Dpdp Act Compliance

Product: RehabDesk AI
Document Type: Compliance Statement and Data Principal Rights Guide
Effective Date: 1 September 2026
Last Updated: 1 September 2026
Applicable Law: India - Digital Personal Data Protection Act, 2023 ("DPDP Act")

1. Applicability and Our Dual Role

The Digital Personal Data Protection Act, 2023 applies to the processing of digital personal data of individuals ("Data Principals") in India, and to the processing of digital personal data outside India where it is done in connection with offering goods or services to individuals in India.

RehabDesk AI operates in two distinct roles under the DPDP Act:

Role 1: Data Fiduciary (for Clinic User data)

When we collect and process data of clinic owners, staff, and website visitors (email addresses, phone numbers, account information, usage data), RehabDesk AI is the Data Fiduciary - we determine the purpose and means of that processing and bear the associated obligations.

Role 2: Data Processor (for Patient data)

When clinics enter patient data (health records, clinical assessments, contact information, billing records) into our platform, the clinic is the Data Fiduciary and RehabDesk AI is the Data Processor - we process that data only as instructed by the clinic for the purpose of providing the Service. The legal obligations as Data Fiduciary for patient data sit with the clinic. Our Data Processing Agreement formalizes this arrangement.

2. Consent Framework

2.1 Consent for Clinic Users (RehabDesk AI as Data Fiduciary)

When a clinic owner or staff member registers or accepts an invitation to join the platform:

• What we collect: We record the date and time of acceptance of our Terms and Conditions and this Privacy/Compliance framework. We maintain a secure digital log of this acceptance timestamp in our database.
• Consent mechanism: At the time of account creation and onboarding, users are presented with a clear, affirmative checkbox or confirmation step to acknowledge acceptance of our Terms and Privacy Policy. Passive acceptance (pre-ticked boxes) is not used.
• Marketing consent: Separately, we collect an affirmative opt-in for promotional communications (product news, feature updates, marketing offers). This is separate from the service terms acceptance.

2.2 Consent for Patients (Clinics as Data Fiduciary)

The clinic is responsible for obtaining valid, informed consent from patients before entering their personal and health data into RehabDesk AI. Specifically, clinics must:

• Inform patients of the purpose of data collection (treatment management, billing, appointment reminders)
• Inform patients that their contact information may be used to send WhatsApp messages (invoice delivery, appointment reminders)
• Obtain explicit opt-in consent before enrolling patients in WhatsApp marketing broadcast lists
• Maintain records of consent

RehabDesk AI's platform provides:

• A marketing consent indicator field in the patient data model that clinics can use to record WhatsApp marketing consent
• The WhatsApp broadcast system filters recipients based on this field - patients without opt-in consent should not be included in marketing broadcasts

2.3 Consent Withdrawal

For Clinic Users: You may withdraw consent for marketing communications at any time by:

• Updating your preferences in Account Settings
• Contacting us at legal@rehabdesk.app
• Unsubscribing via the link in any marketing email

Withdrawal of marketing consent does not affect the lawfulness of processing before withdrawal and does not affect the processing required to provide the Service under the contract.

For Patients (via their clinic): Patients who wish to opt out of WhatsApp marketing messages from their clinic should contact the clinic directly. The clinic must honour opt-out requests and update the patient's consent status in the platform.

3. Purpose Limitation

Under the DPDP Act, personal data must be processed only for the specific purposes for which consent was given or for which there is a lawful basis.

RehabDesk AI commits to the following purpose limitations:

We explicitly do not: Sell, rent, trade, or otherwise monetize personal data.

4. Data Minimization

We collect only the personal data necessary for each specific purpose:

• Patient records include only the fields necessary for clinical management and billing (no extraneous data fields are collected)
• WhatsApp message logs store the minimum necessary content (message direction, text, status) for the 90-day compliance window
• Security audit logs record the minimum necessary information (user ID, action, timestamp, IP) for audit purposes
• Integration tokens (WhatsApp, Instagram, Google) are stored server-side only, with only non-sensitive metadata (account IDs, connection status) visible to clinic staff

5. Data Quality and Accuracy

5.1 Clinics are responsible for the accuracy of patient data they enter. The platform provides tools for clinic staff to update and correct patient records at any time.

