Privacy Policy

Last updated: 10 July 2026

This Privacy Policy explains how DocReview, operated by Strontium Innovations ("we", "us", "our"), collects, uses, shares, and protects personal data when you use [https://docreview.lk] (the "Platform").

We are committed to handling personal data in accordance with the Personal Data Protection Act, No. 9 of 2022 (as amended by Act No. 22 of 2025) ("PDPA") and other applicable Sri Lankan law.

For the purposes of the PDPA, the data controller is: Strontium Innovations, No 277/3, 2nd Lane, Campus Road, Raththanapitiya, Boralesgamuwa, Sri Lanka. Contact: info@docreview.lk.

1. Summary (the short version)

  • We collect account details, your mobile number for one-time-password (OTP) reviewer validation, the reviews you write, and technical/usage data.
  • The OTP and mobile number are used to validate that you are a genuine reviewer.
  • We use reviewer and account data to run the Platform, and also for marketing communications and to personalise your experience (see Section 4).
  • We do not sell your personal data.
  • You can ask us to delete your personal data at any time (see Section 9).

2. Who this policy applies to

This policy applies to: (a) visitors who browse the Platform; (b) reviewers/registered users who create accounts and submit reviews; and (c) doctors/practitioners whose professional information appears on the Platform.

3. What personal data we collect

3.1 Data you give us

  • Account data: name or username, email address, password (stored in hashed form).
  • Reviewer validation data: your mobile phone number and the OTP used to verify it. This is collected specifically to confirm you are a genuine, contactable reviewer and to deter fake reviews.
  • Review content: the reviews, ratings, and any details you choose to include (which may reveal information about your interactions with a practitioner). Please avoid including sensitive personal or health details you do not wish to make public.
  • Communications: messages you send us (support, complaints, takedown requests).

3.2 Data we collect automatically

  • Technical & usage data: IP address, device/browser type, pages viewed, referring URLs, and interactions, collected via cookies and similar technologies (see our Cookie Policy).

3.3 Doctor/practitioner data

  • Professional information such as name, specialty, workplace/hospital, and (where available) SLMC registration details and publicly available professional information, used to build practitioner profiles that are the subject of reviews.

3.4 Special categories. We do not intentionally collect "special categories" of personal data (as defined under the PDPA). Reviews you write may incidentally reference health experiences — please share only what you are comfortable making public.

4. How and why we use personal data (purposes & lawful basis)

We process personal data for the following purposes:

| Purpose | Examples | Lawful basis under the PDPA | |---|---|---| | Operating the Platform | Creating your account, publishing your reviews, discovery/search | Performance of a contract; our legitimate interests | | Reviewer validation | Sending and checking the OTP; confirming your mobile number | Performance of a contract; our legitimate interest in preventing fraud and fake reviews | | Trust & safety / moderation | Detecting fake or unlawful content, handling complaints and takedowns | Legitimate interests; compliance with legal obligations | | Marketing communications | Sending you newsletters, product updates, and offers about DocReview | Your consent (which you may withdraw at any time) | | Personalisation | Tailoring content, recommendations, and your experience based on your activity | Your consent and/or our legitimate interests | | Analytics & improvement | Understanding usage to improve the Platform | Legitimate interests | | Legal & compliance | Responding to lawful requests, court orders (including under the Online Safety Act, No. 9 of 2024), and enforcing our Terms | Compliance with legal obligations; legitimate interests |

Where we rely on consent (e.g. marketing and personalisation), you can withdraw it at any time without affecting processing already carried out (see Section 9).

5. Marketing and personalisation

5.1 With your consent, we may send you marketing communications by email, SMS, or in-app messages, and personalise the content and recommendations you see based on your account activity and reviews.

5.2 You can opt out at any time by using the unsubscribe link in any message, adjusting your account settings, or contacting info@docreview.lk. Opting out of marketing does not stop essential service messages (e.g. OTP codes, security or account notices).

6. Public nature of reviews

6.1 Reviews you publish are visible to the public. Your chosen display name (or anonymised identifier, where offered) may appear with your review.

6.2 Your mobile number and OTP are never displayed publicly — they are used only for validation.

6.3 Please remember that once a review is public, others may read, copy, or share it. Removing a review from the Platform may not remove copies made by third parties.

7. Sharing and disclosure

We do not sell your personal data. We may share personal data with:

  • Service providers / processors who help us operate the Platform (e.g. hosting, SMS/OTP delivery, email, analytics), under contracts requiring them to protect the data and use it only on our instructions.
  • Legal and regulatory bodies, where required by law, court order, or lawful request (including under the Online Safety Act, No. 9 of 2024, the Computer Crimes Act, No. 24 of 2007, or a valid order in a defamation matter).
  • Successors in the event of a merger, acquisition, or reorganisation of the business.

8. International transfers

Where we use service providers located outside Sri Lanka (e.g. cloud hosting, SMS or email providers), your personal data may be processed abroad. We take steps to ensure such transfers comply with the PDPA's requirements on cross-border processing, including using providers that offer appropriate safeguards. [CONFIRM your hosting/SMS/email providers and their locations with counsel.]

9. Your rights under the PDPA

Subject to the conditions in the PDPA, you have the right to:

  • Access the personal data we hold about you;
  • Rectify inaccurate or incomplete data;
  • Withdraw consent (e.g. for marketing or personalisation) at any time;
  • Object to / restrict certain processing;
  • Erasure — request that we delete your personal data. We honour deletion requests (see our Data Request & Erasure Policy).

To exercise any right, contact info@docreview.lk or use the request process described in our Data Request & Erasure Policy. We will respond within the timeframe required by the PDPA (we aim to respond within 21 business days). We may need to verify your identity before acting.

If you are not satisfied with our response, you may complain to the Data Protection Authority of Sri Lanka ([https://www.dpa.gov.lk]).

Note on deletion: When you request deletion, we will remove your account and personal identifiers. We may (a) retain anonymised or de-identified data, (b) retain limited data where we are legally required to (e.g. to comply with a court order or resolve a dispute), and (c) note that a published review may be retained in de-identified form where it forms part of the public record on a practitioner, unless removal is also requested and appropriate.

10. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law. In general:

  • Account & reviewer data: for as long as your account is active, and for a reasonable period afterwards, unless you request deletion.
  • OTP / validation data: the OTP itself is short-lived; the associated mobile number is retained while your account is active for validation and fraud-prevention purposes.
  • Legal/compliance records: as long as needed to meet legal obligations or defend legal claims.

11. Security

We implement reasonable technical and organisational measures to protect personal data — including hashed passwords, access controls, and encryption in transit. No system is perfectly secure, but we work to protect your data and will notify you and the Data Protection Authority of a personal data breach where required under the PDPA.

12. Children

The Platform is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact info@docreview.lk and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice.

14. Contact us

Strontium Innovations — DocReview Privacy contact: info@docreview.lk Address: No 277/3, 2nd Lane, Campus Road, Raththanapitiya, Boralesgamuwa, Sri Lanka Data Protection Authority of Sri Lanka: [https://www.dpa.gov.lk]