Back to Home

Privacy Policy & Data Protection Charter

Compliant with the Digital Personal Data Protection (DPDP) Act, 2023 & Ayushman Bharat Digital Mission (ABDM)

Statutory Compliance Version 2.4 — Updated October 2026

1. Introduction & Statutory Commitment

ORCA OS ("Orca OS", "One Cerebro", "we", "our", or "us") operates an enterprise-grade Clinical Operating System and Electronic Medical Records (EMR) platform for healthcare providers. We are committed to protecting the privacy, confidentiality, and security of patient Protected Health Information (PHI) and personal data in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the Dental Council of India (DCI) Regulations, and the National Medical Commission (NMC) Telemedicine Practice Guidelines.

2. Roles Under DPDP Act 2023

  • Data Fiduciary: The respective healthcare provider or registered dental clinic using ORCA OS is the primary Data Fiduciary determining the purpose and means of clinical data collection.
  • Data Processor: ORCA OS acts as a secure Data Processor providing cryptographic storage, idempotent synchronization, and digital charting tools on behalf of the Data Fiduciary.
  • Data Principal: The patient or legal guardian whose personal and health data is processed.

3. Categories of Data Collected

Personal Identifiers

Name, verified phone number, email address, residential address, emergency contact, and age/date of birth.

Clinical & Health Records

Interactive 32-tooth odontogram, systemic risk flags (MRONJ, bleeding risks), allergies, digital e-prescriptions, vitals, and autoclave sterilization tracking.

ABDM Health Identifiers

14-digit Ayushman Bharat Health Account (ABHA) number and ABHA address, encrypted with AES-GCM-256.

Audit & Telemetry Trails

Immutable timestamps, authenticated staff user ID, IP address, and cryptographic operation IDs to prevent unauthorized tampering.

4. Protection of Minors & Pediatric Patients (Section 9)

In compliance with Section 9 of the DPDP Act 2023, ORCA OS enforces verifiable parental or lawful guardian consent prior to processing the personal data of any individual below 18 years of age. Pediatric health records require the designation of a verified parent/guardian contact, and our platform strictly prohibits behavioral tracking, targeted profiling, or advertisement generation directed at minors.

5. Data Principal Rights

Under Chapter III of the DPDP Act 2023, every patient possesses the following rights:

Right to Access (Section 11):

Request a complete summary of personal data and clinical history processed, accessible anytime via the Patient Passport portal.

Right to Correction & Erasure (Section 12):

Request correction of inaccurate information or erasure of non-clinical data. Clinical records are retained for statutory periods (minimum 3 years) as mandated under Dental Council and NMC ethical regulations (DPDP Section 17 legal obligation exemption).

Right of Grievance Redressal (Section 13):

Access to a designated Grievance Officer and Data Protection Officer with resolution timelines guaranteed within 14 business days.

Right to Nominate (Section 14):

Designate an emergency nominee to exercise rights in the event of medical death or physical incapacity.

6. Technical & Organizational Security Safeguards

  • AES-GCM-256 Field Encryption: All sensitive health identifiers (ABHA numbers, contact details) are encrypted in transit and at rest.
  • PostgreSQL Row Level Security (RLS): Strict multi-tenant isolation ensuring clinic staff can only access records within their explicit clinic workspace.
  • Offline Zero-Knowledge Caching: Local IndexedDB tables with cryptographic session locking and master PIN authentication.
  • Bot & Anti-Automation Mitigation: Realtime keystroke deliberation and headless driver detection preventing automated credential stuffing or data exfiltration.
  • Geographic Data Localization: All database servers, backups, and audit facilities reside strictly within certified Indian data centers (MeitY empanelled).

7. Data Protection Officer (DPO) & Grievance Contact

For any inquiries, consent withdrawals, data access requests, or grievance submissions under the Digital Personal Data Protection Act, please contact our designated Data Protection Officer:

Grievance & Data Protection Office

ORCA OS Technologies / HealthFlo Regulatory Operations

dpo@onecerebro.com | legal@onecerebro.com

Statutory Response Window: Within 7 to 14 Business Days

If your grievance remains unresolved after escalation, you possess the statutory right to file a formal complaint before the Data Protection Board of India (DPBI).