Data processing terms

Version 1 · 28 October 2026 · part of the Terms for hospitals

These terms say how Hospita processes the personal data that a hospital, clinic or diagnostic centre ("the hospital") keeps in Hospita, as the law on data protection requires a controller and its processor to agree: the GDPR and the UK GDPR, India's Digital Personal Data Protection Act 2023, HIPAA in the United States, and comparable laws elsewhere. They are part of the Terms for hospitals.

1. Roles

• For the records the hospital keeps about its patients, its staff and its doctors, the hospital is the controller (in India, the data fiduciary; under HIPAA, the covered entity), and the company that operates Hospita ("Hospita") is its processor (in India, the data processor; under HIPAA, its business associate).
• For a patient's Hospita person (the details they give once), their own app and the permissions they give to share their record, Hospita is the controller, under the Privacy notice. When a patient allows another hospital to see their record, that hospital reads it under the patient's permission, and Hospita records each look.

2. What we process, and for what

Processing lasts as long as the hospital uses Hospita, and then as section 9 says.

3. Hospita's duties

• Hospita processes the data only on the hospital's documented instructions (these terms, the hospital's settings and what its people do in Hospita), unless the law requires otherwise; it tells the hospital if it believes an instruction breaks the law.
• Everyone at Hospita who can reach the data is bound to keep it confidential and reaches only what their work needs.
• Hospita does not sell the data, does not use it for advertising, and does not use it for its own purposes apart from running, securing and improving the service, and keeping the records the law requires.
• Hospita helps the hospital answer patients' requests (to see, correct, delete or move their data), with the security of processing, with impact assessments and prior consultations, and with notifying breaches, as far as Hospita can, taking into account what it processes.
• Hospita makes available the information needed to show that it meets these terms, and allows audits as in section 8.

4. Sub-processors

The hospital agrees that Hospita uses these kinds of sub-processors. Hospita binds each to duties no less protective than these terms, and remains responsible for them.

The current list, with each provider's name and the country where it processes, is sent on request to the legal contact on the Contact page. Hospita tells administrators at least 30 days before adding or replacing a sub-processor; the hospital may object on reasonable grounds of data protection, and if we cannot agree, may end the affected service and receive back the unused part of what it paid.

5. Where the data is

Patient data is kept in: the region named in the current list. Some sub-processors work in other countries. Where data protection law limits a transfer, Hospita relies on an adequacy decision or the European Commission's standard contractual clauses (with the UK addendum where UK law applies), which are part of these terms for such a transfer, and on the safeguards Indian law requires.

6. Security measures

• Separation. Each hospital's records are its own: every request is checked against the hospital the person is signed in at, and a person signs in at one hospital at a time. The front desk cannot open the administrator's pages.
• Access. Each person has their own account and a role. Passwords are kept only as one-way hashes. Patients sign in with a code to their own phone that works for 5 minutes and for 5 tries; their sign-in ends by itself after the time the platform sets. Sign-ins and codes are limited in number to stop guessing.
• Consent built in. A doctor joins a hospital only with a code sent to the doctor's own email. A patient's record is shown elsewhere only with the patient's permission, for its time, with every look recorded.
• In transit. All traffic to Hospita is encrypted (HTTPS). Payment details are entered at the payment gateway and never reach Hospita.
• Audit. Changes in the hospital's account are recorded with who made them and when; lab reports are opened by signed links that work for 10 minutes.
• Calls. Video visits run between the two browsers and are not recorded; Hospita keeps only who joined and when.
• Running it. Back-ups, updates for security fixes, least-privilege access for Hospita's own people, and confidentiality undertakings from them.

Hospita may change these measures, but never so that the overall protection is lowered.

7. Breaches

Hospita tells the hospital without undue delay, and within 48 hours of becoming aware, of a breach of security that affects the hospital's data, with what is known and what is being done; and keeps it informed. The hospital decides on telling authorities and patients, which Hospita helps with (in the EU, within 72 hours; in India, as the Data Protection Board and CERT-In require; under HIPAA, as the breach notification rule requires).

8. Audits

Once a year, or after a breach, the hospital may ask for the information needed to show that Hospita meets these terms, and, where that is not enough, audit it through an independent auditor bound to confidentiality, with 30 days' notice, during working hours and without reaching other hospitals' data. Each party bears its own costs.

9. At the end

When the service ends, the hospital may export its records for 30 days. Hospita then deletes the hospital's data within 90 days, including from back-ups as they are replaced, unless the law requires it to be kept; what must be kept is kept only for that and protected as these terms say. Records that a patient's own app shows from that hospital are taken off it at the same time, unless the patient has a copy of their own.

10. HIPAA

Where the hospital is a covered entity under HIPAA, Hospita as its business associate also: uses and discloses protected health information only as these terms allow or the law requires; uses appropriate safeguards and complies with the Security Rule for electronic protected health information; reports any use or disclosure not allowed by these terms, including a breach of unsecured protected health information, as section 7 says; binds its subcontractors to the same restrictions; makes information available for the patient's rights of access, amendment and an accounting of disclosures; makes its books and records on protected health information available to the Secretary of Health and Human Services; and at the end returns or destroys it as section 9 says.

11. General

If these terms and the Terms for hospitals disagree on personal data, these terms decide. Liability under these terms is as the Terms for hospitals say, except where data protection law does not allow it to be limited.