Your data rights under the Digital Personal Data Protection Act, 2023 — and how Goalka honours every one of them.
The Digital Personal Data Protection Act, 2023 (DPDPA) is India's primary legislation governing the processing of digital personal data. Passed by the Parliament of India and notified in August 2023, it establishes obligations for organisations that collect and process personal data of individuals in India, and creates enforceable rights for those individuals ("Data Principals").
The Act applies to Goalka because we process personal data of Indian doctors (and, in some cases, their patients) to provide our services. It requires us to maintain a lawful basis for every category of data processing, respond promptly to your rights requests, and implement appropriate technical and organisational safeguards.
The DPDPA is enforced by the Data Protection Board of India. Non-compliance may result in financial penalties of up to ₹250 crore per violation.
Under DPDPA, Goalka Health Technologies Pvt. Ltd. acts as a Data Fiduciary — the entity that determines the purpose and means of processing your personal data. We are responsible for ensuring that:
DPDPA Chapter III
All rights under Sections 11–18 of the DPDPA, 2023. To exercise any right, email privacy@goalka.com. We respond within 30 days.
You have the right to know what personal data Goalka collects, the purpose for which it is processed, and how long it is retained.
How to exercise
Request a data processing summary via privacy@goalka.com. We will respond within 30 days.
You have the right to correct inaccurate personal data we hold about you, and to request erasure of data that is no longer required.
How to exercise
Submit a correction or erasure request via /privacy (self-service) or email privacy@goalka.com.
You have the right to file a grievance with Goalka's Designated Privacy Officer if you believe your data rights have been violated.
How to exercise
File a grievance at privacy@goalka.com. We acknowledge within 48 hours and resolve within 30 days.
You have the right to nominate another individual to exercise your data rights on your behalf in the event of death or incapacity.
How to exercise
Contact privacy@goalka.com to register a nominee. Notarised authorisation may be required.
You have the right to withdraw consent for any or all data processing categories at any time. Withdrawal does not affect lawfulness of prior processing.
How to exercise
Withdraw consent instantly via Settings → Consent, or email privacy@goalka.com. Effect within 72 hours.
You have the right to receive your personal data in a structured, machine-readable format and to transfer it to another service.
How to exercise
Request a full data export from Settings → Privacy, or email privacy@goalka.com. Delivered within 15 days.
In the event of a personal data breach that is likely to affect your rights, you have the right to be notified without undue delay.
How to exercise
Breach notifications are sent to your registered email within 72 hours of discovery, per DPDPA Section 8(6).
You have the right to request human review of any automated decision that significantly affects you, including AI-generated clinical recommendations.
How to exercise
Flag any AI-generated output for human review via the Command Center, or email privacy@goalka.com.
Consent management
Goalka uses granular consent — you can grant or withdraw each category independently. Withdrawing consent is as easy as granting it.
platform_useCore account functionality — authentication, session management, and essential platform features. Required to use Goalka.
ai_processingProcessing your clinical notes, commands, and vault content through AI models (Claude API, AssemblyAI) to power the Command Center and intelligent features.
researchAnonymised, aggregated usage data used to improve Goalka's features and AI models. No personally identifiable information is included.
communicationsProduct updates, feature announcements, and educational content delivered via email and WhatsApp. You can opt out at any time.
DPDPA Section 16
Goalka engages the following sub-processors outside India. Each is bound by a Data Processing Agreement (DPA) requiring equivalent data protection standards.
All transfers are subject to Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms approved under DPDPA.
DPDPA Section 13
If you believe your data rights have been violated, or if you have a complaint about how Goalka processes your personal data, you may file a grievance with our Designated Privacy Officer.
Designated officer
Privacy Officer
Goalka Health Technologies Pvt. Ltd.
Contact
privacy@goalka.comResponse time
Within 30 days
Acknowledgement within 48 hours
This DPDPA Policy is effective as of April 12, 2026 and applies to all doctors and users of the Goalka platform.