Data Processing Agreement (DPA)

1. Scope & Licence Grant

This DPA applies to all processing of Patient Personal Data, medical audio, and consultation records initiated by the Customer through the Eldovian Simplify platform.

Subject to the terms of this Agreement, Eldovian Technologies grants the Clinician a limited, non-exclusive, non-transferable, revocable licence to access and use Eldovian Simplify solely for participating in the beta pilot program during the Pilot Duration (30 days from signup/signing). This licence does not include any right to sublicense, resell, or otherwise make the platform available to third parties. Eldovian Technologies reserves the right to suspend or revoke access at any time if the platform is accessed in breach of this Agreement.

2. Nature of Product — Beta Software

The Clinician acknowledges and agrees to the following conditions regarding the platform's development status:

• Beta Status: Eldovian Simplify is beta software and is not a finished, commercially released product. It may contain bugs, errors, or incomplete features.
• Assistive Nature Only: AI-generated clinical notes and transcriptions may contain inaccuracies. The platform must not be used as a substitute for professional medical judgment.
• No Clinical Warranty: Eldovian Technologies provides no warranty, express or implied, regarding the accuracy, completeness, or fitness of any AI-generated output for clinical use.
• Clinical Responsibility: The Clinician retains full, final, and sole clinical and medical responsibility for all patient care decisions, diagnoses, treatments, and patient outcomes, regardless of any output generated by the platform.

3. Data Roles — DPDP Act 2023 (India) & HIPAA

This agreement assigns data roles in accordance with the Digital Personal Data Protection Act 2023 (India) and HIPAA:

• Data Fiduciary / Covered Entity: The Clinician — determines the purpose and means of processing patient data within their clinical practice.
• Data Processor / Business Associate: Eldovian Technologies — processes patient data solely on the instruction and behalf of the Clinician to generate clinical notes and transcriptions.
• Data Principals: The Clinician's patients, whose personal health data is processed.

Implementing Rules: Eldovian Technologies has implemented technical and organizational measures in compliance with the Digital Personal Data Protection Act 2023 as currently in force, including data localization via Supabase (hosted on AWS ap-south-1, Mumbai), application-level encryption of all clinical data, and a no-audio-retention policy. If the Central Government issues further implementing rules or notifications under the Act, both parties agree to review and update their respective obligations in good faith to ensure continued compliance.

3.2 No Joint Fiduciary Status: The parties acknowledge and agree that Eldovian Technologies acts strictly as a Data Processor and not as a Joint Data Fiduciary. Eldovian Technologies does not determine the purposes or means of processing personal data. The Clinician shall have sole control and responsibility over the collection of patient data, obtaining valid informed consents, and managing patient rights under the DPDP Act 2023. The Clinician shall defend, indemnify, and hold Eldovian Technologies harmless from any claims, liabilities, or penalties arising out of any determination by a court or regulator that Eldovian Technologies acts as a Joint Data Fiduciary due to the Clinician's failure to comply with its obligations under the DPDP Act 2023.

4. Strict Processing Commitments & Security

Eldovian Technologies covenants and agrees to adhere to the following data processing obligations:

• Purpose Limitation: Process patient data only for the purpose of generating clinical transcriptions and notes on behalf of the Clinician.
• Zero Audio Storage: All audio recordings are streamed to volatile memory (RAM) in real-time, processed in-flight, and deleted instantly after note generation. Audio files are never written to disk or saved on servers. Personally identifiable data is never used to train models; anonymized usage is limited strictly to product improvement.
• Application-Level Encryption (ALE): All clinical data (including transcripts, clinical notes, and patient details) is protected with Application-Level Encryption using AES-256-GCM. Data is encrypted in memory before database storage, rendering it completely unreadable to unauthorized third parties or Eldovian systems personnel.
• Sovereign Data Storage: Ensure all storage of active patient data remains exclusively within India. The database is localized in the AWS ap-south-1 (Mumbai) region.
• AI Model Optimization: Personally identifiable data is never used to train models; anonymized usage is limited strictly to product improvement.
• NMC Archiving Support: Support the Clinician's National Medical Commission (NMC) obligation to retain clinical records for a minimum of 3 years via a secure soft-delete mechanism.

5. Authorized Sub-processors

Eldovian Technologies engages only the following authorized sub-processors in the delivery of the Platform, each bound by equivalent data protection obligations:

• Supabase (hosted on AWS ap-south-1, Mumbai): Provides clinical notes storage, database services, user authentication, and secure file logs.
• Sarvam AI: Powering real-time audio transcription via Speech-to-Text APIs. All processing occurs within India, audio is processed completely in RAM and discarded immediately, and is never stored, with zero model training on patient data.

