1. Roles
For patient health data entered into Saaro Health, the clinic is the data fiduciary under the Digital Personal Data Protection Act, 2023 ('DPDP Act'), determining the purpose and means of processing. Lumotis Digital Media acts as a data processor, processing that data solely on the clinic's documented instructions as set out in these terms and the product itself.
2. Scope of processing
Lumotis processes patient personal data, including health data, strictly to provide the Saaro Health platform: storing and retrieving records, generating prescriptions and invoices, sending WhatsApp messages via SaroConnect on the clinic's behalf, supporting ABDM/ABHA-related functionality, and providing technical support.
3. Clinic obligations
The clinic is responsible for: obtaining and recording valid patient consent for the processing described in this agreement; determining what data is collected and from whom; and responding to patient rights requests as the data fiduciary, with Lumotis providing reasonable technical assistance to facilitate this.
4. Sub-processors
Lumotis engages sub-processors to operate the platform, including cloud hosting infrastructure and SaroConnect (Lumotis's own WhatsApp Business infrastructure). A current list is maintained at our sub-processors page. We will notify clinics of material changes to this list with at least subprocessor notice days days' notice where practicable.
5. Security measures
Lumotis maintains encryption in transit and at rest, role-based access controls limiting data access to authorised personnel on a need-to-know basis, and audit logging of access to patient records. Further detail is available on our security page.
6. Data location
Patient data is hosted in hosting region, within India, and is not transferred outside India except where a clinic-initiated integration explicitly requires it.
7. Breach notification
In the event of a personal data breach affecting a clinic's data, Lumotis will notify the affected clinic without undue delay after becoming aware of the breach, and will provide information reasonably necessary for the clinic to meet its own notification obligations under the DPDP Act.
8. Assistance with data rights requests
Lumotis will provide the clinic with tools and reasonable assistance to respond to patient requests for access, correction, erasure and nomination under the DPDP Act, recognising that the clinic, as data fiduciary, is responsible for determining and executing the response.
9. Data return and deletion on termination
On termination of a clinic's account, Lumotis will make the clinic's data available for export for a reasonable period, after which data will be deleted from active systems and backups in line with our standard retention schedule, unless a longer retention period is required by applicable law.
10. Audit rights
Lumotis will provide reasonable information to demonstrate compliance with this agreement on request, and will cooperate with a reasonable audit request from a clinic, subject to confidentiality and scheduling considerations.
11. Contact
Questions about this agreement can be sent to contact email or to our named Data Protection Officer, dpo name.