Applies to the Care Ceylon mobile application (Android package org.rotaframe.careceylon) and web platform operated by RotaFrame Technology.
This Privacy Notice is issued in compliance with Schedule V and Section 11 of the Sri Lanka Personal Data Protection Act (PDPA) No. 9 of 2022 and international healthcare data protection standards.
Care Ceylon (engineered and operated by RotaFrame Technology) acts as the Data Controller for platform account and scheduling operations under the Personal Data Protection Act (PDPA) No. 9 of 2022. For privacy inquiries or Data Subject requests, please contact our Data Protection Officer via Help & Support or email info@rotaframe.org.
We collect and process: (a) Identity & Contact Data (full name, mobile phone number, email address, profile photo); (b) Special Category Health Data (consultation reason/symptoms, blood group, date of birth, gender, family dependent profiles, and appointment attendance history); and (c) Device & Telemetry Data (Firebase Cloud Messaging push tokens for real-time queue and doctor delay alerts).
Your personal and health data is processed strictly under Section 6 and Schedule II of the Sri Lanka PDPA (Explicit Consent and Provision of Healthcare Services) to schedule medical appointments, deliver live slot delay notifications, maintain your personal consultation history, and resolve attendance disputes.
Your booking details and medical symptoms are shared exclusively with the specific Verified doctor(s) with whom you book a consultation. Data is secured in transit (TLS 1.3) and at rest (AES-256) on isolated cloud infrastructure. Care Ceylon never sells, rents, or shares patient health data with third-party advertisers.
In accordance with PDPA Sections 16 & 18 and mobile app store guidelines: (a) Self-deleted accounts are placed in an encrypted 90-day recovery archive to protect against accidental deletion; (b) Accounts with zero completed consultations are permanently purged upon expiration or administrative removal; (c) For accounts with completed medical consultations, personally identifiable information (Name, Phone, Email, Avatar, Family Dependents) is permanently scrubbed and anonymized upon erasure, while de-identified consultation timestamps remain preserved for statutory medical and financial audit compliance.
Under Part II of the Sri Lanka PDPA No. 9 of 2022, you have the right to request access to your personal data, rectify inaccurate profile details, withdraw consent, request erasure/anonymization, and lodge a formal complaint with the Data Protection Authority (DPA) of Sri Lanka.
Summary of how Care Ceylon collects, encrypts, and protects personal and sensitive health data.
All API traffic uses TLS 1.3 and all database records & files are encrypted with AES-256.
Health records and personal identifiers are never sold or shared with advertising networks.
Users can permanently delete their account in-app or via our public deletion portal.
| Data Category | Data Elements | Collection Purpose | Sharing & Access | Encrypted |
|---|---|---|---|---|
| Personal Identifiers | Full Name, Email Address, Phone Number, Date of Birth, Gender, Residential Address | Account creation, appointment booking, identity verification (6-digit OTP), and clinic communication | Shared only with the specific verified doctor or clinic you book with | Yes (TLS 1.3 + AES-256) |
| Health & Medical Information | Blood Type, Allergies, Chronic Conditions, Consultation Notes, Digital Prescriptions, Uploaded Lab Reports | Clinical care delivery, continuity of treatment, and patient-controlled medical history | Never sold or used for advertising. Accessible only to authorized treating doctors via RLS | Yes (Row-Level Security + Signed URLs) |
| Professional Credentials (Doctor Mode) | Medical Registration Number, Medical Qualifications, Specialization, Practice Hospital/Clinic, Signature/Stamp | Mandatory practitioner credential verification and digital prescription issuance | Publicly visible on Doctor Directory profile (certificate documents remain private) | Yes (TLS 1.3 + Private Bucket) |
| Financial & Settlement Info | Consultation Fee Records, Invoice Receipts, Doctor Payout Bank Details (Doctor Mode) | Processing consultation payments, generating patient receipts, and settling doctor payouts | Processed via PCI-DSS compliant payment gateways; never sold to third parties | Yes (PCI-DSS + TLS 1.3) |
| Device & Diagnostics | Push Notification Token (FCM), Crash Logs, Session Security Events | Sending real-time queue/booking alerts, preventing unauthorized access, and app stability | No third-party marketing trackers | Yes (TLS 1.3) |