Eldovian Technologies remains liable to the Clinician for the acts and omissions of any sub-processor and will notify the Clinician of any sub-processor changes with reasonable prior notice.

6. Data Breach Response Procedure

In the event of a personal data breach affecting Customer data, Eldovian Technologies shall:

• Timeline: Notify the Clinician within 72 hours of becoming aware of the breach.
• Assistance: Provide the Clinician with commercially reasonable information in its possession to enable compliance with patient notification obligations under applicable law.
• Cooperation: Cooperate with the Clinician in reporting the breach to the Data Protection Board of India (DPBI) where required by the Digital Personal Data Protection Act 2023, at the Clinician’s sole cost and expense.
• Remediation: Take commercially reasonable steps to contain, investigate, and remediate the breach, provided that Eldovian Technologies’ aggregate liability for containment, investigation, and remediation costs shall be capped in accordance with Section 12, except where the breach is due to Eldovian Technologies’ gross negligence or willful misconduct.
• Incident Report: Provide the Clinician with a written summary report within 30 days of containment. The Clinician, as Data Fiduciary, retains primary responsibility for notifying affected patients. Costs arising from a breach attributable to the Clinician’s own acts, omissions, or negligence shall be borne entirely by the Clinician.

7. Clinician Obligations & Patient Consent

To ensure compliant operations, the Clinician covenants and agrees to:

• Verifiable Patient Consent: Obtain explicit verbal or written informed consent from each patient before recording any consultation. The Clinician must inform patients of the AI documentation tool, RAM-only processing, data encryption, and their right to decline at any time.
• Credential Confidentiality: Maintain the security of login credentials and prevent unauthorized platform access.
• Re-verification: Review and verify all AI-generated clinical notes before using, storing, or sharing them in any clinical record.
• Suggested Verbal Consent Script:
  "I’m using an AI-assisted documentation tool today. Your consultation will be transcribed in real-time to generate clinical notes. No audio is stored on any server. Your data is encrypted and accessible only to me. You may decline at any time — just let me know."

8. Patient (Data Principal) Rights Management

Under the DPDP Act 2023, patients have rights regarding access, correction, erasure, grievances, and representative nomination.

The Clinician, as the Data Fiduciary, is responsible for receiving and managing patient rights requests. Where fulfillment of a request requires action by Eldovian Technologies as Data Processor (e.g., erasure of transcripts or notes from the platform), the Clinician shall notify Eldovian promptly at privacy@eldovian.com. Eldovian Technologies shall fulfill such requests within 30 days of receiving notice, subject to legal record-retention requirements.

9. Representations & Warranties

• Eldovian Warranties: Eldovian Technologies represents and warrants that it has full legal authority to enter this Agreement, that the platform does not infringe third-party IP rights, and that it processes personal data in compliance with the DPDP Act 2023.
• Clinician Warranties: The Clinician represents and warrants that they are a duly registered medical practitioner in India with a valid registration from the relevant Medical Council and will use the platform in compliance with the National Medical Commission (NMC) Code of Ethics.

10. Confidentiality & Non-Disclosure

10.1 Definition of Confidential Information: "Confidential Information" means any non-public information disclosed by one party (the "Disclosing Party") to the other party (the "Receiving Party"), whether orally, in writing, or in electronic format, that is marked as confidential or should reasonably be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information of Eldovian Technologies includes, without limitation: (a) any data or information regarding Eldovian Technologies' affairs, business, customers, vendors, partners, products, intellectual property, and proprietary data; (b) the technical architecture, algorithms, source code, and proprietary methods of Eldovian Simplify; and (c) the results, performance, feedback, and metrics of the pilot program. Confidential Information of the Clinician includes all patient data, transcripts, clinical notes, and clinical records processed through the platform.

10.2 Obligations: Both parties agree to keep the other party’s Confidential Information strictly confidential and not disclose it to any third party without prior written consent, except to their employees, representatives, or subcontractors who need to know and are bound by equivalent confidentiality obligations. The Receiving Party shall protect the Disclosing Party’s Confidential Information with the same degree of care it uses to protect its own confidential information, but in no event less than a reasonable standard of care. The Clinician shall not disclose any non-public information about the platform to third parties, media, or competitors without prior written consent from Eldovian Technologies.

10.3 Survival: The confidentiality obligations under this Section 10 shall survive the termination or expiration of this Agreement: (a) indefinitely with respect to patient data, trade secrets, and intellectual property; and (b) for a period of five (5) years from the date of termination or expiration with respect to all other Confidential Information.

