01.Corporate Structure & Commercial Entity Scope
This Privacy Policy establishes the terms and protocols governing the collection, storage, processing, transfer, and safeguarding of data within the MedOpera healthcare management platform.
MedOpera is a proprietary software-as-a-service (SaaS) product conceived, engineered, copyrighted, and operated exclusively by DigiOpera Private Limited (“Company”, “we”, “us”, or “our”), a private limited company duly incorporated under the provisions of the Companies Act, 2013, with its registered corporate office at Gurugram, Haryana, India.
All commercial agreements, software licensing agreements, data processing addenda, service level agreements (SLAs), tax invoices, GST billing, and banking remittances are issued and transacted exclusively in the corporate name of DigiOpera Private Limited. MedOpera has no distinct legal corporate existence separate from DigiOpera Private Limited.
02.Data Fiduciary (Controller) vs. Data Processor Architecture
In strict accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable international privacy regimes (such as the GDPR and HIPAA where applicable):
- The Healthcare Establishment as Data Fiduciary (Data Controller): The hospital, medical college, nursing home, clinic, diagnostic imaging center, or standalone pathology laboratory subscribing to MedOpera (“Subscriber”, “Hospital”, or “Healthcare Provider”) operates as the primary Data Fiduciary. The Hospital maintains sole ownership, clinical custody, and ethical control over the patient records, clinical charts, diagnostic interpretations, and financial accounts generated within its dedicated tenant.
- DigiOpera Private Limited as Data Processor: DigiOpera Private Limited serves solely as a Data Processor. We host, compute, index, backup, and transmit digital records exclusively in accordance with the documented authorizations, clinical configurations, and authenticated workflows directed by the Hospital. We do not claim ownership, commercialize, rent, broker, or exploit any Protected Health Information (PHI) or patient records for advertising or third-party marketing purposes.
03.Categories of Data Processed Within the Platform
MedOpera processes several distinct tiers of organizational and health information:
Full name, age, biological sex, guardian details, government identifier (Aadhaar/PAN where voluntarily furnished), ABHA Address, ABHA Number, residential address, emergency contact numbers, and photo identification.
Chief clinical complaints, recorded vitals (BP, SpO2, Pulse, BMI), ICD-10 diagnostic codes, electronic prescriptions, nursing shift logs, OT anaesthesia notes, clinical discharge summaries, and allergy alerts.
Clinical pathology analyzer results (ASTM/HL7 raw output), microbiology culture reports, digital DICOM imaging files (X-Ray, CT, MRI, Ultrasound), and authorized pathologist/radiologist electronic signatures.
Clinician registration numbers (NMC/State Council), staff roles, authenticated login IP addresses, cryptographic session hashes, physical denomination tally logs, and immutable audit journal entries.
04.Lawful Purpose & Clinical Processing Scope
All data ingested, indexed, and evaluated by MedOpera is processed under valid lawful grounds recognized under Section 4 and Section 7 of the DPDP Act 2023, namely:
- Direct Provision of Medical Care: Facilitating outpatient consultations, automated inpatient bed census allocation, emergency triage, and surgical scheduling.
- Patient Clinical Safety Gates: Running automated, real-time safety verifications such as drug-allergy contraindication warnings, QTc prolongation arrhythmogenic hard-locks, and Look-Alike Sound-Alike (LASA) drug alerts.
- Statutory Healthcare Obligations: Maintaining mandatory institutional medical records under the Clinical Establishments Act, state nursing home regulations, and Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations.
- Revenue & Insurance Settlement: Compiling GST-compliant hospital invoices, processing cashless insurance pre-authorizations with Third Party Administrators (TPAs), and auditing cashier shift cash tallies.
05.Ayushman Bharat Digital Mission (ABDM) Integration
MedOpera is engineered in compliance with the National Health Authority (NHA) standards for Ayushman Bharat Digital Mission (ABDM) Milestone 1 (M1), Milestone 2 (M2), and Milestone 3 (M3) architectures:
• Voluntary Patient Consent Artifacts: Health data sharing across ABDM-linked Health Information Providers (HIP) and Health Information Users (HIU) occurs strictly on the basis of digitally signed consent artifacts issued through patient-approved Health Record (PHR) applications.
• FHIR R4 Interoperability: Electronic medical summaries, laboratory reports, and prescription bundles are converted into standard HL7 FHIR (Fast Healthcare Interoperability Resources) structured profiles prior to transmission across the ABDM Unified Health Interface (UHI).
• Zero Long-Term External Caching: ABDM gateways transiting health information through MedOpera utilize end-to-end ephemeral public-key cryptography (Diffie-Hellman / ECDH). DigiOpera Private Limited does not inspect or permanently intercept transited records outside the subscribed hospital’s secure storage boundaries.
