Data Processing Agreement

Between: RehabDesk AI (the "Data Processor")
And: The subscribing clinic (the "Data Controller" / "Data Fiduciary")
Effective Date: 1 September 2026
Governing Law: India - Digital Personal Data Protection Act, 2023

Recitals

A. The Data Controller is a healthcare clinic that has subscribed to the RehabDesk AI platform to manage its clinical operations, patient records, billing, and communications.

B. In the course of providing the Service, the Data Processor will process personal data of the Data Controller's patients ("Patient Data") on behalf of and as instructed by the Data Controller.

C. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Data Controller is the Data Fiduciary for the Patient Data it collects from its patients, and the Data Processor is the Data Processor processing that data as a service provider.

D. This Data Processing Agreement ("DPA") sets out the terms under which the Data Processor may process Patient Data on behalf of the Data Controller.

E. This DPA is incorporated into and forms part of the main Terms and Conditions between the parties. In the event of conflict between this DPA and the Terms and Conditions, this DPA governs with respect to Patient Data processing.

1. Definitions

"Patient Data" means any personal data (including sensitive personal data such as health information) relating to the Data Controller's patients that is entered into, stored in, or processed through the RehabDesk AI platform.

"Sensitive Personal Data" means Patient Data that constitutes sensitive personal data under applicable law - in this context, health and medical information, financial information, and biometric identifiers (if any).

"Processing" means any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, making available, alignment, combination, restriction, erasure, or destruction.

"Sub-Processor" means any third party engaged by the Data Processor to process Patient Data on behalf of the Data Controller.

"Data Principal" means the individual to whom the Personal Data relates - in this context, the patient.

2. Scope and Nature of Processing

2.1 Categories of Data Subjects

Patients of the Data Controller, including:

• Adult patients undergoing treatment at the clinic
• Minor patients (under 18 years) registered by the clinic with appropriate parental consent
• Prospective patients who have contacted the clinic via WhatsApp or Instagram and whose contact details have been captured through the AI chatbot

2.2 Categories of Personal Data

2.3 Purpose of Processing

The Data Processor processes Patient Data solely for the following purposes:

1. Storing and managing patient records as entered by the Data Controller's staff
2. Generating tax invoices and financial records for treatments provided by the Data Controller
3. Delivering invoices to patients via WhatsApp on behalf of the Data Controller
4. Running the AI chatbot that responds to patient WhatsApp messages on behalf of the Data Controller's clinic number
5. Running the AI chatbot that responds to patient Instagram DMs on behalf of the Data Controller
6. Sending WhatsApp broadcast messages to opted-in patients on behalf of the Data Controller (using pre-approved Meta message templates)
7. Sending Google review request messages via WhatsApp to patients on behalf of the Data Controller
8. Tracking session attendance and treatment progress
9. Providing operational dashboard views to the Data Controller's authorized staff
10. Complying with applicable legal obligations (e.g., data security, audit trails)

The Data Processor shall not process Patient Data for any purpose other than those listed above without the Data Controller's prior written instruction.

3. Data Controller's Obligations

The Data Controller represents, warrants, and undertakes that:

3.1 It has a lawful basis for processing Patient Data under applicable law (including the DPDP Act) and has obtained all necessary consents from its patients or has an alternative lawful basis (e.g., healthcare treatment necessity) for each category of Patient Data entered into the platform.

3.2 It has informed its patients (through its own privacy notice or patient registration documentation) that their data is processed using RehabDesk AI as a cloud-based practice management tool.

3.3 It has obtained explicit, documented opt-in consent from patients before sending them WhatsApp marketing broadcast messages. The Data Controller maintains records of such consent and will produce them upon request.

3.4 It will promptly honour patient data principal rights requests (access, correction, deletion) received from patients, using the tools provided in the RehabDesk AI platform or by contacting the Data Processor in accordance with Clause 6.

3.5 It will only provide access to Patient Data to staff members with a legitimate clinical or operational need, and will maintain appropriate role-based access settings within the platform.

3.6 It will immediately deactivate staff accounts when those staff members leave the clinic's employment.

3.7 For minor patients, it has obtained and maintains verifiable parental or guardian consent for data collection and processing.

3.8 It will notify the Data Processor without undue delay if it becomes aware of a security breach affecting Patient Data.

4. Data Processor's Obligations

The Data Processor undertakes that:

4.1 Process only on instruction: The Data Processor shall process Patient Data only in accordance with the Data Controller's documented instructions (principally, to provide the Service as described in the Terms and Conditions). If the Data Processor is required to process data for any other purpose under applicable law, it shall inform the Data Controller of this requirement before processing, unless prohibited from doing so.

4.2 Confidentiality: The Data Processor shall ensure that all personnel authorized to process Patient Data are subject to appropriate confidentiality obligations, whether contractual or statutory.

