Data Processing Agreement & BAA

2.1 Universal Applicability: This Agreement governs all processing of Customer Personal Data initiated through Eldovian Desk, whether during an initial clinical trial pilot ("Pilot Evaluation") or an ongoing enterprise commercial subscription ("Commercial Subscription").

2.2 Grant of Limited Licence: Subject to the terms and conditions herein, Eldovian grants Customer a limited, non-exclusive, non-sublicensable, non-transferable, revocable licence to access and utilize the Platform for clinical practice management and electronic health records within Customer's authorized clinical facility.

2.3 Assistive Clinical Nature & Medical Non-Liability: Customer acknowledges and expressly agrees that:

• Eldovian Desk is clinical infrastructure and administrative software. Any integrated artificial intelligence features provide assistive documentation drafts and workflow automation, not medical diagnosis or clinical judgment.
• Customer, its consulting doctors, and healthcare practitioners retain sole, exclusive, and final clinical responsibility for evaluating patient conditions, approving medication orders, administering inpatient treatments, diagnosing ailments, and overseeing healthcare outcomes.

3.1 Data Fiduciary / Processor Relationship: Under the DPDP Act 2023, Customer is the Data Fiduciary who determines the purpose and lawful basis for collecting patient data. Eldovian acts strictly as a Data Processor, processing Customer Personal Data solely on the documented, lawful instructions of Customer as set forth in this DPA and the Platform configuration.

3.2 Express Exclusion of Joint Data Fiduciary Status: The parties explicitly stipulate that Eldovian does not act as a Joint Data Fiduciary under Section 2(i) or Section 8 of the DPDP Act. Eldovian does not determine the medical or organizational purposes of data collection. Customer shall indemnify, defend, and hold harmless Eldovian against any regulatory penalties, claims, or administrative actions arising from any determination by a regulatory authority or court that Eldovian is a Joint Data Fiduciary due to Customer's breach of its statutory consent or notice obligations.

3.3 Purpose Limitation: Eldovian covenants to process Customer Personal Data exclusively for: (a) operating outpatient queues and inpatient ward workflows; (b) maintaining nurse e-MAR task logs and medication schedules; (c) generating billing ledgers and pharmacy stock records; and (d) maintaining technical security, audit trails, and platform integrity.

Eldovian covenants to implement and maintain rigorous technical and organizational security measures as detailed below and in Schedule B:

• Demographic Application-Level Encryption (ALE): All sensitive patient demographic fields (including phone, email, ABHA identifiers, blood group, allergies, medical histories, and medications) are protected by Application-Level Encryption utilizing AES-256-GCM. Encryption keys are managed outside the database layer, rendering persisted records cryptographically unreadable in the event of direct database exposure.
• Zero Audio Storage Warranty: Where real-time clinical voice scribing is utilized, audio recordings are streamed ephemerally directly into volatile system memory (RAM). Audio is processed in-flight and permanently discarded immediately upon transcript completion. Audio recordings are never written to disk or non-volatile backup archives.
• Zero Model Training on Protected Data: Eldovian guarantees that Customer Personal Data, patient charts, medication logs, and clinical consults are never utilized to train, re-train, fine-tune, or benchmark public foundation AI models.
• Sovereign Data Localization: All persistent databases, authentication servers, and application clusters are hosted exclusively within the sovereign territory of the Republic of India at the AWS Asia Pacific (Mumbai) Region (ap-south-1).
• ISO 27789 Audit Trails: Platform operations enforce granular, tamper-evident audit logging compliant with ISO 27789 standards, tracking all clinical note views, edits, exports, and identity authentications via an aggregated JSONB ledger.

5.1 Verifiable Patient Consent: Customer warrants and covenants that prior to registering patients or capturing consultation records, Customer has obtained valid, informed, verifiable consent (written or explicit verbal acknowledgement documented in clinical intake forms) from the patient (Data Principal) in compliance with Section 6 of the DPDP Act 2023.