5.2 Clinic users can update their own account information (name, email, mobile) through account settings.

5.3 If a patient informs the clinic that their data is inaccurate, the clinic should correct it using the platform's edit functions.

5.4 If a patient contacts RehabDesk AI directly regarding data inaccuracy, we will forward the request to the relevant clinic within 5 business days.

6. Data Principal Rights (Rights of Individuals)

6.1 Rights of Clinic Users (where RehabDesk AI is Data Fiduciary)

Under the DPDP Act, you as a Data Principal have the following rights with respect to your personal data that we hold:

Right to Access (Section 11, DPDP Act)

You have the right to obtain:

• Confirmation of whether we are processing your personal data
• A summary of the personal data we hold about you
• Information about the processing activities related to your data

How to exercise: Email grievance@rehabdesk.app with the subject "Data Access Request" and your full name and registered email address. We will respond within 30 days.

Right to Correction and Erasure (Section 12, DPDP Act)

You have the right to:

• Correct inaccurate personal data we hold about you
• Complete incomplete personal data
• Request erasure of your personal data that is no longer necessary for the purposes for which it was collected

How to exercise: Email grievance@rehabdesk.app with the subject "Correction/Erasure Request." For simple corrections (name, mobile number), you can update directly in Account Settings.

Note: Erasure requests are subject to legal retention obligations. For example, invoice records must be retained for 7 years. In such cases, we will explain what data can and cannot be deleted and why.

Right to Grievance Redressal (Section 13, DPDP Act)

You have the right to have your grievances related to your personal data processing addressed by our Grievance Officer.

How to exercise: Email grievance@rehabdesk.app. We will acknowledge within 48 hours and resolve within 30 days.

Right to Nominate (Section 14, DPDP Act)

You have the right to nominate any other individual to exercise your data principal rights on your behalf in the event of your death or incapacity.

How to exercise: Email grievance@rehabdesk.app with the subject "Nomination Request" with details of the nominee.

6.2 Rights of Patients (where Clinic is Data Fiduciary)

Patients must contact their clinic directly to exercise rights regarding their health and billing data, as the clinic is the Data Fiduciary. However:

• If the clinic fails to respond to a patient's data rights request within 30 days, the patient may escalate to RehabDesk AI at grievance@rehabdesk.app.
• RehabDesk AI will attempt to facilitate the request where technically possible.
• Patients may ultimately escalate unresolved grievances to the Data Protection Board of India once constituted.

7. Data Fiduciary Obligations (Our Obligations as Data Fiduciary for Clinic User Data)

In accordance with Section 8 of the DPDP Act, RehabDesk AI as Data Fiduciary commits to:

7.1 Completeness, accuracy, and consistency: Maintaining the personal data of clinic users that we process to the extent necessary and for the duration necessary.

7.2 Reasonable security safeguards: Implementing appropriate technical and organizational measures to protect personal data (see Privacy Policy Section 9 for details).

7.3 Breach notification: Notifying the Data Protection Board of India and affected Data Principals in the event of a personal data breach, as soon as reasonably possible and in accordance with applicable DPDP Act rules, once those rules are finalized. See Section 9 of this document for our breach response process.

7.4 Grievance redressal: Maintaining a Grievance Officer and a functioning grievance redressal mechanism.

7.5 Processing children's data with care: Obtaining verifiable parental consent before processing data of children under 18 years, for data we directly collect through the marketing website. For patient data (clinics' patients), clinics are responsible for obtaining appropriate consent for minor patients.

8. Significant Data Fiduciary Considerations

If RehabDesk AI is designated as a Significant Data Fiduciary by the Government of India under DPDP Act Section 10 (based on volume of data processed, sensitivity of data, or other criteria), we will additionally comply with:

• Appointment of a Data Protection Officer
• Periodic Data Protection Impact Assessments
• Periodic audits by an independent data auditor
• Registration with the Data Protection Board of India

As of the effective date of this document, we have not been designated as a Significant Data Fiduciary. We will update this document if designated.