4.3 Security measures: The Data Processor shall implement and maintain appropriate technical and organizational security measures to protect Patient Data against unauthorized access, disclosure, alteration, and destruction. Current measures include (see Privacy Policy for full details):

• AES-256 encryption at rest
• TLS 1.2+ encryption in transit
• PostgreSQL Row-Level Security (RLS) for multi-tenant data isolation
• Role-based access control at application and database layers
• Security audit logging
• Server-side storage of integration credentials (never client-exposed)

4.4 Sub-processors: The Data Processor shall not engage sub-processors to process Patient Data without informing the Data Controller. The current authorized sub-processors are listed in Clause 8. Any new sub-processor engagement will be communicated via email to the registered clinic owner with at least 30 days advance notice, and the Data Controller may object to the engagement within that period.

4.5 Data subject rights: The Data Processor shall assist the Data Controller in fulfilling its obligations to respond to Data Principals' rights requests, to the extent technically feasible, using the tools and processes described in Clause 6.

4.6 Breach notification: The Data Processor shall notify the Data Controller without undue delay (and in any event within 48 hours) after becoming aware of a personal data breach affecting Patient Data, providing sufficient information to enable the Data Controller to meet any breach notification obligations it has as Data Fiduciary.

4.7 Audit support: The Data Processor shall provide the Data Controller with all information necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits by the Data Controller or its authorized auditor, subject to reasonable notice (at least 14 days) and subject to such audit being conducted during normal business hours without unreasonable disruption to the Data Processor's operations.

4.8 Return or deletion of data: Upon termination or expiry of the main subscription agreement, the Data Processor shall, at the Data Controller's option, return or delete all Patient Data (except data required to be retained by law). See Data Deletion Policy for the applicable timelines.

4.9 Not process for own purposes: The Data Processor shall not use Patient Data for its own purposes, including product development, AI model training, marketing, or advertising. Patient data will not be shared with any third party for those parties' own purposes.

5. Multi-Tenancy and Data Isolation Guarantee

The Data Processor operates a multi-tenant platform and guarantees that:

5.1 Patient Data belonging to the Data Controller is technically isolated from data belonging to any other clinic using the platform.

5.2 This isolation is implemented through PostgreSQL Row-Level Security (RLS) policies that are enforced at the database layer - the database itself enforces that each clinic's data is accessible only to authenticated users of that clinic.

5.3 No staff member, agent, or representative of the Data Processor may access Patient Data of the Data Controller except:

• For the purpose of providing contracted support (with documented access logging)
• Where required by law (e.g., a lawful order from an Indian court or government authority)
• During a breach investigation with the Data Controller notified

6. Data Principal Rights Requests

When the Data Controller receives a rights request from a patient (Data Principal):

6.1 Access requests: The Data Controller can generate data summaries for individual patients using the patient record view in the platform. For comprehensive data exports, use the 1-click CSV export.

6.2 Correction requests: The Data Controller can correct patient records using the edit functions in the patient directory.

6.3 Deletion requests: The Data Controller can delete patient records using the delete function (30-day soft delete, then permanent purge - see Data Deletion Policy).

6.4 If the Data Controller cannot technically fulfil a rights request without Data Processor assistance, the Data Controller should contact legal@rehabdesk.app with:

• The clinic's registered email
• The nature of the rights request
• Sufficient identifying information to locate the relevant records (patient name, contact number, approximate registration date)

The Data Processor will provide the necessary assistance within 15 business days.

7. Cross-Border Data Transfers

The Data Processor uses the following infrastructure. Note that the primary database is hosted in India.

Key mitigation: Patient health records, clinical data, billing records, and all sensitive personal data are stored exclusively on servers located within India (AWS ap-south-1, Mumbai). Cross-border transfers are limited to message text via Meta and API tokens via Google - not raw clinical or financial patient data.

The Data Controller acknowledges and accepts these cross-border transfers as inherent to the nature of the Service's third-party integrations. Once the DPDP Act Section 16 whitelist is published, the Data Processor will review and update this DPA as necessary.

8. Authorized Sub-Processors

The Data Processor shall impose data protection obligations equivalent to those in this DPA on each sub-processor. In the event of a sub-processor failing to fulfil its data protection obligations, the Data Processor remains fully liable to the Data Controller.

9. Liability

9.1 Each party shall be liable for any damage caused to Data Principals or the other party as a result of that party's breach of its obligations under this DPA.

9.2 The Data Processor's total liability under this DPA, in aggregate, is limited as set out in the limitation of liability clause in the Terms and Conditions.

9.3 Nothing limits liability for a breach resulting in unauthorized access to sensitive patient health data due to the Data Processor's gross negligence or wilful misconduct.

10. Duration and Termination

10.1 This DPA remains in force for the duration of the main subscription agreement.

10.2 Upon termination of the subscription, this DPA continues to apply until the Data Processor has completed the deletion or return of Patient Data per the Data Deletion Policy.

11. Governing Law

This DPA is governed by the laws of India. Disputes arising from or related to this DPA shall be resolved in accordance with the dispute resolution provisions of the Terms and Conditions.

12. Amendments

The Data Processor may amend this DPA to reflect changes in applicable law (including new DPDP Act Rules or guidance), changes in sub-processors, or material changes to the Service. Amendments will be communicated per the process described in the Terms and Conditions.

This Data Processing Agreement was last reviewed on 1 September 2026.