5.2 Pediatric & Minor Governance (DPDP Act Section 9): Where outpatient or inpatient treatment involves a Data Principal who is a child (under 18 years of age) or a person with a disability under lawful guardianship:

• Customer represents, warrants, and covenants that it has obtained verifiable consent from the parent or lawful guardian of the child prior to creating medical records or initiating real-time clinical voice transcription.
• Customer acknowledges that Eldovian enforces an absolute prohibition against behavioral tracking, targeted profiling, or advertisement tracking of children, and Customer agrees never to configure or utilize the Platform for any such purpose.

6.1 Authorized Sub-processors: Customer provides prior general written authorization for Eldovian to engage the sub-processors set forth in Schedule C.

6.2 Pass-Through Contractual Covenants: Eldovian shall impose data protection and cybersecurity obligations on each sub-processor that are no less protective than those set forth in this Agreement, including data localization within India, zero model training on patient data, and encryption at rest and in transit.

6.3 Sub-processor Modification & Right to Object: Eldovian shall notify Customer of any planned addition, removal, or replacement of a sub-processor by updating its sub-processor registry or providing electronic notice at least fifteen (15) calendar days in advance. Customer may object to a new sub-processor on reasonable data protection grounds within ten (10) days of receiving notice. If the parties cannot resolve the objection, Customer may terminate the affected service without penalty upon written notice.

6.4 Primary Processor Liability: Eldovian remains fully liable to Customer for the acts and omissions of its sub-processors to the same extent as if performed directly by Eldovian.

7.1 Fiduciary Responsibility: Customer, as Data Fiduciary, is primarily responsible for receiving, evaluating, and fulfilling Data Principal rights requests (including access, correction, completion, erasure, and grievance redressal under Sections 11–13 of the DPDP Act 2023).

7.2 Processor Assistance SLA: To the extent Customer cannot fulfill a Data Principal request through the Platform console, Eldovian shall, upon receipt of written notice at grievance@eldovian.com (or privacy@eldovian.com), provide commercially reasonable assistance within thirty (30) calendar days.

7.3 Harmonization with NMC Medical Archiving: If a Data Principal requests the erasure of medical charts or inpatient records, both parties recognize that Customer and Eldovian are subject to statutory medical record-retention mandates, including the National Medical Commission (NMC) requirement to retain clinical records for a minimum period of three (3) years. In such instances, Eldovian shall support Customer by quarantining and soft-deleting the active records, retaining them in an isolated, encrypted cold archive solely for statutory compliance.

7.4 Statutory Grievance Redressal Officer (DPDP Act Sec. 8(9)): Pursuant to Section 8(9) and Section 13 of the DPDP Act 2023, Eldovian has designated a Grievance Redressal Officer. Data Principals and Healthcare Facilities may lodge privacy complaints, rights requests, or audit queries directly:

8.1 Notification Timeline: In the event of a confirmed Personal Data Breach affecting Customer Personal Data within Eldovian's infrastructure, Eldovian shall notify Customer without undue delay and in any event within twenty-four to forty-eight (24–48) hours of verifying the incident.

8.2 Incident Documentation: Eldovian shall provide Customer with available details regarding: (a) the nature, timing, and extent of the breach; (b) the estimated categories and volume of affected Data Principals; (c) the likely consequences; and (d) mitigation and remediation measures taken or planned.

8.3 Regulatory Reporting & Cost Allocation:

• Customer retains primary statutory responsibility for reporting the breach to the Data Protection Board of India (DPBI) under Section 8(6) of the DPDP Act and to affected Data Principals.
• Where a breach is caused solely by Eldovian's breach of its security commitments, Eldovian shall remediate the breach and provide breach documentation at its own expense. Where a breach is caused by Customer's credential mismanagement, device compromise, or unauthorized user access, all remediation and notification expenses shall be borne solely by Customer.

9.1 Managed Security Evidence: Upon Customer's written request, Eldovian shall satisfy Customer's verification and audit rights under Applicable Data Protection Law by providing: (a) executive summaries of its annual Vulnerability Assessment and Penetration Testing (VAPT) conducted by an independent CERT-In empaneled security auditor; (b) technical architecture security attestations; and (c) completed standardized security questionnaires (SIG/CAIQ).

