Privacy policy
What this website collects, why, and what you can ask us to do about it.
Last updated 8 August 2026. We will post the date here whenever this changes.
Small, and not pretending otherwise.
XDQ Labs Private Limited, Gurugram, Haryana, India, operating the product Drapto, is the data fiduciary for personal data collected through this website.
What this website collects, and why
| Where | What | Why | Kept for |
|---|---|---|---|
| Free audit form | Name, hospital name, role, WhatsApp number, email (optional), bed band, payer mix, notes | To contact you about the audit you requested and to prepare it | 24 months from last contact |
| Claims Decoder gate | Work email, hospital name, WhatsApp (optional) | To give continued access and to follow up if you ask us to | 24 months from last contact |
| Contact form | What you choose to send | To answer you | 24 months |
| Server logs | IP address, browser, pages requested | Security and troubleshooting | 90 days |
What this website does not collect
- Patient data. Nothing on this site asks for it and nothing here should be used to send it.
- Text you paste into the Claims Decoder. It is processed entirely in your own browser and is not transmitted to us or stored on any server. Identifiers are stripped before the text is processed even locally.
- Anything you type into Sahayak or Nadi on this site. Both run in your browser. Nothing is sent anywhere.
- Advertising or cross-site tracking identifiers. We do not run advertising trackers on this site.
Browser storage
We use your browser’s own storage for two things: remembering that you have unlocked the pricing rate card so you are not asked twice in one visit, and counting Decoder runs so the second one prompts for an email. Both are cleared when you clear site data. Neither is a cookie sent to a server.
Who else can see it: the short answer is nobody.
Web fonts are requested from Google Fonts, which means your browser makes a request to Google when a page loads. We do not send them anything about you. Beyond that, form submissions reach our own systems and our email provider. We do not sell personal data and we do not share it for anyone else’s marketing.
Where your data physically sits.
On Indian infrastructure. We do not transfer personal data collected through this site outside India.
Your rights under the DPDP Act
You may ask us to give you a copy of what we hold about you, correct or complete it, erase it, nominate someone to exercise these rights on your behalf if you cannot, and raise a grievance about how we have handled any of this.
Write to info@xdqlabs.com with the subject line “DPDP request”. We will respond within 30 days. If we cannot do what you have asked, we will tell you why rather than leave it unanswered.
Grievances
If you are not satisfied with how we have handled a request or a complaint, our grievance redressal process sets out who to contact and what happens next.
Children
This site is for people running healthcare businesses. It is not directed at children and we do not knowingly collect data from anyone under 18.
XDQ Labs Private Limited · Gurugram, Haryana, India. Questions about this page: info@xdqlabs.com.
See the platform on your own claims.
We will walk one month of your settlements and show you the mechanism behind each deduction.