Data Request & Erasure

Last updated: 10 July 2026

This policy explains how you can exercise your data-protection rights under the Personal Data Protection Act, No. 9 of 2022 (as amended) with DocReview (operated by Strontium Innovations), and how we handle your requests. It supplements our Privacy Policy.

1. Your rights

Subject to the PDPA, you may ask us to:

  • Access — provide a copy of the personal data we hold about you.
  • Rectify — correct inaccurate or incomplete data.
  • Erase (delete) — delete your personal data. We honour deletion requests.
  • Withdraw consent — stop marketing or personalisation based on consent.
  • Object / restrict — object to or restrict certain processing.

2. How to make a request

Submit your request by:

Please tell us: (a) your name and the email/mobile linked to your account; (b) which right you wish to exercise; and (c) any details that help us locate your data.

3. Verifying your identity

To protect your data, we will verify your identity before acting on a request — for example, by confirming control of the registered email or mobile number. We may ask for additional information if needed.

4. Our timeframe

We aim to respond within 21 business days of receiving a complete, verified request, in line with the PDPA. If a request is complex, we may need more time and will let you know.

5. What deletion means

When you ask us to delete your personal data, we will:

  • delete or de-identify your account and personal identifiers (name, email, mobile number used for OTP validation, etc.);
  • stop using your data for marketing and personalisation.

Please note that we may:

  • retain anonymised / de-identified data that no longer identifies you;
  • retain limited data where we are legally required to, or to establish, exercise, or defend legal claims, or to comply with a court order or lawful request (including under the Online Safety Act, No. 9 of 2024);
  • where a review you posted forms part of the public information about a practitioner, retain it in de-identified form, unless removal of the review itself is also appropriate.

If you want a specific review removed as well as your account deleted, please say so in your request and we will handle it under this policy and our Notice-and-Takedown Policy.

6. Withdrawing marketing/personalisation consent

You can opt out of marketing and personalisation at any time via the unsubscribe link in our messages, your account settings, or by emailing info@docreview.lk — without deleting your whole account.

7. Fees

We generally handle requests free of charge. Where a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee or decline it, as permitted by law, and will explain why.

8. Complaints

If you are unhappy with how we handle your request, you may complain to the Data Protection Authority of Sri Lanka at [https://www.dpa.gov.lk].

9. Contact

Data requests: info@docreview.lk · Strontium Innovations — DocReview, No 277/3, 2nd Lane, Campus Road, Raththanapitiya, Boralesgamuwa, Sri Lanka

Request your data

Verify your email with a one-time code, then download the reviews tied to your identity or erase them from DocReview.

Use the same email you used when leaving your review.