Data Processing Addendum (DPA)
Contractual Data Protection Framework Governing Enterprise Clients, Hospitals, Colleges, and Clinic Deployments
1. Roles of the Parties
Under this DPA, the Client is the Data Fiduciary (or Data Controller) and determines the purpose and lawful basis for processing personal data. Tech Potentia acts strictly as the Data Processor, processing personal data solely in accordance with the Client's documented written instructions and the terms of the underlying agreement.
2. Scope & Processing Instructions
Tech Potentia shall process Customer Personal Data exclusively for the performance of the software development, hosting, API integration, or maintenance services stipulated in the applicable SOW. Tech Potentia shall not process, retain, or disclose Customer Personal Data for any other purpose, nor utilize it to train public artificial intelligence models.
3. Confidentiality & Security Measures
Tech Potentia ensures that all personnel authorized to process Customer Personal Data are bound by enforceable confidentiality obligations. Tech Potentia implements technical and organizational measures (detailed in Schedule B) including TLS 1.3 encryption, AES-256 storage encryption, and strict role-based access control.
4. Subprocessors
The Client grants general written authorization to Tech Potentia to engage subprocessors to provide infrastructure, compute, and communications services. Current approved subprocessors are listed on our public Subprocessor Directory. Tech Potentia imposes contractually equivalent data protection obligations on all subprocessors.
5. Data Incidents & Notification
In the event of a verified personal data breach impacting Customer Personal Data, Tech Potentia shall notify the Client without unreasonable delay (and within 48 hours of confirmation), providing sufficient information to enable the Client to fulfill its statutory reporting obligations to the Data Protection Board of India or relevant supervisory authorities.
6. Return & Deletion of Data
Upon termination of the Services or written request by the Client, Tech Potentia shall securely delete or return all Customer Personal Data, unless statutory Indian law requires continued retention (e.g. accounting records or cybersecurity log retention).
Contractual Schedules
Schedule A — Details of Processing
Subject Matter: Provision of custom software engineering, platform hosting, and clinical suite tools.
Duration: Term of the underlying SOW / agreement plus post-termination deletion window.
Categories of Data Principals: Client employees, end-users, medical students, doctors, and patients.
Categories of Personal Data: Names, contact info, login credentials, project data, and clinical notes.
Schedule B — Technical & Organizational Measures
Encryption: Enforced TLS 1.3 in transit and AES-256 for all stored database records and backups.
Access Control: MFA required for all administrative access; least-privilege RBAC architecture.
Audit Logging: Centralized immutable audit logs maintained for all production infrastructure.
Schedule C — Authorized Subprocessors
All authorized cloud hosting, database, email, and payment subprocessors are maintained dynamically on our live Subprocessor List.