Privacy Policy

This Privacy Policy explains how the OT Logbook platform (“OT Logbook”, “we”, “us”) collects, uses, stores, and protects information about you. OT Logbook is operated by Devoue Health and Education Foundation (the “Foundation”), the data controller. The platform is built and technically maintained by Cureline Healthcare Pvt Ltd, acting as data processor on behalf of the Foundation.

1. Personal information we collect

When you create an account and use the platform, we collect:

• Identity details: full name, email address, mobile number.
• Training details: college name, college address, home address, specialty, internship start date, expected completion date.
• Verification documents: a college ID card image you upload during onboarding.
• Authentication and security metadata: login timestamps, email verification codes, IP address (for rate-limiting and abuse prevention), and device/browser information.

2. Clinical training data

As part of your daily logs you may submit information about patient encounters: a patient identifier (which can be anonymised), age/gender, diagnosis, interventions used, time spent, and your role in care. You may also submit reflections, supervisor sign-off records, and final evaluations.

You are responsible for ensuring that any patient identifier you enter complies with the privacy norms of your training institution. We recommend using anonymised codes rather than full patient names.

3. How we use your information

• To create and operate your training logbook.
• To allow your nominated supervisor to verify your daily logs by secure email OTP.
• To generate daily, weekly, and final internship reports you can download or share with your college.
• To allow administrators of the Foundation to approve accounts and ensure the integrity of the training records.
• To send you essential service emails (verification codes, approval decisions, weekly nudges, supervisor reminders, contact-form replies).

4. Legal basis

We process your data on the basis of your consent (which you provide when you create an account) and on the basis of the legitimate interest of the Foundation in maintaining a credible training-record platform for the occupational therapy community in India.

5. Where your data is stored

Data is stored on managed cloud infrastructure (Lovable Cloud / Supabase) in encrypted form, both in transit and at rest. Uploaded ID cards are kept in a private storage bucket that is not publicly accessible. Access is restricted by row-level security and role-based access controls so trainees can see only their own data.

6. Who we share your data with

• Your nominated supervisor — receives an email link to view and verify the specific log they have been asked to sign, authenticated by a one-time code.
• Foundation administrators — for account approval, quality oversight, and resolving support requests.
• Cureline Healthcare Pvt Ltd — the technology provider, strictly to operate, maintain, and secure the platform on behalf of the Foundation.

We do not sell your personal data. We do not share it with advertisers or marketing third parties.

7. Retention

We retain your account and training data for as long as your account is active and for a reasonable period afterwards so that you and your college can continue to access submitted reports. You may request deletion of your account and associated data by writing to us via the contact form; we will action verified requests within a reasonable time frame, subject to any legal retention obligations.

8. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate information from within the platform.
• Request deletion of your account and data.
• Withdraw consent for non-essential communications using the unsubscribe link present in those emails.

To exercise any of these rights, please use our contact form.

9. Cookies and tracking

We use only the minimum cookies and local-storage entries needed to keep you signed in and to remember your preferences. We do not use third-party advertising or analytics trackers.

10. Children

OT Logbook is intended for adult occupational therapy trainees and professionals. It is not directed at children and we do not knowingly collect data from anyone under 18.

11. Compliance with India's Digital Personal Data Protection Act, 2023

OT Logbook complies with the Digital Personal Data Protection Act, 2023 (“DPDP Act”). In accordance with the Act:

• Purpose limitation: Personal data is collected and processed only for the specific, lawful purposes set out in this policy (operating the trainee logbook, supervisor verification, report generation, and Foundation oversight).
• Data minimisation: We collect only what is needed for the platform to function. You can choose to anonymise patient identifiers and we explicitly discourage entering full patient names.
• Consent: Your consent to processing is collected during signup and may be withdrawn at any time by deleting your account.
• Data principal rights: You have the rights of access, correction, erasure, grievance redressal, and nomination granted under the DPDP Act. Use the contact form below to exercise them.
• Security safeguards: Encryption at rest and in transit, role-based access, row-level security, and audited backups.
• Breach notification: In the event of a personal data breach we will notify affected users and the Data Protection Board of India in accordance with the timelines prescribed under the Act.

Grievance Officer (DPDP Act, s.10(2)(c)): The Grievance Officer for OT Logbook is the designated contact at Devoue Health and Education Foundation. You may reach the Grievance Officer via the contact form; please put “Grievance: Privacy” in the subject line. We will acknowledge your grievance within 3 working days and aim to resolve it within 30 days.

12. Updates to this policy

We may update this Privacy Policy from time to time. Material changes will be highlighted on the platform and, where appropriate, sent to you by email. The “Last updated” date at the top of this page indicates the current version.

13. Contact

For any privacy-related question or request, please write to us via the contact form.