Data Processing Agreement

Reusable processor DPA template clauses and per-hospital signing tracker (DPDP §8 / Rule 6)

Backup / restoreFacilitiesCERT-InBreachUAT checklist

Hospital = Data Fiduciary; MeevaMed = Data Processor under a valid contract. This page is a clause/signing tracker only — counsel-reviewed PDF and live e-sign remain Blocked.

Template

DPA-v0.1-stub

Close clause gaps

Clauses ready

0/8

Data Processor (SaaS HMS vendor)

Countersigned

0/5

0 sent

Active sites covered

No

0 signed · 3 active
Template incompleteActive sites incompleteData Fiduciary (hospital / chain)

Template metadata

Template clauses

Mark Ready only after counsel draft covers the clause — stub statuses are not legal advice.

ClauseStatus
Scope & purpose limitation
Named data categories; ban on model training without separate consent.
Draft
Instructions-only processing
Processor acts only on documented hospital instructions (DPDP §8).
Draft
Rule 6 security safeguards
Encryption, access control, logging, backup/recovery; ≥1 year log retention.
Draft
Sub-processor approval
Cloud host, SMS gateway, backup vendor — equivalent obligations + approval.
Missing
Breach notification to fiduciary
Immediate alert to hospital so they can meet 72h Board + CERT-In clocks.
Draft
Audit rights
Hospital (and regulators) may audit processor controls.
Missing
Certified deletion on termination
Return/delete PHI and confirm in writing on contract end.
Draft
Indemnity sized to DPDP exposure
Counsel must size vs ₹200–250 Cr fiduciary penalty — not 12-month fees cap.
Missing

Per-facility signing

Advance: not started → sent → countersigned → expired/renew. Requires all clauses Ready.

FacilityStatusSignatoryAction
MeevaMed Whitefield
FAC-WF-001 · Bengaluru · active
Not started
MeevaMed Yelahanka
FAC-YH-002 · Bengaluru · active
Not started
MeevaMed Hosur Road
FAC-HR-003 · Bengaluru · active
Not started
MeevaMed Indiranagar
FAC-IN-004 · Bengaluru · setup
Not started
MeevaMed Hitech City
FAC-HY-005 · Hyderabad · setup
Not started