This Data Processing Agreement ("DPA") is part of the Airgent Terms of Service between Airgent Services Private Limited ("Airgent") and the clinic that accepted them ("Clinic"). It applies whenever Airgent processes Patient Data for the Clinic. Words defined in the Terms have the same meaning here.
1.1 For Patient Data, the Clinic is the Data Fiduciary and Airgent is its Data Processor under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the DPDP Rules, 2025.
1.2 "Patient Data" means personal data about patients, their guardians and anyone who contacts the Clinic through the Service (including people who call or message the Clinic's agents before becoming patients), as described in Annex A.
1.3 Airgent's own handling of data about the Clinic's Users is covered by the Privacy Policy, not this DPA.
1.4 Until the DPDP Act's operative provisions commence, Airgent also complies with section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011 for Patient Data, which is sensitive personal data under those Rules, including rule 7 for transfers.
2.1 Airgent processes Patient Data only to provide the Service as the Clinic configures and uses it, and on the Clinic's other documented instructions. The Clinic's use of the Service's settings is an instruction.
2.2 If Airgent believes an instruction breaks the law, it will tell the Clinic and need not follow it.
2.3 Airgent may process Patient Data when Indian law requires it; it will tell the Clinic first unless the law forbids that.
3.1 The Clinic will give patients the notice the DPDP Act requires and have a lawful basis (consent or a legitimate use) for every purpose it uses the Service for. Annex D is a template notice the Clinic may adapt.
3.2 The Clinic is responsible for the accuracy of Patient Data it enters and for answering patients' rights requests.
3.3 Recording. Before a consultation is recorded, the Clinic will obtain and record the patient's consent in the Service. The Clinic will honour a refusal or a withdrawal; the Service supports both Pending · P1.
3.4 Children and guardians. Where the law requires a parent's or lawful guardian's consent, the Clinic will obtain it and record the guardian against the child's profile. For the lawyer · confirm the DPDP Rules 2025 exemption for clinical establishments
3.5 The Clinic will not instruct Airgent to send messages to patients who have not opted in where opt-in is required (WhatsApp Business Messaging Policy; telecom rules).
4.1 Purpose. Airgent will not use Patient Data for any purpose of its own, will not sell it, and will not combine it with another clinic's data, except to create anonymised data that is no longer personal data (Terms §12.3).
4.2 Confidentiality. Everyone at Airgent who can access Patient Data is bound by confidentiality.
4.3 Staff access. Airgent staff access Patient Data only to support the Clinic at its request, to keep the Service secure, or to meet a legal duty. Every such access is logged Pending · P9. Development and testing use no real Patient Data Pending · P19.
4.4 Assistance. Airgent will give the Clinic reasonable help with security, breach notification, impact assessments and requests from the Data Protection Board, to the extent they concern the Service.
Airgent will keep reasonable security safeguards, including those in Annex B, as the DPDP Act (§8(5)) and the DPDP Rules, 2025 require. Airgent may improve them but will not reduce their overall level.
If a patient or other person contacts Airgent to use their rights over Patient Data (for example through the Grievance Officer named in the Privacy Policy §9), Airgent will pass the request to the Clinic within 7 days and will not answer it directly unless the Clinic asks. The Service lets the Clinic find, correct, export and erase a patient's data Pending · P4, P5.
7.1 Airgent will notify the Clinic without undue delay, and in any case within 24 hours of becoming aware of a breach affecting the Clinic's Patient Data Pending · P6.
7.2 The notice will say, as far as known: what happened, when and where; its cause and, if known, who caused it; what data and how many people are affected; the likely consequences; what Airgent has done and will do to contain it and prevent a recurrence; safety steps patients can take; and a contact person. Airgent will update it as it learns more.
7.3 Airgent will help the Clinic notify the Data Protection Board and affected patients as the DPDP Rules, 2025 require (an intimation to the Board and each affected patient without delay, and a detailed report to the Board within 72 hours), and will not notify patients itself unless the Clinic asks or the law requires.
7.4 Airgent will report cyber security incidents to CERT-In within 6 hours Pending · P6 as the CERT-In Directions of 28 April 2022 require, and keeps the ICT logs those Directions require within India for at least 180 days, and the logs the DPDP Rules, 2025 require for one year once they apply Pending · P13.
8.1 The Clinic authorises Airgent to use the sub-processors in the published list (sub-processors.md, Annex C), which names what each one does and where it processes data.
8.2 Airgent will use each sub-processor under written terms that provide the safeguards the DPDP Act requires of a processor Pending · P17, and remains responsible to the Clinic for them.
8.3 Airgent will give 30 days' notice in the Service before adding or replacing a sub-processor that receives Patient Data, including a change in which provider handles a kind of Patient Data Pending · P18. If the Clinic objects on reasonable data-protection grounds and the parties cannot agree a solution, the Clinic may end the affected part of the Service and receive a pro-rata refund of prepaid fees.
