Data Processing Agreement
This Agreement forms part of the Terms between the Clinic and StomaGrid Tech Unit ("StomaGrid"), Plot no.20, Saptshrungi Bungalow, Jawahar Bakery Road, Dhankwadi, Pune, Maharashtra, 411043.
1. Roles
The Clinic decides why and how patient data is processed and is responsible for giving patients notice and obtaining any consent the law requires. StomaGrid processes patient data only on the Clinic's documented instructions, which are given by using and configuring the service.
2. Subject matter, duration and purpose
Provision of the StomaGrid service for the subscription term and the 30-day export window after it. Processing covers storing records, charting, billing, messaging, file storage, AI-assisted notes and voice call handling.
3. Data and people concerned
Patients (identity, contact, dental and medical history, images, prescriptions, billing), clinic staff (name, role, sign-in details) and callers to the AI voice receptionist (number, audio, transcript).
4. StomaGrid's obligations
- Process data only on the Clinic's instructions.
- Keep personnel bound to confidentiality.
- Apply reasonable security safeguards: separation between clinics, access control, encryption in transit and an audit log.
- Use sub-processors only under written terms, and list them on this page.
- Help the Clinic respond to requests from patients (data principals).
- Notify the Clinic of a personal data breach without undue delay and within the timelines the law requires.
- At the end of the term, allow export for 30 days, then delete on a verified request, except where the law requires retention.
- Not use patient data for its own marketing.
- Require its AI providers not to use clinic data to train their models.
5. The Clinic's obligations
Give patients the notices and obtain the consents the law requires; keep data accurate; give only lawful instructions; manage its authorised users; and decide which features (messaging, AI, voice) to switch on.
6. Sub-processors
| Provider | Purpose |
|---|---|
| Cloudflare | Website hosting and edge services |
| Supabase | Primary database |
| Drive vault in the Clinic's own Google account; Gemini AI | |
| Meta | WhatsApp messages |
| Telegram | Alerts to the Clinic and StomaGrid |
| Razorpay | Payments for StomaGrid subscriptions |
| SMS and email providers | Failover messages and notices |
| Sarvam, Bolna | AI voice receptionist (only if subscribed) |
Primary database hosted in India; AI, WhatsApp and Telegram providers process data outside India. Other providers may process data in or outside India. We will update this list before adding a sub-processor.
7. Data principal requests and complaints
StomaGrid forwards requests it receives from patients to the Clinic and helps the Clinic respond. Complaints about StomaGrid can go to the Grievance Officer.
8. Liability and law
Liability follows the Terms. This Agreement is governed by the laws of India; the courts at Pune, Maharashtra, India have exclusive jurisdiction.