11. Intellectual Property

Eldovian Simplify, including its software, algorithms, models, and interface, is the sole intellectual property of Eldovian Technologies. Participation in the pilot does not transfer any ownership rights. Eldovian Technologies may use pilot feedback without financial compensation. Generated clinical notes and transcriptions belong exclusively to the Clinician and their practice.

12. Liability Cap & Disclaimers

To the maximum extent permitted by applicable law, the parties agree to the following liability limits:

• Clinical Disclaimers: Eldovian is not liable for any clinical decision, patient harm, misdiagnosis, or adverse medical outcomes resulting from the use or misuse of AI-generated summaries.
• Consequential Damages: Eldovian is not liable for any indirect, incidental, or consequential losses, including platform downtime or data inaccuracies.
• Aggregate Liability Cap: Eldovian's total aggregate liability under this Agreement shall not exceed INR 50,000 (Rupees Fifty Thousand). This cap does not apply to liability arising from fraud, gross negligence, or wilful misconduct.
• Mutual Indemnities: The Clinician agrees to indemnify Eldovian against claims arising from consent failures, clinical decisions, or credential misuse. Subject to the limitations and caps on liability set forth in this Section, Eldovian agrees to indemnify the Clinician against third-party claims arising from material data processing breaches or gross negligence caused solely by Eldovian's failure to implement committed security measures.

13. Term & Termination

13.1 Term: This Agreement commences upon account registration and continues for the 30-day pilot duration (the "Pilot Duration").

13.2 Termination for Convenience: Eldovian Technologies may terminate this Agreement at any time for convenience upon 7 days’ written notice to the Clinician. The Clinician may terminate this Agreement for convenience upon 14 days’ written notice to Eldovian Technologies.

13.3 Termination for Cause: Eldovian Technologies may terminate this Agreement immediately upon written notice to the Clinician if the Clinician breaches any provision of this Agreement, including but not limited to the Clinician Obligations under Section 7. Either party may terminate this Agreement with immediate effect if the other party is declared insolvent or files for bankruptcy.

13.4 Effect of Termination: Upon termination or expiration of this Agreement: (a) The Clinician's access to Eldovian Simplify will be revoked within 48 hours; (b) The Clinician may request deletion of their data via privacy@eldovian.com, subject to any applicable legal and NMC archiving obligations (which require a minimum retention period of 3 years, as noted in Section 4); and (c) Any provisions of this Agreement which by their nature should survive termination shall survive, including Sections 10 (Confidentiality), 11 (Intellectual Property), 12 (Liability Cap & Disclaimers), 14 (Dispute Resolution & Governing Law), and Section 14.2 (Indemnification).

14. Dispute Resolution & Governing Law

14.1 Governing Law: This Agreement is governed by and construed in accordance with the laws of India, without reference to its conflict of laws principles.

14.2 Dispute Resolution: In the event of any dispute, claim, or controversy arising out of or in connection with this Agreement, the parties shall first attempt to resolve the matter amicably through good-faith negotiations for a period of 15 days.

14.3 Arbitration: If the dispute is not resolved within 15 days of initiating negotiations, it shall be referred to and finally resolved by binding ad hoc arbitration in accordance with the Arbitration and Conciliation Act, 1996 (as amended from time to time). The arbitration proceedings shall be conducted by a sole arbitrator appointed by mutual agreement of both parties. If the parties fail to agree on a sole arbitrator within 15 days of the request for arbitration, the arbitrator shall be appointed in accordance with the provisions of the Arbitration and Conciliation Act, 1996.

14.4 Venue and Language: The seat and venue of the arbitration shall be Bengaluru, India. The language of the arbitration shall be English. The arbitrator's award shall be final, binding, and enforceable in any court of competent jurisdiction. The parties shall share the costs of the arbitration equally, unless the arbitrator directs otherwise.

15. Force Majeure & Assignment

Neither party is liable for performance delays caused by circumstances beyond reasonable control (acts of God, natural disasters, cloud outages).

The Clinician may not assign this Agreement without written consent. Eldovian Technologies may assign its rights and obligations to (a) a successor entity upon formal incorporation as Eldovian Technologies Private Limited without consent, and the individual founders shall be fully and automatically released from all personal, joint, and several liability under this Agreement, provided that Eldovian Technologies notifies the Clinician in writing within 14 days of such incorporation; or (b) an asset acquirer with 14 days' prior notice.

16. Execution & Acceptance

Execution Clause: By registering an account, completing the onboarding wizard, entering into a service order, or using the Eldovian Simplify platform, the Customer/Clinician and Eldovian Technologies mutually agree to, execute, and accept all clauses in this Data Processing Agreement, establishing a formal bilateral contract in accordance with the Information Technology Act, 2000 (India).