Privacy Policy

Daily Rounds 360 is run by Mohammed Imran Sujad, a sole proprietorship registered in India, trading as Daily Rounds 360. Under the Digital Personal Data Protection Act, 2023 we are the data fiduciary for the personal data described here: we decide why and how it is processed, and we are answerable for it.

You can reach us at imransujad321@gmail.com or through our contact page.

When you join the waitlist

The public form asks for your name and WhatsApp number, and optionally your email address, MBBS year, university, and a short description of the consistency problem you want to solve. You choose what to write in that last field; please do not put health information or anyone else’s details in it.

When you are given a cohort account

Accounts are created for people who have been accepted into a cohort. The account holds your name, email address, password, WhatsApp number, university, MBBS year, time zone, and a profile picture if you upload one. Your password is never stored as you typed it, only a scrypt hash of it, which cannot be reversed back into the password.

While you use the cohort

The product exists to make consistency visible, so most of what it records is a record of showing up:

• —Study sessions: when a focus block started and ended, how long it ran, and whether it was completed or abandoned.
• —Attendance in the weekday study rooms, and whether you were present, late or absent.
• —Daily check-ins and reflections, your plan for tomorrow, and the obstacles you select.
• —Your roadmap: the subjects and topics you chose, and what you have marked complete.
• —Quiz, flashcard and assessment attempts, including your answers, scores and review notes.
• —Points, streaks, achievements and your position on the cohort leaderboard.

When you pay

Payments are collected through Razorpay Software Private Limited, a payment aggregator authorised by the Reserve Bank of India. Your card, UPI, netbanking and wallet credentials are entered on Razorpay’s own checkout and go directly to them. We never see, receive or store those credentials, and we are contractually forbidden from doing so. What reaches us is the outcome: a payment identifier, the amount, the date, the method in general terms, and whether it succeeded.

If you buy personalised mentorship

Personalised mentorship is a conversation, so it creates a record of one. We store the messages you and your mentor exchange in the app, the doubts you ask, the study plan your mentor writes for you and its revision, the calls you request along with the topic and times you suggest, and the weekly progress check-ins your mentor records about your consistency and what to change.

The community

Messages you send in the community are stored with your name and picture against them, because that is what makes them a conversation. A message in the main room can be read by every member; a message in a cohort room by that cohort, its lead and its mentors; a private message only by the two of you. A cohort lead can remove a message from the main room or a cohort room, and a removed message is kept as a record that something was removed, without its text. We do not read private conversations except where we have to in order to investigate a report of abuse or to meet a legal obligation.

Technical data

When you sign in we set one cookie, dr_session. It holds a random session token and nothing about you, is marked HTTP-only so page scripts cannot read it, and expires after thirty days or when you sign out. Your browser also stores your light or dark theme choice locally under dr-theme; that never leaves your device. Our hosting and database providers keep short-lived technical logs, which can include IP addresses, for security and debugging.

There are no advertising cookies, no analytics trackers and no tracking pixels anywhere on this site. Every cookie and stored setting is listed in our Cookie Policy. A few questions and materials contain a video from YouTube or Vimeo; those are embedded in YouTube’s privacy-enhanced mode and with Vimeo’s do-not-track setting, and the provider only receives anything once you press play.

Item by item

In general

• —To run your account and give you access to the cohort. This is what you asked us to do when you enrolled, and processing it is necessary to deliver what you paid for.
• —To track attendance and progress, and to let a coach notice when you have gone quiet and follow up with you. This is the service, not surveillance of it.
• —To show your streak, points and leaderboard position to the rest of your cohort, because a shared scoreboard is part of how the cohort works.
• —To deliver personalised mentorship if you buy it: to let the mentor assigned to you read your progress, write your study plan, answer your doubts and record your weekly check-in. This is what the pass pays for.
• —To send you service messages: password resets, cohort schedules, and notices about changes to these policies.
• —To take payment, issue receipts, and meet our tax and accounting obligations.
• —To keep the platform secure, by detecting misuse, abuse and fraudulent access.

We do not sell your personal data, and we do not share it with anyone for their own marketing.

