Data Processing Agreement (DPA)

1. Scope & Licence Grant

This DPA applies to all processing of Patient Personal Data, demographic identifiers, outpatient (OPD) queues, inpatient (IPD) admission charts, bed maps, nurse task logs (e-MAR), diagnostic references, pharmacy stock records, billing details, and clinical audio/transcriptions initiated by the Customer through the Eldovian Desk platform.

Subject to the terms of this Agreement, Eldovian Technologies grants the Customer and its authorized clinical users a limited, non-exclusive, non-transferable, revocable licence to access and use Eldovian Desk solely for operating clinic workflows during the active pilot duration or paid subscription period. This licence does not include any right to sublicense, reverse-engineer, resell, or otherwise make the platform available to unauthorized third parties. Eldovian Technologies reserves the right to suspend or revoke access if the platform is accessed in material breach of this Agreement.

2. Nature of Software & Clinical Responsibility

The Clinician and Healthcare Facility acknowledge and agree to the following conditions regarding the platform's operational scope:

• Software Operational Status: Eldovian Desk is clinical management and EMR infrastructure software. Advanced AI capabilities (such as ambient outpatient scribe and inpatient rounds summarization) provide draft assistive documentation.
• Assistive Nature Only: AI-generated clinical notes, progress summaries, and transcription drafts may contain inaccuracies or omissions. The platform must never be used as an automated diagnostic tool or as a substitute for licensed clinical judgment.
• No Clinical Warranty: Eldovian Technologies provides no warranty, express or implied, regarding the medical accuracy, diagnostic correctness, or clinical fitness of any AI-generated text or calculated metric for direct patient treatment.
• Sole Clinical Responsibility: The Clinician and Medical Facility retain full, final, and exclusive clinical and medico-legal responsibility for all patient care decisions, prescriptions, diagnoses, discharge orders, and patient outcomes, regardless of any data presented or generated by the platform.

3. Data Roles — DPDP Act 2023 (India) & HIPAA

This agreement assigns data roles in strict accordance with the Digital Personal Data Protection Act 2023 (India) and HIPAA regulations:

• Data Fiduciary / Covered Entity: The Customer (Clinic / Hospital / Registered Clinician) — determines the legal purpose and means of processing patient records and health data within their practice.
• Data Processor / Business Associate: Eldovian Technologies — processes patient health records and metadata strictly on the instruction, configuration, and behalf of the Customer to provide EMR, ward management, billing, and clinical documentation infrastructure.
• Data Principals:The patients treated at the Customer's healthcare facility, whose personal health data is securely stored and managed.

3.2 No Joint Fiduciary Status:The parties acknowledge and agree that Eldovian Technologies acts strictly as a Data Processor and not as a Joint Data Fiduciary. Eldovian Technologies does not independently determine the purposes or clinical means of processing personal data. The Customer shall maintain sole responsibility for the lawful collection of patient data, obtaining valid informed consents, verifying doctor credentials, and responding to patient rights under the DPDP Act 2023. The Customer shall defend, indemnify, and hold Eldovian Technologies harmless from any claims, liabilities, or penalties arising out of any determination that Eldovian Technologies acts as a Joint Data Fiduciary due to the Customer's failure to comply with statutory fiduciary obligations.

4. Strict Processing Commitments & Technical Measures (TOMs)

Eldovian Technologies covenants and guarantees the implementation of the following security and processing controls:

• Field-Level Demographic Encryption (AES-256): Sensitive patient demographic fields (including phone numbers, email addresses, ABHA IDs, ABHA numbers, blood groups, allergies, medical history, and active medications) are encrypted using AES-256 before disk writes, ensuring data remains secure at rest.
• Zero Audio Storage (AI Scribe): When AI scribing or voice rounds are utilized, medical audio streams are processed in volatile memory (RAM) in real time and discarded immediately upon note generation. Audio recordings are never written to disk or stored on permanent storage servers.
• Aggregated Audit Trails (ISO 27789 / DPDP Act): All critical actions (such as chart views, note edits, and DDI clinical overrides) are ledgered into immutable JSONB event arrays inside public.audit_logs, recording timestamps, actor IDs, and IP addresses.
• Role-Based Access Control (RBAC): Granular privilege boundaries separating Doctors, Nurses, Receptionists, and Billing Staff to enforce the principle of least privilege.
• Sovereign Data Hosting (AWS Mumbai): All database instances, application nodes, and audit storage are exclusively hosted in the AWS Asia Pacific (Mumbai) region (ap-south-1), guaranteeing data localization within Indian borders.
• No AI Model Training on Patient Data: Patient health records and clinical notes are never used to train generalized foundation models or shared with unauthorized commercial entities.
• National Medical Commission (NMC) Retention Support: Eldovian Desk provides structured archiving tools and soft-delete protection to assist Clinicians in fulfilling their statutory duty to maintain medical records for a minimum of 3 years under NMC regulations.

5. Authorized Sub-Processors

Eldovian Technologies engages only the following vetted sub-processors in the delivery of the Platform, each bound by equivalent data protection obligations:

• Supabase Inc. (hosted on AWS ap-south-1, Mumbai): Provides Postgres database infrastructure, real-time sync, user authentication, automated encrypted backups, and audit storage.
• Sarvam AI / Google Cloud Vertex AI (Sovereign Endpoints): Powers real-time speech-to-text transcription and structured clinical note draft synthesis via stateless APIs. Processing occurs entirely in memory within authorized boundaries with zero permanent retention.

Eldovian Technologies remains responsible to the Customer for the acts and omissions of its authorized sub-processors and shall notify the Customer of any material sub-processor modifications with reasonable prior notice.

6. Data Breach Response Procedure

In the event of a confirmed security incident impacting Customer data, Eldovian Technologies shall:

• 72-Hour Notification: Notify the Customer's designated administrative contact within 72 hours of confirming a personal data breach affecting patient data.
• Forensic Assistance: Provide commercially reasonable incident forensics, affected record scopes, and corrective remediation steps.
• Regulatory Cooperation: Cooperate with the Customer in reporting the incident to the Data Protection Board of India (DPBI) and CERT-In where required by applicable law.
• Remediation: Take prompt steps to contain, isolate, and remediate the breach. Liability for containment and remediation shall be governed by Section 12, except in cases of gross negligence or willful misconduct.
• Summary Report: Furnish a formal post-incident report within 30 days of complete containment. The Customer retains primary responsibility for communicating breach advisories to affected patients.

7. Clinician & Healthcare Facility Obligations

To maintain clinical safety and statutory compliance, the Customer covenants and agrees to:

• Informed Patient Consent: Obtain appropriate consent from patients before entering their personal health information and when utilizing assistive ambient scribing tools during consultations.
• Credential & Session Hygiene: Maintain strict confidentiality of clinic login credentials, enforce multi-factor authentication where available, and immediately revoke access for offboarded staff members.
• Doctor Verification & Finalization: Ensure all clinical prescriptions, inpatient round notes, and discharge summaries are personally reviewed and signed off by a registered medical practitioner prior to clinical execution.
• Suggested Patient Notice Script:
  "This clinic utilizes digital EMR infrastructure and AI documentation tools. Your medical consultation and care notes are encrypted under AES-256 security standards and stored within sovereign Indian cloud data centers. No audio is permanently stored on any server."

8. Patient (Data Principal) Rights Management

Under the DPDP Act 2023, patients have legal rights regarding access, correction, erasure, grievances, and representative nomination.

The Healthcare Facility, as Data Fiduciary, is responsible for receiving and verifying patient rights requests. Where fulfillment of an erasure or correction request requires action by Eldovian Technologies as Data Processor, the Customer shall notify Eldovian promptly at privacy@eldovian.com. Eldovian Technologies shall process verified requests within 30 days, subject to statutory medical record retention rules (such as NMC 3-year archiving requirements).

