Privacy Policy

toprated.lk is a Sri Lanka-based online directory that helps patients find and review doctors and healthcare providers. Our website is available at toprated.lk.

If you have questions about this policy, contact us at hello@toprated.lk.

2.1 Information you provide

• Reviews and ratings: When you submit a review, we collect your display name and the content of your review.
• Doctor accounts: When a healthcare professional creates an account, we collect their email address, password (stored as a secure hash), and optionally a profile photo and LinkedIn URL.
• Profile claims: When a doctor submits a claim for a profile, we collect their SLMC registration number and an uploaded identity document for verification purposes.
• Suggested listings: When you suggest a doctor, we collect the name, speciality, hospital, and city you provide.

2.2 Information collected automatically

• Page views: We record anonymous page view counts to understand overall traffic. We do not link page views to individual users.
• Session data: If you sign in, we store an authentication session in a secure, HTTP-only cookie to keep you logged in.
• Log data: Our hosting provider (Vercel) and database provider (Supabase) may collect standard server logs including IP addresses, browser type, and pages visited. This data is governed by their respective privacy policies.

• To display doctor profiles, ratings, and reviews on the directory.
• To verify healthcare professionals who claim a profile on our platform.
• To allow verified doctors to respond to reviews and manage their profile information.
• To monitor and improve the quality of listings and reviews.
• To detect and prevent fraudulent, abusive, or harmful content.
• To understand aggregate usage patterns and improve our service.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

We use cookies solely for the following purposes:

• Authentication cookie: A secure, HTTP-only cookie that keeps a verified doctor signed in across visits. This cookie expires automatically and contains no personal data — it is a session token issued by Supabase Auth.
• Session storage flag: A browser sessionStorage item (not a cookie) that prevents duplicate page-view counts within a single browser session. It contains no personal data and is cleared when you close the browser tab.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

Your data is stored securely using Supabase, a cloud database platform. Passwords are never stored in plaintext — they are hashed using industry-standard algorithms by Supabase Auth. Identity documents submitted for profile verification are stored in a private, access-controlled storage bucket and are only accessible to our administrators.

Our website is served over HTTPS. We take reasonable technical measures to protect your data, but no system is completely secure and we cannot guarantee absolute security.

• Reviews and ratings are retained indefinitely as part of the public directory unless you request removal.
• Doctor accounts and associated profile data are retained until the account is deleted.
• Verification documents (SLMC number, ID upload) are retained for as long as the associated doctor profile is active.
• Page view counts are anonymised aggregate data with no retention limit.

We use the following third-party services:

• Supabase — database, authentication, and file storage. Supabase Privacy Policy
• Vercel — website hosting and deployment. Vercel Privacy Policy
• Google OAuth — optional sign-in method for doctor accounts. If you choose to sign in with Google, Google shares your name and email address with us. Google Privacy Policy
• unavatar.io — used to automatically fetch LinkedIn profile photos when a doctor links their LinkedIn profile and has no existing photo.

You have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated personal data.
• Request removal of a review you submitted.

To exercise any of these rights, please contact us at hello@toprated.lk. We will respond within a reasonable time.

Our service is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of the site after changes constitutes acceptance of the updated policy.

For any privacy-related questions or requests, please contact us at hello@toprated.lk.