Privacy Policy & Statutory DPDP Notice

    DPDP Act 2023 Compliant

    SleepCare OS — Digital Personal Data Protection Policy & Patient Consent Framework

    Statutory Notice under Section 5, Digital Personal Data Protection (DPDP) Act, 2023

    This document serves as the official privacy notice for patients, clinicians, and partners accessing SleepCare OS. It outlines what personal medical data we process, the precise purposes, security safeguards, and your statutory rights to access, correct, and erase your data.

    1. Identity of the Data Fiduciary

    The primary Data Fiduciary for patient data processed through SleepCare OS is the registered somnology clinic, sleep diagnostic center, or treating hospital where you booked or received your sleep study. SleepCare OS acts as a technology platform and Data Processor facilitating digital diagnostics, machine rentals, and clinical reporting.

    2. Categories of Personal & Health Data Collected

    We process only such data as is strictly necessary for somnological evaluation and therapy:

    • Identifying & Contact Details: Full name, age/date of birth, biological sex, contact mobile number, and city/pin code for home study dispatch.
    • Physiological Sleep Telemetry: Polysomnography (PSG) readings, Apnea-Hypopnea Index (AHI), Oxygen Desaturation Index (ODI), pulse oximetry (SpO2), sleep stage durations (REM, Deep, Light), and sleep efficiency.
    • DME & Therapy Records: CPAP/BiPAP machine serial numbers, prescribed pressure settings, mask fitting type, rental trial dates, and usage compliance adherence.
    • Operational Audit Logs: Access timestamps, device type, and IP address recorded strictly to prevent unauthorized access to medical records.

    3. Specified Purposes of Processing

    Under Section 6 of the DPDP Act 2023, data is processed solely for:

    A. Clinical Sleep Diagnostics

    Generating diagnostic reports, AHI scoring, and doctor consultations.

    B. Equipment Titration & Trials

    Tracking CPAP/BiPAP trials, machine delivery, and therapy optimization.

    C. Direct WhatsApp/SMS Communication

    Delivering secure 1-click magic access links, test scheduling, and reminders.

    D. Zero Commercial Data Sale

    Your health data is NEVER sold, rented, or monetized to advertisers or third parties.

    4. Security Safeguards & Encryption

    All patient records are protected using PostgreSQL Row Level Security (RLS) with cryptographic separation between organizations and patients. Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Patient portal access uses temporary cryptographic tokens with automatic expiration.

    5. Retention Period & Statutory Mandates

    Diagnostic sleep study recordings and medical reports are retained for a minimum period of 3 years in adherence to Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, or as mandated by your healthcare provider. After the statutory retention period, data is securely purged or anonymized.

    6. Your Rights under Chapter III, DPDP Act 2023

    As a Data Principal, you are entitled to:

    Right to Access: View and download your diagnostic summary and list of all processing activities at any time from your Patient Portal.
    Right to Correction & Updating: Request corrections to any demographic or clinical recording errors through your clinic.
    Right to Withdraw Consent: Withdraw optional marketing or non-critical notifications in 1-click via the "My Documents & Consent" tab.
    Right to Nominate: Nominate a legal representative or family member to manage your health records in event of incapacitation.

    7. Grievance Redressal & Data Protection Officer

    In accordance with Rule 11 of the DPDP Framework, any privacy concern, data correction, or grievance may be addressed to our designated Data Protection Officer:

    Officer: Grievance Redressal Officer, SleepCare Health

    Email: privacy@sleepcare.app

    Response Timeline: Within 72 working hours (DPDP Statutory SLA)

    Version: DPDP-v1.0 (Nov 2025 Standard)Last Updated: October 2026