Data Processing Agreement

This DPA governs how NarraHealth Technologies Pvt. Ltd. ("Data Processor") processes personal data on behalf of a controller ("Client").

Legal Basis

• India's Digital Personal Data Protection (DPDP) Act, 2023 (primary)
• GDPR for EU data subjects
• Indian Contract Act 1872
• IT Act 2000

Who Needs a DPA

• You provide personal data to Narra Healthcare for processing
• You control how and why data is processed
• You are a covered entity under DPDP Act
• You use Narra Healthcare with patient, customer, or employee data

Examples of Controllers

• Healthcare providers (doctors, clinics, hospitals)
• Diagnostic centres and laboratories
• Telemedicine platforms
• Research institutions
• Business entities

Relationship to Other Agreements

This DPA complements the Business Associate Agreement (BAA), Privacy Policy, Terms of Service, and Data Security Statement.

Data Controller (Client)

Determines the purposes and means of data processing.

• Determine what data to process and why
• Collect data with proper consent
• Ensure legal basis for processing
• Respond to data subject requests
• Report breaches to authorities

Data Processor (Narra Healthcare)

Processes data on behalf of Controller.

• Process only per Controller's instructions
• Implement security safeguards
• Maintain audit trails
• Notify Controller of breaches
• Assist with data subject requests
• Comply with data protection laws

Narra Healthcare IS NOT

• A joint controller
• An independent data handler
• A data owner
• A data broker

Narra Healthcare IS

• A data custodian
• A service provider
• Your data processor
• Your compliance partner

Processing Services Provided

• Data Storage and Management: secure storage, version control, backup
• Data Access and Sharing: authentication, granular access controls, logging
• Data Portability: export in PDF, CSV, JSON, HL7, FHIR
• Compliance and Audit: audit trails, access logging
• Security and Protection: encryption, intrusion detection

Duration

Effective upon execution, continues for service agreement term. Post-termination: data retained 30–90 days for transition; data available for download; deleted on request or per retention policy.

Controller Authorises Narra Healthcare To

• Store personal data on encrypted servers
• Create backup copies for disaster recovery
• Authenticate users (password verification, MFA)
• Authorise access per Controller's instructions
• Allow data subjects to correct/update data
• Maintain version history
• Log all data access (who, what, when)
• Maintain audit trails (5+ years)
• Monitor for unauthorised activity
• Export data in standard formats
• Maintain processing documentation
• Cooperate with regulatory inspections

Prohibited Processing

• Process data for own purposes
• Use for marketing or advertising
• Sell or share data with third parties
• Combine with other customers' data
• Make automated decisions affecting individuals
• Retain longer than necessary
• Disclose without authorisation

Demographic data

Name, email, phone, address, date of birth, gender, nationality

Health data, if applicable

Medical history, diagnoses, medications, test results, clinical notes, allergies, vaccination records

Authentication data

Usernames, password hashes, MFA tokens, session tokens, device identifiers

Activity data

Login/logout timestamps, access logs, modification history, API calls

Metadata

Timestamps, anonymised IP addresses, device types

Sensitive Personal Data

Enhanced security applies to health, financial, biometric, and genetic data. Additional measures include:

• Enhanced encryption
• Stricter access controls
• Limited retention
• Explicit consent verification

Right to Access

Data subjects can access all personal data and obtain copies in portable format within 30 days.

Right to Correction

Correct inaccurate data; maintain version history; respond within 30 days.

Right to Erasure

Request deletion; primary data deleted within 30 days; backups deleted within 30 days of primary deletion.

Right to Data Portability

Receive data in portable format (PDF, CSV, JSON, HL7, FHIR).

Right to Restrict

Limit how data is processed; restrict sharing for specific purposes.

Right to Object

Object to marketing uses, profiling, or automated decisions.

How Narra Healthcare Assists

Narra Healthcare assists the Controller by:

• Receiving Data Subject Access Requests (DSARs)
• Forwarding to Controller for authorisation
• Compiling requested data
• Responding within 30 days total

Technical Security

• AES-256 encryption at rest
• TLS 1.3 in transit
• MFA and RBAC
• 24/7 intrusion detection
• Weekly vulnerability scanning
• Quarterly penetration testing
• Encrypted backups with tested recovery

Physical Security

• Biometric access and 24/7 security at Google Cloud data centres
• Fire suppression and environmental controls
• Encrypted storage media

Administrative Security

• Background checks and confidentiality agreements
• Least privilege access controls
• Documented incident response procedures
• Audit logging retained 5+ years
• Disaster recovery plan with regular drills

Security Controls Schedule

Approval Process

1. Assessment: evaluate security and compliance
2. Documentation: collect certifications and audit reports
3. DPA Requirement: sub-processor must sign DPA
4. Notice: notify Controller
5. Objection period: 30 days
6. Implementation
7. Monitoring: ongoing compliance

Current Sub-processors

Sub-processor Requirements

• ISO 27001 or equivalent
• Annual security audits
• Breach reports within 24 hours
• Data residency compliance
• Equivalent security controls

Data Residency

All personal data is stored in India (AWS ap-south-1 / Google Cloud asia-south1). No transfer outside India without explicit approval.

Transfer Mechanisms

EU transfers (GDPR)

Standard Contractual Clauses (SCCs)

Other jurisdictions

Legal basis required (court order, regulatory requirement, or explicit consent) with data subject notification

Narra Healthcare will NOT transfer data to:

• Countries without data protection laws
• Countries on DPDP/GDPR restricted lists
• Any party without adequate safeguards

Definition

Unauthorised access, disclosure, modification, loss, or corruption of personal data.

Response Timeline

• Immediate (< 1 hour): detection, isolation, containment
• Investigation (within 24 hours): scope, impact, root cause
• Notification (within 72 hours): Controller and authorities as required

Notification Schedule

Controller notification

Within 1 hour (critical)

Data subject notification

Within 72 hours (via Controller)

Authority notification

As required by law

Breach Support

Narra Healthcare provides notification templates, media response assistance, and regulatory communication support.

Effective upon execution; continues for service agreement term.

Termination by Controller

• Convenience (any reason)
• Material breach uncured within 30 days
• Regulatory requirement

Termination by Narra Healthcare

• Material breach uncured within 30 days
• Non-payment
• Force majeure

Effect of Termination

No new data accepted; existing data retained 30–90 days; processing limited to export and deletion; confidentiality obligations continue indefinitely.

Data Deletion

Deletion uses overwrite method, crypto-erase, or physical destruction for decommissioned servers. A certificate of deletion is provided. Audit logs are retained per legal requirements (5–7 years).

Liability Cap

Basis

Limited to fees paid in prior 12 months

Minimum

₹1,00,000

Maximum

₹1,00,00,000

Exceptions

Gross negligence, fraud, death or personal injury

Excluded Damages

• Lost profits
• Indirect or consequential damages
• Regulatory fines for Controller's violations

Indemnification

Narra Healthcare indemnifies Controller for: data breaches caused by Narra Healthcare, unauthorised disclosure, failure to implement security.

Controller indemnifies Narra Healthcare for: claims from unauthorised data uploads, IP infringement, regulatory violations by Controller.

Dispute Resolution

• Negotiation: 15 days
• Executive review: 30 days
• Mediation: 30 days
• Arbitration: Hyderabad, Telangana

Governing law: India. Jurisdiction: Hyderabad courts.

Contact

DPA questions

legal@narra.health

Data protection

dpo@narra.health

Security concerns

security@narra.health