Data protection

Draft, under legal review

Our role under the DPDP Act 2023

Under India's Digital Personal Data Protection Act 2023, the clinic is the Data Fiduciary: it decides why and how patient data is used. OwnClinic is the clinic's Data Processor: we handle patient data only on the clinic's behalf and on its instructions.

How the product supports the clinic

• Consent is recorded with a timestamp at registration, and patients can withdraw it.
• Every view or change of a patient record is written to an audit log.
• Staff see only what their role allows.
• Owners and doctors sign in with an SMS code as a second step.
• Signed prescriptions are locked. Corrections create a new version.

Storage and retention

Data is hosted in India on AWS in Mumbai. Records are kept for 5 years by default. The clinic can export all its data at any time.

Patient requests

Patients should send requests to access, correct or erase their data to their clinic. We help the clinic carry these out.

Data breaches

If we learn of a breach affecting a clinic's data, we will tell the clinic without delay so that it can meet its duties under the Act.

Our commitment

We never sell patient data or use it for advertising.