9. Representations & Warranties

• Eldovian Warranties: Eldovian Technologies represents and warrants that it has full legal power to execute this Agreement, that the software does not knowingly infringe third-party intellectual property, and that it processes personal data in compliance with the DPDP Act 2023.
• Customer Warranties: The Customer represents and warrants that all medical staff operating the workspace hold valid registrations from the relevant State Medical Council / National Medical Commission (NMC), and that clinic operations comply with applicable medical ethics and healthcare legislation.

10. Confidentiality & Non-Disclosure

10.1 Definition of Confidential Information:"Confidential Information" refers to any non-public technical, clinical, financial, or operational information disclosed by one party to the other. Confidential Information of Eldovian Technologies includes software source code, architecture, algorithms, UI patterns, and pilot performance metrics. Confidential Information of the Customer includes all patient records, EMR charts, demographic data, and billing entries.

10.2 Obligations & Standard of Care:Both parties agree to protect each other's Confidential Information with at least a reasonable standard of care, preventing unauthorized disclosure to third parties.

10.3 Survival: Confidentiality obligations regarding patient health data, trade secrets, and core IP shall survive indefinitely. All other general confidentiality covenants shall survive for five (5) years following agreement termination.

11. Intellectual Property & Data Ownership

Eldovian Desk, including all underlying software, schemas, algorithms, interfaces, and branding, remains the exclusive intellectual property of Eldovian Technologies. Participation in the clinical pilot or subscription does not transfer any proprietary IP ownership.

Customer Data Ownership: All patient EMR records, consultation notes, prescription histories, ward charts, and clinical invoices created by the Customer remain the exclusive property of the Customer.

12. Liability Cap & Disclaimers

To the maximum extent permitted by applicable law, the parties agree to the following liability limits:

• Clinical Disclaimers: Eldovian Technologies is not liable for any clinical decision, patient injury, adverse medical outcome, medication error, or misdiagnosis resulting from the use or misuse of the platform.
• Consequential Damages: Neither party shall be liable for indirect, incidental, special, or consequential damages, including loss of clinical revenue or platform downtime.
• Aggregate Liability Cap: Eldovian's total aggregate liability under this Agreement shall not exceed INR 50,000 (Rupees Fifty Thousand) or the total fees paid by the Customer in the preceding 3 months, whichever is lower. This cap does not apply to liabilities resulting from gross negligence or willful misconduct.
• Mutual Indemnities:The Customer agrees to indemnify Eldovian against third-party claims arising from clinical decisions or credential breaches. Eldovian agrees to indemnify the Customer against third-party claims arising solely from Eldovian's direct failure to implement committed security measures.

13. Term & Termination

13.1 Term: This Agreement commences upon account registration / workspace deployment and remains in effect throughout the active trial or paid subscription duration.

13.2 Termination for Convenience:Eldovian Technologies may terminate this Agreement upon 7 days' written notice. The Customer may terminate upon 14 days' written notice.

13.3 Termination for Cause: Either party may terminate immediately upon written notice if the other party commits a material breach of this Agreement.

13.4 Effect of Termination: Upon termination, platform access will be revoked within 48 hours. The Customer may export or request complete purge of their clinical data via privacy@eldovian.com, subject to statutory record-retention requirements under Indian healthcare regulations.

14. Dispute Resolution & Governing Law

14.1 Governing Law: This Agreement is governed by and construed in accordance with the laws of India.

14.2 Amicable Resolution: The parties shall first attempt to resolve any dispute through good-faith negotiations for a period of 15 days.

14.3 Arbitration: Any unresolved dispute shall be finally settled by binding arbitration in accordance with the Arbitration and Conciliation Act, 1996, before a mutually agreed sole arbitrator.

14.4 Seat & Venue: The seat and venue of arbitration shall be Bengaluru, Karnataka, India, and proceedings shall be conducted in English.

15. Force Majeure & Assignment

Neither party shall be liable for performance delays resulting from circumstances beyond reasonable control (natural disasters, public grid failures, major cloud region outages).

Eldovian Technologies may assign its rights and obligations to a successor entity upon formal corporate incorporation as Eldovian Technologies Private Limited without additional consent, fully releasing individual co-founders from personal liability upon written notice.

16. Digital Execution & Acceptance