Data Processing Agreement

Last updated: 24 September 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between OpenORDO ("OpenORDO", the "Processor") and the clinic or practice that uses the OpenORDO service (the "Customer", the "Controller"). It applies to all personal data that OpenORDO processes on the Customer's behalf ("Customer Personal Data"), and it applies automatically when the Customer accepts the Terms. No signature is needed; a countersigned copy is available on request at support@openordo.com.

  • Data Protection Laws: all laws that apply to the processing, including India's Digital Personal Data Protection Act, 2023 and its rules ("DPDP Act"), the Information Technology Act, 2000 and rules made under it, the EU and UK GDPR, and, where a BAA is in force, HIPAA.
  • Controller / Data Fiduciary and Processor / Data Processor have the meanings in the relevant law. For this DPA, the Customer is the Controller and OpenORDO is the Processor.
  • Data Subject means an identifiable individual whose data is processed, such as patients and clinic staff.
  • Personal Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
  • Sub-processor: a third party engaged by OpenORDO to process Customer Personal Data.
  • Services: the OpenORDO platform and any add-ons the Customer has purchased.
  1. The Customer is the Controller of Customer Personal Data and decides the purposes and means of processing. OpenORDO processes it only as a Processor on the Customer's documented instructions.
  2. The Customer's instructions are the Terms, this DPA, the Customer's configuration and use of the Services (for example creating patients or inviting staff), and any written instructions that are consistent with these.
  3. OpenORDO acts as an independent controller only for its own account, billing, security and website data, described in the Privacy Policy. This DPA does not cover that data.
  4. Details of the processing are in Annex 1.

The Customer confirms that it:

  • has a lawful basis, and has given all notices and obtained all consents needed, to enter Customer Personal Data into the Services and, where it uses the public booking page or messaging features, to communicate with patients;
  • will use only accurate data and use the Services in line with law and the Acceptable Use Policy;
  • is responsible for assigning roles, keeping login credentials secure and removing users who no longer need access;
  • will handle the requests of Data Subjects (patients) to exercise their rights, with OpenORDO's help as described in Section 8.

OpenORDO will:

  1. process Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise (in which case we will inform the Customer beforehand unless the law prohibits it);
  2. ensure that anyone authorised to process the data is bound by confidentiality;
  3. implement and maintain the technical and organisational measures in Annex 2;
  4. respect the conditions for engaging Sub-processors in Section 6;
  5. help the Customer respond to Data Subject requests and meet its own legal obligations (Sections 8 and 9);
  6. notify the Customer of Personal Data Breaches (Section 7);
  7. delete or return Customer Personal Data at the end of the Services (Section 11);
  8. make available the information needed to show compliance and allow audits (Section 10);
  9. tell the Customer if we believe an instruction breaches Data Protection Laws.

OpenORDO will not sell Customer Personal Data, use it for advertising, or use it to train generative AI models. OpenORDO will not combine Customer Personal Data with other data except to provide the Services.

The Customer acknowledges that Customer Personal Data will include health data, which is sensitive personal data under many laws. The Customer must not enter into the Services any data that is not necessary for delivering care and running the practice. The Customer must not enter government identifiers, payment card numbers or bank account details into free-text fields such as notes.

  1. General authorisation. The Customer gives OpenORDO general authorisation to engage the Sub-processors and authorises the categories of Sub-processors needed to run the Services (hosting, database, payments, email, sign-in, video, file storage).
  2. Change notice. We will give at least 30 days' notice, by email to the Customer's Owner and before a new Sub-processor starts processing Customer Personal Data.
  3. Right to object. The Customer may object on reasonable data protection grounds within that period by emailing support@openordo.com. We will work in good faith to find a solution; if none is found, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for the terminated period.
  4. Flow-down. Each Sub-processor is bound by written terms that provide protections no less protective than this DPA. OpenORDO remains responsible for its Sub-processors' performance.
  1. OpenORDO will notify the Customer's Owner (and the security contact, if set) without undue delay and in any event within 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data.
  2. The notice will include, as far as known: the nature of the breach; the categories and approximate number of Data Subjects and records; likely consequences; measures taken or proposed; and a contact point. We will supplement the notice as more information becomes available.
  3. OpenORDO will take reasonable steps to contain and remediate the breach and will cooperate with the Customer's investigation and regulatory notifications.
  4. The Customer is responsible for notifying regulators and Data Subjects where required, unless the law requires OpenORDO to do so.
  5. OpenORDO's notice of a breach is not an admission of fault or liability.

If a Data Subject contacts OpenORDO about Customer Personal Data (for example a patient asks for access or deletion), OpenORDO will not respond on substance, and will forward the request to the Customer promptly. The Services give the Customer tools to search, edit, export and delete patient records. Where the Customer cannot fulfil a request with those tools, OpenORDO will provide reasonable assistance at no additional charge, unless the request is manifestly excessive.

