1.1 "Data Fiduciary" (MyAyushClinic) determines purpose and means of processing; "Data Processor" (Practitioner) processes on its behalf; "Personal Data" includes health data per DPDPA. 2.1 This DPA governs the Practitioner's processing of patient data accessed through the Platform.
3.1 Process patient data ONLY to provide AYUSH services via the Platform. 3.2 No other purpose (no personal research, marketing, or third-party sharing). 3.3 Implement safeguards: secure password-protected device, 2FA, no shared/public computers, private consultation environment. 3.4 Observe data minimisation — access only data of assigned patients; no downloading or storing outside the Platform's secure environment unless expressly permitted in writing or required by law.
4.1 No sub-processor without prior written consent. 5.1 Notify MyAyushClinic of any suspected or actual breach within 12 hours, with nature, categories, numbers affected, and remediation. 6.1 Forward any patient rights request to MyAyushClinic within 24 hours and assist compliance. 7.1 On termination, cease processing and confirm in writing no patient data is retained. 8.1 MyAyushClinic may audit (max once per quarter, 7 days' notice); the Practitioner cooperates.