9.2 Restricted On-Site Audits: If Customer, as an NABH-accredited or regulated hospital entity, is required by a competent healthcare accreditation authority to perform an on-site audit, Eldovian shall permit such inspection subject to: (a) at least thirty (30) business days' advance written notice; (b) conduct during normal business hours; (c) execution of a non-disclosure agreement; (d) strict non-interference with production operations and multi-tenant data boundaries; and (e) Customer bearing all out-of-pocket costs of such audit.

10.1 Bilateral Confidentiality: Each party covenants to protect the other party's Confidential Information with the same degree of care it uses for its own confidential records, but in no event less than a reasonable standard of care.

10.2 Customer Data Ownership: All patient EMR records, consultation notes, prescription histories, ward charts, e-MAR nurse tasks, and clinical invoices created by Customer remain the sole and exclusive intellectual and proprietary property of Customer.

10.3 Platform Intellectual Property: Eldovian retains sole and exclusive ownership of all right, title, and interest in and to the Platform, including proprietary algorithms, database architectures, user interfaces, documentation, and technical enhancements.

11.1 Post-Termination Transition Window: Upon expiration or termination of the service relationship for any reason, Eldovian shall provide Customer with a thirty (30) calendar day read-only transition period, during which Customer may export all clinical charts, EMR records, and audit logs via standard JSON/PDF/CSV formats.

11.2 Certified Cryptographic Erasure: Following the expiry of the 30-day transition window, Eldovian shall, upon Customer's written confirmation or automatic expiry, permanently delete, overwrite, and cryptographically erase all active Customer Personal Data from its production database clusters within sixty (60) days, retaining only those archived records strictly mandated by applicable statutory laws (such as NMC archiving or taxation).

12.1 Consequential Damages Exclusion: To the maximum extent permitted by applicable law, neither party shall be liable to the other for any indirect, incidental, punitive, special, or consequential damages, including loss of hospital revenue, loss of goodwill, or business interruption.

12.2 Aggregate Liability Ceiling:

• Commercial Subscriptions: Eldovian's total aggregate liability arising out of or related to this Agreement shall be strictly capped at the total fees paid by Customer to Eldovian in the twelve (12) months preceding the incident.
• Pilot Evaluations: For non-paying clinical pilot users, Eldovian's aggregate liability shall not exceed INR 50,000 (Rupees Fifty Thousand).

12.3 Liability Carve-Outs: The liability limitations in Section 12.2 shall not apply to damages resulting from a party's gross negligence, willful misconduct, or breach of Section 10 (Confidentiality).

12.4 Customer Indemnity: Customer agrees to defend, indemnify, and hold Eldovian harmless against any third-party claims, liabilities, or regulatory fines arising out of: (a) failure to obtain valid informed patient consent; (b) clinical malpractice, patient misdiagnosis, or inpatient treatment decisions; or (c) Customer's breach of Section 5.2 (Pediatric Governance).

13.1 Term: This Agreement takes effect upon workspace deployment or signature and remains in effect co-terminously with Customer's active Pilot Evaluation or Commercial Subscription.

13.2 Termination for Convenience: Either party may terminate this Agreement without cause upon thirty (30) days' advance written notice.

13.3 Termination for Material Breach: Either party may terminate this Agreement immediately upon written notice if the other party materially breaches this Agreement and fails to cure such breach within fifteen (15) days of written notice.

14.1 Governing Law: This Agreement shall be governed by, and construed in accordance with, the substantive laws of the Republic of India.

14.2 Amicable Resolution: In the event of any dispute arising out of this Agreement, the parties shall first attempt to resolve the dispute through good-faith negotiations between designated hospital executive representatives for fifteen (15) business days.

14.3 Binding Arbitration: Any dispute not resolved through negotiation shall be referred to and finally resolved by binding arbitration under the Arbitration and Conciliation Act, 1996 (as amended). The arbitral tribunal shall consist of a sole arbitrator appointed by mutual agreement, or failing agreement within thirty (30) days, in accordance with the Act.

14.4 Seat, Venue & Language: The legal seat and venue of the arbitration shall be Bengaluru, Karnataka, India. The language of arbitration shall be English.