06.Statutory Healthcare Registers (PCPNDT & CDSCO)
Certain specialized modules within MedOpera collect and maintain statutory registries mandated by Indian healthcare legislation:
- PCPNDT Act Statutory Compliance: For ultrasound, fetal medicine, and diagnostic radiology installations, MedOpera records mandatory Form F declarations, referring doctor details, invasive test indications, and ultrasound machine serial identifiers under the Pre-Conception and Pre-Natal Diagnostic Techniques Act, 1994. These records are stored in an append-only, tamper-evident partition accessible exclusively during official inspections by appropriate government authorities.
- CDSCO Schedule H1 & Schedule X Registers: Pharmacy transactions involving narcotic preparations, habit-forming drugs, and Schedule X formulations mandate dual clinician/pharmacist verification signatures, capturing doctor registration numbers and patient identification in compliance with the Drugs and Cosmetics Rules, 1945.
07.Medical Record Retention, Archiving & Purging
Unlike generic commercial software, hospital electronic health records are subject to strict statutory retention periods under Indian medical law:
| Record Category | Minimum Mandatory Retention | Governing Authority / Guideline |
|---|---|---|
| Outpatient (OPD) Consultations | 3 Years | NMC / Medical Council of India Guidelines |
| Inpatient (IPD) Admissions | 5 Years (Recommended 10 Years) | NABH Accreditation Standards |
| Medico-Legal Cases (MLC) | Permanent / Case Disposal | Bharatiya Nagarik Suraksha Sanhita (BNSS) / Courts |
| Diagnostic Radiology (Ultrasound Form F) | 2 Years | PCPNDT Rules, 1996 |
| Commercial Invoices & Tax Ledgers | 8 Financial Years | CGST Act, 2017 & Income Tax Act, 1961 |
DigiOpera Private Limited enforces automated cold-storage archiving after active clinical validity has expired. Data purging is executed only upon written authorization from the hospital’s designated Medical Superintendent or Authorized Signatory.
08.Data Sovereignty & Indian Cloud Hosting
DigiOpera Private Limited complies rigorously with Indian data sovereignty directives issued by the Ministry of Electronics and Information Technology (MeitY) and the National Health Authority:
• Geographic Residency: All production databases, clinical object stores, backup snapshots, and disaster-recovery replication targets are located in Tier-IV, MeitY-empaneled enterprise data centers physically situated within the Republic of India (Mumbai / Hyderabad / Bengaluru regions).
• No Cross-Border Routing: Patient medical records, genomic data, and hospital financial records generated by Indian healthcare establishments are strictly barred from cross-border replication or transit to foreign jurisdictions without explicit statutory clearance.
09.Technical Safeguards & Cryptographic Protocols
MedOpera applies defense-in-depth architectural safeguards to protect healthcare records:
- Encryption at Rest: All PostgreSQL relational tables, patient MPI directories, laboratory results, and S3-compatible document stores are encrypted using AES-256-GCM with hardware security module (HSM) key rotation.
- Encryption in Transit: All HTTP traffic between client web browsers, hospital workstation terminals, auto-analyzers, and backend APIs is enforced via TLS 1.3 / HTTPS with Strict-Transport-Security (HSTS) headers.
- Logical Multi-Tenant Separation: Tenants are strictly segregated using PostgreSQL Row-Level Security (RLS) policies and tenant-scoped connection interceptors. No hospital tenant can query, access, or manipulate records belonging to another establishment.
- Granular Role-Based Access Control (RBAC): Hospital personnel are restricted strictly to least-privilege roles (e.g. Receptionist cannot access pathology analyzers; Staff Nurses cannot approve financial discounts; Junior Doctors cannot authorize discharge without consultant clearance).
10.Incident Response & CERT-In Protocol Adherence
In the event of a verified cybersecurity event, unauthorized data exfiltration, or infrastructure compromise:
DigiOpera Private Limited complies with the Indian Computer Emergency Response Team (CERT-In) Cyber Security Directions. Confirmed cyber incidents involving sensitive systems will be reported to CERT-In within the mandated 6-hour reporting window of detection.
Subscribed hospitals whose tenant databases are affected will be formally notified within 24 hours of technical confirmation, along with full forensic telemetry, containment measures, and remediation advisories.
11.Rights of Data Principals (Patients & Clinicians)
Under the DPDP Act 2023, individual patients and hospital personnel whose personal data is processed within MedOpera possess specific legal rights:
- Right of Summary & Confirmation: Patients may request a consolidated summary of their personal and health data held within the hospital’s MedOpera instance through their authenticated ABHA PHR portal or hospital medical records department.
- Right of Correction: Patients may seek rectification of inaccurate demographic details. Note: In accordance with medical ethics standards, past clinical entries and signed medical notes cannot be modified post-finalization; necessary clinical amendments are recorded as dated supplementary addenda.
- Right of Grievance Redressal: Data principals may escalate unresolved data protection concerns directly to the Grievance Officer designated by DigiOpera Private Limited.
12.Grievance Officer & Legal Communication
Pursuant to Section 8(10) of the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the details of the designated Data Protection & Grievance Officer for DigiOpera Private Limited are set out below: