Data processing agreement

1. Scope and roles

The Institution decides why and how patient and staff personal data is processed. The Processor processes that data only to provide ECMO Universe, and only on the Institution's documented instructions given through the platform's settings and the subscription. These terms take effect when the Institution's administrator activates a subscription or first records patient data.

2. Processor obligations

• Process personal data only for providing the service, and never for advertising, profiling, or sale.
• Ensure staff of the Processor with access are bound by confidentiality and are given access only as needed.
• Maintain the reasonable security safeguards described on the Security and compliance page, aligned with ISO/IEC 27001:2022 Annex A.
• Keep Institution data logically isolated from every other institution's data.
• Keep an audit trail of access and changes, available to the Institution's administrators.
• Help the Institution respond to data principal requests and grievances through the Data protection register.

3. Sub-processors

The Processor uses the following sub-processors, each bound by equivalent obligations:

• Vercel Inc. — application hosting and delivery.
• Neon (Databricks) — managed PostgreSQL database with encrypted backups.
• Vercel Blob — encrypted private storage for clinical images and signed consent documents.
• Stripe — subscription billing. Stripe receives administrator billing details only, never patient data.

The Processor will notify Institution administrators before adding or replacing a sub-processor that handles patient data. The Institution may object on reasonable data protection grounds.

4. Cross-border transfer

Some sub-processors may process data outside India. Transfers are made only to countries not restricted by the Central Government under section 16 of the DPDP Act, with encryption in transit and at rest.

5. Personal data breach

The Processor will inform the Institution without undue delay, and in any case within 24 hours of becoming aware of a personal data breach affecting its data. It will provide the details the Institution needs to intimate the Data Protection Board of India within 72 hours and to notify affected data principals.

6. Retention, return, and erasure

Personal data is kept for as long as the Institution's subscription is active, and longer where medical-records law requires it. When the subscription ends, the Institution may export its records within 60 days. After that, the Processor erases the data from active systems, and backups expire in their normal rotation, unless the law requires otherwise.

7. Audit and cooperation

On reasonable written notice, the Processor will provide the information the Institution needs to show compliance with these terms. This includes security documentation and audit-log exports, and cooperation with regulatory inquiries.

8. Institution responsibilities

• Give notice to, and obtain valid consent from, patients or their lawful representatives where required.
• Appoint and publish a Grievance Officer / Data Protection Officer.
• Manage staff accounts and roles, and remove access promptly when staff leave.
• Respond to data principal requests within the statutory timelines.

9. Governing law

These terms are governed by the laws of India. The courts at Vadodara, Gujarat have jurisdiction. Sardhara Medical Private Limited, CIN U32509GJ2026PTC184082, registered office: Tower-A, 4th Floor, Silver Square, B/s Patel Timber, Harni Colony, Vadodara 390022, Gujarat, India.

An institution that needs a countersigned copy of this agreement can ask for one through its administrator's support ticket.