9. Data Breach Response Process

9.1 Detection and Assessment

In the event of a suspected personal data breach (unauthorized access, disclosure, alteration, or destruction of personal data), our response process is:

Hour 0-2: Incident detected via security monitoring, staff report, or third-party notification.
Hour 2-24: Internal incident response team assesses the scope and nature of the breach. Affected systems isolated where necessary.
Hour 24-72: Forensic investigation to confirm breach, identify affected records, and determine cause.

9.2 Notification

Regulatory Notification: We will notify the Data Protection Board of India (or the relevant authority) of a qualifying breach within the timeframe prescribed by DPDP Act Rules, once those Rules are finalized. Until the Rules are finalized, we will notify within 72 hours of confirming a breach, consistent with international best practice.

Affected Individual Notification: We will notify affected individuals (clinic owners and/or the relevant clinic whose patient data may be affected) as soon as reasonably possible after confirming the nature and scope of the breach. Notification will include:

• Nature of the breach
• Categories of data affected
• Approximate number of individuals affected
• Measures taken to address the breach
• Contact details for further information

Special Consideration - Patient Data Breach: If patient health data is involved in a breach, the clinic (as Data Fiduciary for patient data) will also be notified immediately so they can inform their patients. RehabDesk AI will assist clinics in understanding the scope of the breach and in drafting patient notifications.

WhatsApp/Instagram Breach: If a breach involves data that has passed through or is stored in WhatsApp/Instagram infrastructure (Meta), we will also notify Meta per our contractual obligations and work with Meta's security team on the response.

9.3 Remediation

Following a breach:

• Immediate patching of the security vulnerability
• Review of RLS policies and access controls
• Enhanced monitoring of the affected systems
• Internal post-incident review and documentation
• Policy updates as necessary

10. Cross-Border Data Transfers

See Privacy Policy Section 10 for full details. In summary:

• Patient and clinic data is stored in India: Our primary database is on Supabase-hosted AWS infrastructure in the South Asia (Mumbai) region (ap-south-1). Patient health records, clinical data, invoices, and audit logs do not leave India.
• Remaining cross-border transfers: Message content flows through Meta (USA/Global) for WhatsApp/Instagram, and Google (USA/Global) for GMB API. These transfers involve message text and OAuth tokens - not raw patient health data.
• The DPDP Act Section 16 country whitelist has not yet been published. The remaining Meta/Google transfers will be reviewed for compliance once the whitelist is finalized.
• We maintain data processing agreements with Supabase, and rely on Meta and Google's published compliance frameworks for transfers to those platforms.

11. Grievance Redressal Contact

In accordance with Section 13 of the DPDP Act and Rule 7 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, we provide the following grievance redressal contact:

Grievance Redressal Contact
Organization: RehabDesk (Krishnam Rastogi, Proprietorship)
Email: grievance@rehabdesk.app
Postal Address: 338C/1C/1, 60 Feet Harsh Nagar Road, Meera Pur, Prayagraj, Uttar Pradesh - 211003, India
Response Commitment: Acknowledge within 48 hours, resolve within 30 days

In Progress: The DPDP Act requires a formally designated, named Grievance Officer. We are in the process of making this appointment. Until then, grievance@rehabdesk.app is monitored and handled directly by the founding team. This section will be updated with the officer's name and designation once appointed.

If your grievance is not resolved satisfactorily within 30 days, you may escalate to the Data Protection Board of India once the Board is constituted under the DPDP Act.

12. Updates to This Compliance Statement

The DPDP Act framework, including rules, sector-specific guidelines, and the Data Protection Board's guidance, is evolving. We commit to:

• Reviewing this compliance statement at least once every 6 months
• Updating this document when significant DPDP Act Rules or guidelines are published
• Notifying clinic owners of material changes to our compliance practices via email

This DPDP Act Compliance Statement was last reviewed on 1 September 2026.
This document does not constitute legal advice. It is a compliance statement describing our data protection practices.