This document explains how Viyora Tech (“Viyora”) complies with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), India’s primary personal-data-protection legislation, and its associated rules. It is intended for our clinic customers, patients whose records are stored on the platform, auditors, and regulators.
1. Roles under the DPDP Act
- Clinic (customer) — Data Fiduciary. Determines the purpose and means of processing patient records.
- Viyora — Data Processor. Processes personal data on behalf of, and per the instructions of, the clinic.
- Patient / clinic staff — Data Principal. The natural person whose personal data is being processed.
2. Principles we honour
- Lawful, fair, transparent processing — Every purpose is disclosed at collection.
- Purpose limitation — Data is used only for the specified clinical / operational purpose.
- Data minimisation — We do not require fields that aren’t clinically or legally necessary.
- Accuracy — Clinics can edit patient records at any time; audit trail preserved.
- Storage limitation — Retention aligned with clinical, tax, and legal necessity (see Privacy Policy §5).
- Accountability — All processing is logged; sub-processors are contractually bound.
3. Consent framework
Consent captured on Viyora is:
- Free — obtained without coercion or bundled with unrelated services.
- Specific — separated per purpose (treatment consent, marketing communication, data storage).
- Informed — the patient sees a plain-language description of the treatment, risks, and warranty before signing.
- Unambiguous — recorded as a digitally-signed document with timestamp and IP address.
- Withdrawable — the patient can revoke consent through the clinic; withdrawal takes effect prospectively.
4. Security safeguards (Section 8(5), DPDP Act)
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Multi-tenant isolation with
clinic_id-scoped queries and role-based access. - Bcrypt password hashing; short-lived JWT tokens; JWKS-verified social login via Supabase.
- Signed webhooks (HMAC-SHA256) for all payment events.
- Access to production systems restricted to a small named team; access reviewed every 90 days.
- Immutable audit logs for consent forms, warranty issuance, invoices, and role changes.
5. Data-breach notification
In the event of a personal-data breach affecting the confidentiality, integrity, or availability of records on the platform, Viyora will:
- Notify the Data Protection Board of India within 72 hours of confirmation, as required.
- Notify affected clinics (Data Fiduciaries) without undue delay so they can, in turn, notify their patients.
- Publish a post-incident report within 30 days including root cause and remediation.
6. Data Principal rights & how to exercise them
- Right to access — Log in and export your data, or email admin@viyora.co.in.
- Right to correction & erasure — Patients contact their clinic; the clinic contacts us if the change requires backend action.
- Right to grievance redressal — Any Data Principal may raise a complaint with our DPO (below). Unresolved grievances may be escalated to the Data Protection Board of India.
- Right to nominate — Users can nominate an heir to receive their data (contact DPO to record).
7. Cross-border transfer
Primary data storage is located in India (Mumbai region). Sub-processors that operate outside India (e.g., Anthropic for AI inference) are engaged only under written data-processing agreements with standard contractual clauses, and only for the narrow purposes described in our Privacy Policy.
8. Children’s data (Section 9)
Personal data of minors (below 18) is processed only after verifiable parental / guardian consent captured through the digital consent flow. Behavioural tracking and targeted advertising of children are prohibited on the platform.
9. Grievance officer
Data Protection Officer, Viyora Tech
Email: admin@viyora.co.in
Statutory response window: 15 working days from receipt.
10. Amendments
This statement is reviewed at least once every 12 months and whenever the DPDP Act, associated rules, or our processing activities change materially.