DPDP Act, 2023 Compliance

India's Digital Personal Data Protection Act, 2023 ("DPDP Act") regulates processing of digital personal data. Careflow is designed to support clinics and platform operations in a manner consistent with core DPDP principles: purpose limitation, data minimization, security safeguards, and accountability.

This page is informational and not legal advice. Clinics should obtain their own counsel for compliance with clinical and privacy regulations.

For patient data entered by a clinic, the clinic is generally the Data Fiduciary. Careflow processes such data as a service provider on the clinic's behalf.

For Careflow account and billing data of clinic users, Careflow acts as Data Fiduciary.

Clinics should provide patients with clear notices about data use and obtain consents required for treatment, electronic records, and messaging channels such as WhatsApp.

Careflow provides digital consent capture tools for treatment consent workflows. Clinics control when and how those tools are used.

Data Principals (individuals) may have rights to access, correction, erasure, and withdrawal of consent under the DPDP Act and rules. Patients should contact their clinic first for clinical data. We maintain a grievance channel for platform-related concerns.

We implement reasonable security safeguards including encryption in transit, authentication, authorization scoped by clinic, and logging of security-relevant events.

If personal data is processed outside India due to infrastructure location, we will follow applicable DPDP transfer requirements and contractual protections as they come into force.

Where clinics process data of children as patients, clinics are responsible for verifiable parental/guardian consent and for not undertaking tracking or behavioral advertising to children through Careflow.

Contact our Grievance Officer at [email protected]. See the Grievance & Contact page for response timelines.