Data processing agreement

Applicable Data Protection Law means the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as each provision comes into force; the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, for as long as they apply; and, where the Agreement says so, other laws such as the Saudi Personal Data Protection Law or the EU and UK GDPR.

Customer Personal Data means personal data that OneHeal processes on the Customer's behalf in providing the Services.

Personal Data Breach means any unauthorised processing of Customer Personal Data, or its accidental disclosure, acquisition, sharing, use, alteration or destruction, or loss of access to it, that compromises its confidentiality, integrity or availability.

Sub-processor means a third party that OneHeal engages to process Customer Personal Data.

Terms such as Data Fiduciary, Data Processor and Data Principal have the meanings given in the DPDP Act. Where another law applies, they should be read as "controller", "processor" and "data subject" respectively.

Services means the OncoSync platform and related services that OneHeal provides under the Agreement; Order Form means the order form or master agreement signed by the parties; Fees means the amounts payable under the Agreement; Authorised Users means the individuals the Customer allows to use the Services; and a Specialist is an independent healthcare professional engaged through OncoSync's Clinical Intelligence Network.

For Customer Personal Data, the Customer is the Data Fiduciary and OneHeal is the Data Processor. This DPA is the contract required by Section 8(2) of the DPDP Act.

The Customer is responsible for the lawfulness of the processing it instructs. That includes giving patients the required notices, obtaining consent or relying on a valid legitimate use, keeping data accurate, responding to Data Principals, meeting the conditions that apply to children's data, and deciding how long medical records must be kept.

Where OneHeal processes personal data for its own purposes, such as managing user accounts, billing and Specialist verification, it does so as a Data Fiduciary under its Privacy policy, not under this DPA.

OneHeal will process Customer Personal Data only on the Customer's documented instructions. These consist of the Agreement, the way the Customer configures and uses the Services, and any other written instructions it gives. If OneHeal believes an instruction breaks the law, it will tell the Customer.

OneHeal will give access to Customer Personal Data only to personnel who need it to provide the Services, who are bound by confidentiality obligations, and who have been trained in handling health data.

OneHeal will not sell Customer Personal Data, use it for its own purposes, or combine it with other customers' data. It will not use Customer Personal Data to train models or develop features for anyone else, and will use de-identified data derived from it only with the Customer's written agreement.

OneHeal will keep a record of the processing it carries out for the Customer.

If the Customer is notified as a Significant Data Fiduciary, OneHeal will give reasonable help with its data protection impact assessments and audits.

OneHeal will maintain reasonable security safeguards to protect Customer Personal Data, including the measures required by Rule 6 of the DPDP Rules: encryption, access control, logging and monitoring, and backups. The measures currently in place are described in Annex 2.

OneHeal will keep the logs needed to detect and investigate unauthorised access for at least one year.

OneHeal may update its measures over time, but will not reduce the overall level of protection during the term.

The Customer authorises OneHeal to use the Sub-processors listed in Annex 3.

OneHeal will give the Customer at least 30 days' notice before adding or replacing a Sub-processor, by email and by updating its published list. The Customer may object on reasonable data protection grounds within 15 days of the notice. The parties will then work together in good faith to resolve the objection. If they can't, the Customer may end the affected Services and receive a refund of prepaid Fees for the unused part of the term.

OneHeal will bind each Sub-processor by a written contract that protects Customer Personal Data at least as well as this DPA does, and remains responsible to the Customer for each Sub-processor's performance.

Customer Personal Data is stored in the AWS region stated in Annex 1. OneHeal will not move its primary storage to another region without the Customer's prior written consent.

OneHeal's engineering and support teams access the Services from India.

Any transfer of Customer Personal Data outside India will comply with Section 16 of the DPDP Act and any restrictions the Government notifies. Where a Customer is subject to data-residency rules elsewhere, such as in the Kingdom of Saudi Arabia, OneHeal will meet the residency requirements set out in the Order Form.

Where the EU or UK GDPR applies, the parties will put the relevant standard contractual clauses in place on request.

OneHeal will notify the Customer without undue delay, and in any event within 24 hours of becoming aware of a Personal Data Breach. This gives the Customer time to send its detailed report to the Data Protection Board within the 72 hours the DPDP Rules allow.

The notice will describe, as far as is then known, the nature and extent of the breach, when and where it happened, the categories and approximate number of Data Principals and records affected, its likely consequences, the steps taken and proposed to contain it, and a contact person. OneHeal will add further information as it becomes available.

OneHeal will act immediately to contain, investigate and mitigate the breach, preserve the relevant evidence, and cooperate fully with the Customer.

OneHeal will not notify Data Principals or the Data Protection Board on the Customer's behalf unless the Customer asks it to or the law requires it. OneHeal will report cyber security incidents to CERT-In within the time the CERT-In Directions of 28 April 2022 require, and will tell the Customer when it does.

Notifying a breach is not an admission of fault or liability.

If OneHeal receives a request from a Data Principal about Customer Personal Data, it will forward it to the Customer within three working days and won't respond to it directly, except to tell the person that the request has been passed on.

OneHeal will provide tools and reasonable help so that the Customer can give access to, correct, complete, update and erase Customer Personal Data, and respond to grievances, within the time limits the law sets. This help is free of charge, unless the volume of requests is unusually high.

OneHeal will make available the information the Customer reasonably needs to show that this DPA is being complied with. On request, this includes a summary of its security measures and of any independent audit or penetration test reports it has.

Once a year, the Customer, or an independent auditor bound by confidentiality who isn't a competitor of OneHeal, may audit OneHeal's compliance with this DPA. The Customer must give 30 days' notice, carry out the audit during business hours and bear its own costs. The Customer may carry out further audits after a Personal Data Breach, or where a regulator requires it.

OneHeal will cooperate with any regulator that has authority over the Customer.

The Customer can export Customer Personal Data at any time during the term.

When the Agreement ends, the Customer has 30 days to export its data. OneHeal will then delete Customer Personal Data from its production systems within the following 30 days, and from backups as they expire, which takes no more than 90 days. OneHeal will confirm the deletion in writing on request.

OneHeal may keep data only where the law requires it to. In that case, it will continue to protect the data and use it only for that purpose.

The Customer is responsible for meeting its own legal obligations to keep medical records, and should export the data it needs before deletion.

Each party's liability under this DPA is subject to the limitations of liability in the Agreement. Where the Agreement doesn't set a separate limit for data protection, OneHeal's total liability for breach of this DPA is limited to two times the Fees paid and payable by the Customer in the 12 months before the event that gave rise to the claim.

This DPA is governed by the laws of India, unless the Agreement says otherwise. Disputes are resolved as the Agreement provides. If it doesn't, they will be referred to arbitration by a sole arbitrator appointed by mutual agreement under the Arbitration and Conciliation Act, 1996, with the seat and venue in New Delhi and proceedings in English.