8.4 Transfers outside India. Some sub-processors process Patient Data outside India, as Annex C shows. The DPDP Act (§16) permits this except to countries the Government restricts; Airgent will stop any transfer to a country that becomes restricted.
9.1 The Clinic decides how long its medical records are kept, including any period the law requires of it (for example, the 3-year clinical-record duty under regulation 1.3.1 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002).
9.2 Airgent applies these technical windows unless the Clinic sets a different one where the Service allows:
| Data | Window |
|---|---|
| Consultation audio | 30 days after recording Pending · P2 |
| WhatsApp message transcripts | 90 days Pending · P2 |
| Contacts who never became patients (front-office leads) | 180 days after last contact Pending · P2 |
| Draft working data during a consultation | deleted when the consultation finishes Pending · P2 |
| Notes, transcripts, prescriptions, appointments, invoices | kept while the Clinic's account is active |
These windows are subject to any minimum retention Indian law requires, including the one-year retention of personal data, traffic data and logs under the DPDP Rules, 2025 once they apply For the lawyer · confirm how this interacts with 30-day audio deletion.
9.3 When the Terms end, the Clinic has 30 days to export its data (Terms §14.5). Airgent then deletes Patient Data, including from backups within their normal rotation Pending · P16, except copies Indian law requires Airgent itself to keep, which it protects under this DPA until deleted.
9.4 During the term, on the Clinic's instruction, Airgent erases the Patient Data the Clinic specifies from the systems Airgent controls within To be filled · Erasure days days, confirms that in writing, and instructs the relevant sub-processors to delete their copies Pending · P17.
On request, once a year (or after a breach), Airgent will provide the Clinic with written answers to reasonable security questions and a summary of its latest independent assessment, if any. On-site audits need a separate agreement and reasonable notice.
This DPA lasts as long as Airgent processes Patient Data for the Clinic. Liability under it is governed by the Terms §13.
| Item | Detail |
|---|---|
| People concerned | patients, their guardians and companions, people who call or message the Clinic, the Clinic's staff when they appear in records |
| Patient Data | identity (name, age, sex, contact), appointments and visits, consultation audio, transcripts, clinical notes, vitals, prescriptions, uploaded documents, voice calls and WhatsApp messages with the Clinic's agents, invoices and payments |
| Purpose | scheduling and patient communication (Airgent Front Office); clinical documentation and prescriptions (Airgent Scribe); records, billing and practice management (Keel) |
| Nature | collection, recording, transcription, AI drafting, storage, display, export, deletion |
| Duration | while the Clinic uses the Service, then §9 |
| AI processing | speech-to-text of consultations and calls; drafting notes from transcripts; agents that converse with patients. A doctor reviews and signs every note (Terms §7.1) |
| Area | Measure | State |
|---|---|---|
| Encryption | TLS for all traffic; storage encrypted at rest by the database provider; sensitive fields (such as phone numbers and in-progress consultation text) additionally sealed with libsodium before storage | in place |
| Separation between clinics | queries are scoped to the Clinic through shared access helpers in application code | in place |
| database row-level security enforced for the application's connection | Pending · P8 | |
| Access control | role-based permissions inside each Clinic; Airgent staff access limited and logged | permissions in place · staff-read logging Pending · P9 |
| Audit | an append-only audit log protected by revoked privileges for restricted database roles | in place · not yet enforced for the application's own connection Pending · P8 |
| Retention | automated deletion windows (§9.2) | Pending · P2 |
| Incident response | named clocks for Clinic notice (24 h) and CERT-In (6 h) | Pending · P6 |
| Change control | every production change is reviewed before release | in place |
See sub-processors.md, which is published on its own page so it can be updated under §8.3.
How [Clinic name] uses your information
We use Airgent, a software service, to book your appointments, answer calls and WhatsApp messages, and write your consultation notes. Airgent acts only on our instructions.
Calls and messages. Our phone line and WhatsApp may be answered by an AI assistant. It will tell you it is an AI. Calls may be recorded.
Consultations. With your permission, your doctor may record the consultation so the notes are written accurately. You can say no, or ask us to stop at any time; your care does not change. Recordings are deleted after 30 days Pending · P2. Your doctor checks and signs every note.
Where it is stored. In India. Some providers outside India (including the USA) also process the content of calls, messages and consultations, for speech-to-text, AI drafting and message delivery, listed at airgent.ai/dpa/sub-processors. Pending · P10
What we use and why.
Information Why name, age, sex, phone number to identify you and contact you about your care and appointments appointments and messages with us to book and manage your visits consultation recording and transcript (only with your permission) to write accurate notes clinical notes, prescriptions, test results to treat you and keep your medical record bills and payments to bill you Your rights. You can ask us to see, correct or delete your information, or withdraw your consent at any time, by contacting [clinic contact] or [link]. You may nominate someone to act for you if you die or cannot act. Raise concerns with us first; if they are not resolved, you may complain to the Data Protection Board of India.