DRAFT: not yet legal advice or a final document. This text was prepared as a starting point and must be reviewed and completed by a qualified Indian lawyer before launch. Highlighted [brackets] are details still to be filled in.

Data Processing Terms

Last updated 13 October 2026

These terms apply to the personal information that a clinic (“the Clinic”) stores in CliniZentro, including its patients’ health information (“Clinic Data”). They are part of the Terms of Service between the Clinic and [COMPANY LEGAL NAME] (“CliniZentro”), and apply from the moment the Clinic accepts those terms.

These terms do not cover what a doctor or clinic chooses to publish in the public doctor directory (names, qualifications, fees and similar). That is described in section 9 of the Privacy Policy.

1. Roles

The Clinic decides why and how Clinic Data is used (it is the “data fiduciary” or controller). CliniZentro processes Clinic Data only on the Clinic’s behalf (it is the “data processor”). The Clinic is responsible for having a lawful basis and any required consent for the data it puts into the service.

2. What CliniZentro will do

• Follow instructions. Process Clinic Data only to provide the service and as the Clinic instructs through the app and these terms, unless the law requires otherwise (in which case we will tell the Clinic where we lawfully can).
• Keep it confidential. Allow access only to people who need it to run the service, who are bound by confidentiality. Platform tools do not allow our staff to open patient records or sign in as a clinic user.
• Keep it secure. Maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest for files and credentials, separation between clinics, role-based access, two-step sign-in, audit logging and encrypted backups, as described in the Privacy Policy. We will keep these measures at least at the current standard.
• Use sub-processors responsibly. The Clinic authorises the sub-processors listed in the Privacy Policy. We will bind each to protect Clinic Data, and give the Clinic at least [30] days’ notice before adding or replacing one, so it can object. If the Clinic objects and we cannot resolve it, the Clinic may close its account and download its data.
• Help with rights requests. The Clinic can export, correct, archive and erase an individual’s data using tools in CliniZentro. We will assist further where the tools do not cover a request, within a reasonable time. If an individual contacts us directly about Clinic Data, we will refer them to the Clinic.
• Report breaches. Tell the Clinic without undue delay [and within 72 hours] after we confirm a personal data breach affecting Clinic Data, with what we know about its nature, the data and people affected, and what we are doing; and cooperate with the Clinic’s own notifications to authorities and individuals.
• Return and delete. At the end of the agreement, or when the Clinic asks, make Clinic Data available for download and then permanently delete it as described in the Terms of Service: 30 days after the Clinic closes, or sooner on the owner’s instruction. Copies in encrypted backups are removed as backups rotate out, within [35] days, and earlier deletions are re-applied if a backup is restored. We may retain what the law requires us to keep.
• Show compliance. Provide information reasonably needed to show we meet these terms, and allow for reasonable audits by the Clinic [no more than once a year, with notice, at the Clinic’s cost, and subject to confidentiality], or accept an independent report in its place.

3. What the Clinic must do

• Keep its account credentials and its staff’s access secure, and give staff only the roles they need.
• Give patients the notices and obtain the consents the law requires, including for WhatsApp and marketing messages, and record them in the app.
• Not put into the service data it has no right to use, and keep its own copy of records it is legally required to keep.

4. International transfers

Clinic Data is stored on servers in [HOSTING PROVIDER AND CITY, INDIA]. Some sub-processors (for example Meta for WhatsApp messages, and the AI provider if used) may process limited data outside India as part of the function the Clinic chooses to use. [LAWYER: confirm and complete the transfer wording required for your situation.]

5. Liability and order of precedence

The limits on liability in the Terms of Service apply to these terms. If these terms conflict with the Terms of Service on the handling of Clinic Data, these terms prevail.

6. Contact

Questions about data protection: [SUPPORT EMAIL]. Grievance Officer: [GRIEVANCE OFFICER NAME], [GRIEVANCE OFFICER EMAIL].