OH-ID Privacy Policy

1Who Operates OH-ID?

OH-ID (One Health ID) is operated by Sathus Technology Private Limited (“Sathus”, “we”, “us” or “our”).

The organisation responsible for a particular medical record may depend on the service and relationship involved. For example, a hospital independently determines how clinical records are created, maintained, and used for direct healthcare delivery. Where Sathus processes records on behalf of a partner hospital, the hospital acts as the Data Fiduciary/Controller and Sathus operates as the Data Processor under strict contractual safeguards.

2Scope of this Policy

This policy applies to OH-ID’s website, web application, mobile applications (iOS and Android), and associated cloud services operated by Sathus.

It covers information relating to patients, doctors, hospital administrators, reception desk staff, lab personnel, healthcare organisation representatives, and individuals communicating with our support desk.

3Information We May Process

The information collected depends on the specific features used, your role, and the participating hospital’s clinical modules. We strictly observe data minimisation:

4Why We Process Information

• To provision, authenticate, and administer patient and clinical staff accounts.
• To verify mobile numbers via OTP and validate professional hospital credentials.
• To facilitate OPD token allocation, hospital appointment queues, and intake workflows.
• To empower authorized clinical documentation, e-prescriptions, and diagnostic record access.
• To facilitate QR-based identification and emergency health summary verification.
• To protect user accounts against unauthorized access, credential stuffing, and session hijacking.
• To maintain immutable audit logs in compliance with healthcare regulations.
• To send critical operational notifications (e.g., appointment confirmations, queue alerts).

5Consent and Your Choices

Where processing relies on consent, consent is obtained in an explicit, informed manner. You may withdraw consent for optional features at any time via your account settings or by contacting admin@sathus.in.

Withdrawing consent does not invalidate lawful processing carried out prior to withdrawal, nor does it override statutory obligations to maintain patient medical records under healthcare establishment regulations.

6Who Can Access Information?

Information is strictly compartmentalized based on verified organizational roles:

• Patients: Access their own profile, past appointments, active prescriptions, and shared health records.
• Treating Doctors: Access clinical history and current vitals for patients under their active consultation or admitted care.
• Hospital Reception & Billing: Access demographic and appointment scheduling data; restricted from confidential doctor consultation notes.
• Sathus Infrastructure Engineers: Strict, audited access restricted to encrypted database infrastructure for maintenance and incident resolution.
• No Inter-Hospital Data Leaks: Hospital instances are logically isolated. One hospital cannot view records from another hospital without explicit, authenticated consent protocols.

7Service Providers and Subprocessors

We partner with enterprise-grade cloud providers for infrastructure, transactional SMS/email delivery, and secure storage. All service providers operate under stringent Business Associate or Data Processing Agreements adhering to ISO 27001, SOC 2, and Indian DPDP guidelines.

Zero AI Data Retention: Where document OCR or machine intelligence is employed for clinical intake, data is processed in private enterprise runtime containers with strict zero-data-retention; client data is never utilized to train third-party machine learning models.

8Data Storage & International Processing

Primary databases and patient health repositories are maintained in secure data centre facilities located within India, adhering to national health data residency mandates and the Digital Personal Data Protection Act (DPDP) 2023. Any cross-border infrastructure integrations are safeguarded through end-to-end encryption and contractual protections.

9Security Safeguards

• Encryption in Transit: TLS 1.3 enforced across all web and mobile endpoints.
• Encryption at Rest: Database records, patient identifiers, and medical files encrypted with AES-256.
• Access Controls: Multi-factor authentication (MFA) and fine-grained Role-Based Access Controls (RBAC).
• Audit Logging: Immutable audit logs for all clinical file access, modifications, and administrative exports.
• Periodic Audits: Automated vulnerability scanning, static application security testing (SAST), and penetration testing.

10Retention of Information

Information is retained only for the duration necessary to satisfy the purpose of collection or statutory compliance:

• User Account Details: Retained while your account is active.
• Clinical & Hospital Records: Retained in alignment with National Medical Commission (NMC) regulations and hospital recordkeeping laws (typically a minimum of 3 years from consultation date).
• Security & Authentication Logs: Retained for a minimum of 180 days to support incident analysis and compliance verification.

12Children's Information

OH-ID supports pediatric healthcare management through parent or legal guardian accounts. Accounts or clinical files for minors (under 18 years) must be initiated and overseen by an authorized parent or guardian in compliance with DPDP Act requirements.

13Cookies and Tracking Technologies

OH-ID web services use essential cookies strictly required for secure user authentication, CSRF protection, and session maintenance. We do not use third-party behavioral tracking or advertising cookies.

14Your Privacy Rights and Complaints

Subject to applicable law, you have the right to request access to, correction of, or deletion of your personal data, and to lodge a grievance:

15Changes to this Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory updates. Any material updates will be communicated through prominent notifications within the OH-ID application or on our website.

16Contact Us

For privacy questions, verification requests, or complaints concerning OH-ID: