
• Withdraw consent or object: you can withdraw consent for optional processing, such as analytics, and object to processing in the cases the Act allows.

To exercise any of these rights, use your account settings or contact us. If you believe we have not handled your data properly, you may also complain to the Data Protection Authority of Sri Lanka.

8. Data retention

We keep your information for as long as your account is active and as needed to provide the service. We may retain limited records, such as moderation logs, for longer where necessary to keep the platform safe, resolve disputes, and meet legal obligations.

9. Children

The site is intended for adults. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “last updated” date above and, where appropriate, notify you.

11. Contact us

For any privacy question or request, including data access or deletion, please contact our team. We aim to respond within a reasonable time.