Clinicea Compliance with DPDP Act (India)
Clinicea and India's DPDP Act, 2023
Last updated: 30 September 2026
Clinicea is compliant with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 in its role as your Data Processor. This article explains where your data is hosted, how it is protected, and how Clinicea helps your clinic meet its own obligations under the Act.
At a glance
- Your role: your clinic is the Data Fiduciary. Clinicea Healthcare India Pvt. Ltd. is your Data Processor.
- Contract: a Data Processing Agreement (DPA) covers our processor obligations.
- Hosting: Microsoft Azure, Southeast Asia region (Singapore). The DPDP Act permits this.
- Security: encryption in transit and at rest, MFA, Web Application Firewall, annual VAPT.
- Breach notice: we notify your clinic within 24 hours of confirming a breach affecting your data.
- Patient rights: export, correction, deletion, consent capture and guardian details are built into Clinicea.
Who is responsible for what
The DPDP Act separates the organisation that decides why data is collected from the one that processes it on their behalf.
Role | Who | What it means |
|---|---|---|
Data Principal | Your patient | The person the data is about |
Data Fiduciary | Your clinic | Decides why and how patient data is used; collects consent; answers patient requests |
Data Processor | Clinicea Healthcare India Pvt. Ltd. | Processes patient data only on your clinic's instructions, and keeps it secure |
Our obligations as your processor are set out in our Data Processing Agreement. It covers confidentiality, security safeguards, breach notification, use of sub-processors, and return or deletion of data when the contract ends. |
Where your data is hosted
All data for Indian clinics is hosted on Microsoft Azure in the Southeast Asia region (Singapore). This includes your live database, files and backups.
- Primary data: Azure Southeast Asia (Singapore).
- Backups: stored in the same Singapore region.
- Test environments: use separate test data, never copies of your patients' records.
- No other regions: data for Indian clinics is not processed or replicated in any other country.
Is hosting in India mandatory? No. Section 16 of the DPDP Act allows personal data to be transferred outside India, except to countries the Central Government specifically restricts by notification. Singapore is not restricted. The DPDP Rules, 2025 confirm this approach. Mandatory in-India storage applies only to specific data that the government notifies for Significant Data Fiduciaries, a category designated for very large data handlers. It does not apply to clinics using Clinicea.
Clinicea currently offers hosting in the Singapore region only.
Sub-processors and integrations
Clinicea uses a small number of sub-processors to run the service. Each is bound by contract to protect your data.
Sub-processor | Purpose |
|---|---|
Microsoft Azure | Hosting, database, file storage and backups |
Cloudflare | Web Application Firewall, DNS and traffic protection |
Freshdesk | Customer support ticketing |
Integrations your clinic chooses to enable are not Clinicea sub-processors. For these, your clinic signs up directly with the provider, under that provider's own terms, and connects its account to Clinicea. Examples include: |
- Payment gateways such as Stripe, Razorpay and Authorize.net
- Video consultations such as Zoom
- Telephony and call centre services such as SuperReceptionist and TeleCMI
- WhatsApp Business messaging and Google Calendar sync
Because your clinic holds the contract with these providers, it should review their privacy terms before connecting them.
How we protect your data
The DPDP Rules require reasonable security safeguards to prevent personal data breaches. Clinicea has the following in place.
Encryption
- All connections use TLS 1.2 or higher, with TLS 1.3 on our web tier. Our site holds an SSL Labs A+ rating.
- Databases and file storage are encrypted at rest.
- Passwords are stored using PBKDF2 hashing, and checked against known breached-password lists.
Access control
- Multi-factor authentication is enforced for all administrative access to our cloud infrastructure.
- Application secrets are held in Azure Key Vault and accessed through managed identities, not stored in code.
- Clinicea support staff access your clinic's data only with your permission, and that access is logged.
Network and application protection
- A Cloudflare Web Application Firewall filters malicious traffic before it reaches our servers.
- A Content Security Policy is enforced to protect against script injection.
