Everything a clinic owner, an auditor or a careful patient would want to know, without a sales call.
Six pages that say plainly what the law asks, what the product does, and what stays your job. Where a fact is not yet confirmed for publication, it says so instead of implying it.
Hosted in IndiaDPDP-readyOwned messaging layer
Start with the question you actually have.
Each page follows the same shape: what is asked, who owns each obligation, the product controls, what it looks like in the record, and a mapping table.
- Regulation
ABDM compliance
ABHA creation and linking, care contexts, the HIP and HIU roles, consent artefacts and FHIR bundles, done from the front desk.
Read more - Regulation
DPDP compliance
Your clinic is the data fiduciary. Notice, consent, retention, erasure, breach reporting and grievance handling, with who owns each.
Read more - Platform
Security
Encryption in transit and at rest, role-based access, an audit trail that cannot be edited, tested backups, and an honest line on certification.
Read more - Platform
Data residency
Hosted in India. Where each category of data lives, the one thing that crosses a border, and how to verify it yourself.
Read more - Platform
Uptime and SLA
The availability target, the public status page, support hours, maintenance windows and service credits.
Read more - Disclosure
Sub-processors
Every third party that touches clinic data, what it does and where it runs. Reviewed monthly, change-notified in advance.
Read more
Three readers, three routes through the same six pages.
If you are a clinic owner deciding whether to switch, read DPDP compliance and Security. Between them they answer the questions your accountant, your senior doctor and your most sceptical patient will ask: who is responsible, where is the data, who can see it, and what happens if something goes wrong. Then read Uptime and SLA, because a clinic runs on the software every OPD session and a target without a status page is a promise without a receipt.
If you are an auditor or a consultant doing due diligence for a chain, start with Sub-processors and Data residency, then Security. Each has a mapping table built to be lifted into a questionnaire, and each says which evidence is available on request. Tokens in braces mark values confirmed at signature; we publish them as tokens rather than guess.
If you are a doctor who cares mostly about ABDM, read ABDM compliance first. It explains the building blocks, the HIP and HIU roles, and what the clinic still has to register itself, and it links to the integration page and the guide for the detail.
- Lumotis Digital Media, Jaipur, is the data processor; your clinic is the data fiduciary under the DPDP Act 2023.
- Patient data is hosted in India, in hosting region, with backups also in India.
- WhatsApp messaging runs on SaroConnect, Lumotis's own WhatsApp Business Solution Provider infrastructure, with no third-party BSP.
- Independent certification status is stated as certification status rather than implied.
- The legal documents that back these pages are the privacy policy, terms of service, data processing agreement and cookie policy.
Bring your auditor's checklist to the demo.
We answer each item and show the screen behind it. If the answer is a token, we say when it will be filled.
Your questions answered.
The things clinics ask first.
The clinic, as data fiduciary, is responsible. Saaro Health, operated by Lumotis Digital Media, is the data processor and is bound to the clinic by a data processing agreement. The DPDP page lists every obligation with its owner.
In India, in {{HOSTING_REGION}}, with encrypted backups also in India. The WhatsApp message itself travels over Meta's network once sent, as every WhatsApp message does. The data residency page has the full breakdown.
Our current independent certification status is {{CERTIFICATION_STATUS}}. We state it plainly rather than imply a certificate we do not hold. Product controls, encryption, access and audit are described on the security page regardless.
Saaro implements ABHA creation and linking, care-context linking as an HIP, consent handling and FHIR record push. Certification status with the National Health Authority is {{ABDM_CERTIFICATION_STATUS}}; the ABDM page explains the building blocks and what the clinic still registers itself.
A short list: cloud hosting, email, analytics and voice transcription, each named with function and location on the sub-processor page. WhatsApp messaging is on SaroConnect, Lumotis's own infrastructure, so there is no third-party BSP.
The status page shows what is affected and when the next update is due, support is reachable during {{SUPPORT_HOURS}}, queued messages are sent on recovery, and service credits apply if the monthly target of {{UPTIME_TARGET}} is missed. The uptime page has the detail.
Keep reading.
- FeaturesPatient recordsA record built from every visit, not a spreadsheet row. Prescriptions, reports, notes and follow-ups sit in one timeline, linked to the patient's ABHA if they have one.
- FeaturesWhatsApp automationSaaro runs on SaroConnect, Lumotis's own WhatsApp Business infrastructure. Reminders, prescriptions, reports and refills go out from your number, patient replies come back to the desk, and messaging is included in every plan.
- FeaturesMulti-clinicSaaro runs a clinic chain as one system: a shared patient index, doctors who move between branches, billing that stays separate per location, and a single view for the owner.
- TrustABDM complianceABHA creation, care-context linking, consent requests and FHIR record push happen inside the patient record. Here is what the Ayushman Bharat Digital Mission asks of a clinic, and which parts Saaro handles.
- TrustDPDP complianceConsent, notice, retention, erasure, breach reporting and grievance handling are obligations on the clinic. Here is what each one means for an OPD, and which parts the product does for you.
- TrustSecurityPatient data is encrypted in transit and at rest, seen only by the roles that need it, logged every time it is touched, and backed up so it can be restored. Here is the detail behind each of those claims.