Data protection and the DPDP Act, 2023

Last updated: 4 November 2026

India's Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for how personal data, including patient data, is collected, used, kept and protected. This page explains who is responsible for what when a hospital uses Aarogentix, and the safeguards built into the product. It describes how the software works. It is not legal advice, and each hospital stays responsible for its own compliance.

Who is responsible for what

The hospital is the data fiduciary. It decides why and how patient data is used. It gives patients notice and takes consent where the law requires it, answers patients' requests, decides how long records are kept, and reports a personal data breach to the Data Protection Board of India and to affected patients when required.
Aarogentix is the data processor. We process the data only for the hospital, to run the service. We apply the safeguards below and help the hospital with requests and incidents.

Safeguards built into the product

Separate data for each hospital. Every query is limited to the hospital that is signed in.
Roles and permissions. Reception, nurses, doctors, pharmacy, lab and billing each see and do only what their role allows. Access can be removed the day someone leaves.
Protected sign-in. Lockout after repeated wrong passwords, optional two-step sign-in with an authenticator app, and automatic sign-out of idle sessions.
Encryption. HTTPS for all traffic, plus field-level AES-256-GCM encryption of national ID numbers such as Aadhaar and of staff bank and tax numbers.
An audit trail. Sign-ins and changes to records are logged, and the log cannot be edited or deleted through the application or the database.
Backups. Nightly database backups, kept for 14 days.
No data sent to outside AI services. The built-in assistant runs inside the application.

Patient rights, and how the software helps the hospital

Access: staff can open, print and export a patient's record, bills and reports.
Correction: records can be corrected, and the change is recorded in the audit trail.
Erasure: records can be removed from active use. The hospital decides what to erase, because medical-records retention rules also apply to it.
Grievances: patients should first contact the hospital. If the hospital needs help with a request about its data in Aarogentix, it can write to us at support@aarogentix.in.

If something goes wrong

If we find a security incident that affects a hospital's data, we tell that hospital without undue delay and share what we know, so that it can meet its own duties to the Data Protection Board of India and to affected patients.

A short checklist for hospitals

Give every person their own login. Never share one login at the front desk.
Turn on two-step sign-in for doctors and administrators.
Remove access the same day someone leaves.
Publish a clear privacy notice for patients and train staff to explain it.
Decide how long each kind of record is kept, and who may ask for exports.
Keep a named person responsible for patient requests and incidents.