- We carry out Vulnerability Assessment and Penetration Testing (VAPT) every year. The latest was completed in September 2026.
Backup and recovery
- Databases are backed up automatically.
- Restores are tested. Our last test restored the full production database in about 38 minutes.
People
- All staff sign confidentiality agreements and receive privacy and security training.
- We are working towards the Cyber Essentials certification from the Cyber Security Agency of Singapore.
Features that help your clinic comply
Clinicea includes the tools your clinic needs to meet its obligations as a Data Fiduciary.
DPDP obligation | How Clinicea helps |
|---|---|
Consent and withdrawal of consent | Digital consent forms, marketing opt-outs for SMS and WhatsApp, and consent timestamps |
Right to access | Export a patient's full record; patients can view and download their own data through the Patient Portal add-on |
Right to correction and erasure | Edit patient records, or permanently delete a patient when required |
Children's data | Record parent or guardian details on a patient's file |
Access control | Role-based permissions for each staff user, and two-factor authentication that your clinic can enforce |
Accountability | An audit trail of who viewed or changed a patient record |
Security | Automatic logout of idle sessions |
Before deleting a patient's record, check your medical-records retention obligations. Other laws may require you to keep clinical records for a set period, and the DPDP Act allows retention where another law requires it. |
If a breach happens
Clinicea will notify your clinic within 24 hours of confirming a personal data breach that affects your data. This gives your clinic time to meet its own duty to inform the Data Protection Board of India and affected patients, with a detailed report due to the Board within 72 hours.
We follow a documented incident response plan. Our notice to you will describe what happened, the data affected, the likely impact, and the steps we are taking. We will support your clinic with the information it needs for its own reports.
Data retention and leaving Clinicea
- During your contract: your data is kept for as long as your clinic uses Clinicea, and your clinic decides what to retain or delete.
- When your contract ends: we provide an export of your data on request. We then delete your data within 90 days, and it ages out of backups within 7 days.
- Inactive and trial accounts: these are deleted automatically after a period of inactivity.
Your responsibilities as the clinic
As the Data Fiduciary, your clinic remains responsible for how patient data is collected and used. Clinicea gives you the tools; your clinic needs to use them.
- Give patients a clear privacy notice explaining what data you collect and why.
- Obtain consent where required, and honour withdrawals of consent.
- Respond to patient requests for access, correction or erasure within 90 days.
- Enable two-factor authentication and give each staff member only the access they need.
- Remove access promptly when staff leave.
- Report personal data breaches to the Data Protection Board of India and affected patients.
- Review the privacy terms of any third-party integration before connecting it.
- Publish a contact for patients to raise privacy concerns with your clinic.
Most DPDP obligations take full effect on 13 May 2027. We recommend putting these practices in place now.
Frequently asked questions
Is Clinicea DPDP compliant? Yes. Clinicea meets its obligations as a Data Processor under the DPDP Act and DPDP Rules, 2025, and supports your clinic in meeting its obligations as a Data Fiduciary.
Does my patients' data have to be stored in India? No. The DPDP Act permits transfer of personal data outside India, except to countries the government restricts. Singapore is not restricted.
Is there an official DPDP certificate? No. The DPDP Act and Rules do not create a government-issued certificate of compliance. Be cautious of any "DPDP certified" claims. Compliance is shown through contracts, security controls and documented practices.
Can I get a Data Processing Agreement? Yes. Contact us and we will share our DPA for your clinic to sign.
Does Clinicea access my patient data? Only when your clinic gives permission, for example to resolve a support request. All such access is logged.
What happens to my data if I stop using Clinicea? We provide an export on request, then delete your data within 90 days.
Contact
For privacy questions, DPA requests or grievances, contact our Data Protection Officer:
- Dibyendu Shome, Data Protection Officer, Clinicea Healthcare India Pvt. Ltd.
- Email: dpo@clinicea.com
Read more in our Privacy Policy and Terms and Conditions.
Updated on: 30/09/2026
Thank you!