Data Processing Addendum
Last updated 24 July 2026
This DPA forms part of the agreement between your clinic (the data fiduciary/controller) and Ayunila (the data processor) for the processing of personal and health data through the Ayunila platform.
Roles
The clinic that subscribes to Ayunila is the data fiduciary (controller) for the personal and health data it enters. ClinicOS Technologies Pvt. Ltd. is the data processor, and processes that data only on the clinic's documented instructions — as given through the product's configuration and these terms — and not for its own independent purposes.
Categories of data and data subjects
This DPA covers personal data processed through Ayunila on the clinic's behalf, including:
- Data subjects: the clinic's patients, and the clinic's own staff (doctors, receptionists, pharmacists, lab staff, billing staff and owners).
- Categories of data: contact and identity details, appointment and visit history, clinical notes, prescriptions, lab orders and results, vitals, and billing and payment records.
Processor obligations
- Process personal data only on the clinic's instructions, as configured through Ayunila.
- Ensure people with access to the data are subject to confidentiality obligations.
- Implement and maintain the security measures described below.
- Not engage a sub-processor without the safeguards described in this DPA.
- Assist the clinic in responding to data-subject requests and in meeting its own obligations under applicable data-protection law.
Security measures
- Sensitive clinical fields are encrypted in the database.
- Traffic to and from the service is encrypted in transit (HTTPS/TLS).
- Role-based access control, so staff only see the data their role requires.
- An audit trail of access to patient records.
- Two-factor authentication (TOTP) available for staff accounts, and rate limiting on authentication endpoints.
- Logical separation of each clinic's data from every other clinic on the platform.
Sub-processing
We use a limited set of infrastructure, payment and messaging sub-processors to provide the service — for example cloud hosting and file storage, payment gateways, and WhatsApp messaging providers. Each is bound by confidentiality and data-protection obligations at least as protective as those in this DPA. We remain responsible for our sub-processors' performance.
Breach notification
If we become aware of a personal-data breach affecting data we process on the clinic's behalf, we will notify the clinic without undue delay and provide the information reasonably available to us, so the clinic can meet its own notification obligations to regulators and data subjects.
Assistance with data-subject requests
Patients can exercise many rights directly through the patient portal (access, consent management, data export and erasure requests). Where a request requires clinic or platform action beyond the portal, we will provide reasonable assistance to the clinic in responding within the timeframes required by applicable law.
Deletion or return of data on termination
On termination of a clinic's subscription, we will make the clinic's data available for export for a period we communicate at cancellation, after which it is deleted or de-identified, except where retention is required by law (for example, medical-record retention requirements) — see /legal/privacy and /legal/refund for detail.