A cohort is a group, and some of your activity is visible to it by design: your name and profile picture, your streak and points, your leaderboard position, and your presence in a study room while a session is running.

Your check-in text, reflections, assessment answers, contact details and payment records are not shown to other students. They are visible to the cohort administrators who coach you.

If you buy personalised mentorship, the mentor assigned to you is a further person who can see your record. They can read what an administrator can — your progress, your study and attendance history, your assessment results, and everything in your mentorship conversation — because guidance that cannot see your work is not guidance. A mentor sees only the students assigned to them, never the rest of the cohort, and their access ends when your pass ends. You can ask us to reassign you to a different mentor, or to stop mentorship altogether, by writing to imransujad321@gmail.com.

We use a small number of service providers. Each processes data only on our instructions and only for the purpose listed:

• —Vercel — hosting for the website and the cohort portal.
• —Supabase — the managed PostgreSQL database that stores your account and your activity.
• —Cloudflare R2 — private storage for the textbooks and materials read inside the app.
• —Resend — delivery of transactional email, such as password resets.
• —Razorpay — payment processing, under their own privacy policy.
• —Google (Gemini API), and occasionally a backup AI provider such as Groq when it is unavailable — used to answer questions typed into the anatomy atlas, to propose chapter structures for uploaded study material, and to help staff draft flashcards. The question or material is sent; your name, email, phone number and payment details are not, so please do not type personal information into the atlas’s question box.

We will also disclose personal data where the law requires it — a valid order from a court, a regulator or a law enforcement agency — and, if the business is ever transferred, to the party taking it over, on the same terms as this policy.

We prefer Indian regions where a provider offers them, but several of the services above operate globally, so your data may be processed on servers outside India. Where that happens the provider is bound by a contract requiring protection equivalent to what this policy promises, and transfers are made only to countries not restricted under Indian law.

• —Your account and cohort history are kept while your account exists, and for up to twelve months after it is closed, so that a returning student keeps their record.
• —Mentorship messages, study plans, call records and progress check-ins are kept for as long as your account is, on the same twelve-month rule, so that a student who renews later still has the plan they were given. Your mentor loses access to all of it when the pass ends.
• —Waitlist entries are kept for up to twenty-four months, or until you ask us to remove yours.
• —Payment and invoice records are kept for eight years, because tax law requires it. This is the one category we cannot delete on request.
• —Session tokens expire after thirty days; password reset tokens expire within the hour.

Traffic is served over TLS. Passwords are stored as scrypt hashes. Session cookies are HTTP-only and expire. Access to student records is limited to the administrators of the cohort you are in — and, for a mentee, to their own mentor — and administrator actions taken on a student’s behalf are logged. Textbook storage is a private bucket reached through short-lived signed URLs.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data we will notify you and the Data Protection Board of India as required by law.

Under the Digital Personal Data Protection Act, 2023 you may ask us to:

• —Tell you what personal data of yours we hold and who we have shared it with.
• —Correct anything inaccurate, or complete anything missing. Most of this you can do yourself in your profile.
• —Erase your data, except where we are required to keep it (see retention, above).
• —Withdraw a consent you have given. Withdrawing consent for data that is necessary to run your account means closing the account.
• —Nominate someone to exercise these rights for you if you die or become incapacitated.

The two most common requests you can make yourself, from the Your data section of your profile in the app: Download my data gives you a file of every record linked to your account, straight away; Delete my account asks us to erase it, and you can withdraw that request until we act on it. Waitlist entries have no account, so to see or delete one, email us from the address or number you gave.

For anything else, write to imransujad321@gmail.com and we will respond within 5 business days. We may need to confirm who you are before acting on a request.

This service is for medical students aged 18 or over. We do not knowingly create accounts for children, and if we learn that we hold a child’s personal data we will delete it.

When this policy changes we update the date at the top of the page. If a change materially affects how your data is used, we will tell you by email before it takes effect.

If you are unhappy with how we have handled your personal data, contact our Grievance Officer, Mohammed Imran Sujad, at imransujad321@gmail.com. Complaints are acknowledged and answered within 5 business days. If you remain dissatisfied you may complain to the Data Protection Board of India.

This policy should be read together with our Terms & Conditions.