Data Processing Agreement

Version 2026-10 · Template under the Digital Personal Data Protection Act, 2023 (India) and the DPDP Rules. Have your legal adviser review it before relying on it; your signed master agreement with ConfirmDoc prevails where they differ.

1. Who is who

• The Customer (the hospital, clinic, laboratory, imaging centre or pharmacy that uses ConfirmDoc) is the Data Fiduciary: it decides why and how patients' and staff members' personal data is processed.
• ConfirmDoc (the platform provider) is the Data Processor: it processes that personal data only on the Customer's behalf, to provide the service.
• Data Principals are the patients, their family members or nominees, and the Customer's staff whose data is in the system.

2. What ConfirmDoc processes, and why

• Kinds of data: identity and contact details, ABHA / health IDs, medical history, clinical notes, prescriptions, test and imaging results, bills, insurance and payment details, consent records; staff names, roles, contact details and sign-in records.
• Purposes: running the hospital information system the Customer subscribed to — registration, appointments, OPD / IPD care, laboratory, imaging, pharmacy, billing, insurance claims, reminders, patient app, AI-assisted features the Customer switches on, reports, backups and support.
• ConfirmDoc does not use the Customer's personal data for its own purposes: no selling, no advertising, no profiling, and no training of AI models on identifiable patient data.

3. ConfirmDoc's obligations

1. Instructions. Process personal data only on the Customer's documented instructions — this agreement, the master agreement, and what the Customer configures in the product. ConfirmDoc tells the Customer if it believes an instruction breaks the law.
2. Confidentiality. Everyone at ConfirmDoc who can reach personal data is bound by confidentiality and gets access only when needed. Support staff can see a Customer's data only after a Customer administrator approves it in Settings → Support access, for a limited time, read-only, and every screen they open is logged and shown to the Customer.
3. Security. Maintain the safeguards described in the Security Overview (version 2026-10), including encryption in transit and at rest, database-level separation of customers, two-factor sign-in for ConfirmDoc staff, audit logs, encrypted backups with restore checks, malware scanning of uploads, and monitoring. ConfirmDoc may improve these measures but will not reduce the overall level of protection.
4. Sub-processors. Use only the sub-processors listed in Annex 1 (or added later with notice). ConfirmDoc gives at least 30 days' notice of a new sub-processor; the Customer may object on reasonable data-protection grounds. ConfirmDoc imposes equivalent obligations on each sub-processor and remains responsible for them.
5. Location. Store the Customer's personal data in India (cloud region Mumbai or equivalent), unless the Customer chooses a service that needs a transfer (for example WhatsApp messaging) — and never to a country the Government of India restricts.
6. Breaches. Tell the Customer without undue delay and in any case within 24 hours of becoming aware of a personal-data breach affecting the Customer's data, with what is known (what happened, data and people affected, likely consequences, measures taken), and keep updating it — so the Customer can inform the Data Protection Board and affected Data Principals in time (details within 72 hours) and CERT-In within 6 hours for cyber incidents.
7. Data Principals' rights. Provide tools for the Customer to answer requests to access, correct, erase or port data, to record and withdraw consents, and to handle grievances and nominations (Settings → Privacy & DPDP; the patient app's privacy centre), and assist with anything those tools don't cover.
8. Records and audits. Keep records of processing; make available the information needed to show compliance; allow audits by the Customer (or an independent auditor it appoints) once a year with 30 days' notice, or after a breach, at the Customer's cost, without exposing other customers' data. Independent certifications and penetration-test summaries may be provided instead.
9. Retention and deletion. When the subscription ends, the Customer can export all of its data (a complete ZIP of all tables and files). ConfirmDoc keeps the data for the retention period stated in the master agreement (90 days by default) so the Customer can return, then deletes it from the live systems; encrypted backups containing it expire within the backup retention period (14 days by default). Data the law requires ConfirmDoc itself to keep (invoices, tax records) is kept only as required.

4. The Customer's obligations

• Have a lawful basis — consent or a legitimate use under the Act — for the personal data it enters, and give patients a clear privacy notice (the product lets the Customer publish one, versioned).
• Configure access correctly: give staff only the roles they need, use two-factor sign-in for administrators, restrict sensitive records, review access alerts.
• Keep its own sign-in credentials secret and tell ConfirmDoc promptly of any suspected misuse.

5. Liability, term and law

• Liability is as set out in the master agreement.
• This agreement lasts as long as ConfirmDoc processes personal data for the Customer, and its confidentiality and deletion duties survive termination.
• Governed by the laws of India; courts as in the master agreement.

Annex 1 — Sub-processors (as configured by the Customer)

Annex 2 — Security measures

See the Security Overview, version 2026-10.