Taking into account the nature of processing, OpenORDO will reasonably assist the Customer with data protection impact assessments, consultations with regulators, security obligations, and breach notification, on request. Where the assistance goes beyond what is reasonable, OpenORDO may charge reasonable fees after notifying the Customer.

  1. OpenORDO will provide, on written request and no more than once a year, information reasonably needed to show compliance with this DPA, such as this page, the security description at Security & Trust, and the results of any independent assessments available.
  2. If the information is not enough, or a regulator requires it, the Customer may carry out an audit with at least 30 days' written notice, during business hours, subject to confidentiality and without disrupting the Services. Audits of Sub-processors are conducted through the reports and certifications those Sub-processors make available.
  3. Each party bears its own costs of an audit, unless the audit reveals a material breach by OpenORDO.
  1. On termination or expiry, the Customer may export Customer Personal Data using the export tools in Settings for the export period stated in Data Retention.
  2. After that period, OpenORDO will delete Customer Personal Data from active systems, and from backups within the backup rotation cycle in the Data Retention page, unless the law requires that we keep it. Anything we must keep will remain protected and used only for the legally required purpose.
  3. On request OpenORDO will confirm deletion in writing.
  1. Customer Personal Data is hosted in the region stated in the Privacy Policy (the locations configured for the service). OpenORDO and its Sub-processors may access or process it from other locations as needed to provide the Services.
  2. EU / UK data: Where Customer Personal Data subject to the EU or UK GDPR is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (Module Two, Controller to Processor, and, for the UK, the International Data Transfer Addendum), which are incorporated by reference. Annexes 1 and 2 of this DPA serve as the annexes to the clauses. The competent supervisory authority is that of the Customer's establishment.
  3. India: Transfers outside India are made only to the extent permitted by the DPDP Act and any restrictions notified by the Government of India.
  4. Other laws: If another law requires additional transfer mechanisms, the parties will work together to put them in place.

If the Customer is a covered entity or business associate under the US HIPAA rules, and the Customer has a paid plan and has signed our Business Associate Agreement, the HIPAA BAA also applies. If there is a conflict between the BAA and this DPA about PHI, the BAA prevails for that PHI.

Each party's liability under this DPA is subject to the limits and exclusions in the Terms of Service. Nothing in this DPA limits a party's liability to Data Subjects, or liability that cannot be limited by law.

This DPA lasts for as long as OpenORDO processes Customer Personal Data. If there is a conflict between this DPA and the Terms about the processing of Customer Personal Data, this DPA prevails. If there is a conflict between the Standard Contractual Clauses and this DPA, the Standard Contractual Clauses prevail.

ItemDescription
Subject matterProviding the OpenORDO clinic management Services
DurationThe term of the Customer's account, plus the export and deletion period
Nature and purposeHosting, storage, retrieval, display, backup, transmission, and deletion of clinic data so the Customer can manage patients, appointments, billing and records; sending transactional emails on the Customer's behalf; enabling video consultations when purchased; providing support
Data subjectsPatients and prospective patients (including minors); patients' guardians; the Customer's doctors, staff and other authorised users
Categories of personal dataNames, age, gender, phone, email, address, blood group, allergies, condition/reason for visit, appointment data, invoice items and amounts, diagnosis, prescription text and structured prescriptions, clinical notes, user account details (name, email, username, role), inventory items, uploaded files, video-call presence signals
Special categoriesHealth data (and, where entered by the Customer, any other sensitive data)
FrequencyContinuous
RetentionPer Data Retention

A fuller description is at Security & Trust. In summary OpenORDO maintains:

  1. Access control: role-based access (Owner, Admin, Doctor, Front Desk); authentication with hashed passwords or Google sign-in; email verification for new email accounts; session-based access with server-side checks on every action; separate platform-administrator role with server-side authorisation.
  2. Tenant isolation: every clinic-scoped record carries the clinic identifier, and every query is scoped to the signed-in user's clinic.
  3. Encryption: TLS for data in transit; encryption at rest provided by our database and infrastructure providers.
  4. Logging and accountability: audit log of administrative actions (suspensions, plan changes, promotions, role changes, add-on grants and deletions), with destructive actions requiring explicit confirmation.
  5. Payment security: card data handled only by Razorpay; payment events verified before processing.
  6. Minimisation and segregation: platform staff access limited to what is needed; production and development environments kept separate.
  7. Availability and recovery: managed database with backups, and documented restore procedures.
  8. Vendor management: Sub-processors assessed before engagement and bound by written terms.
  9. Incident response: a defined process for detecting, investigating, containing and notifying breaches.
  10. Personnel: confidentiality obligations and security awareness for staff with access.

OpenORDO may update these measures as long as the overall level of protection is not materially reduced.

Data protection queries: support@openordo.com · Legal: support@openordo.com · OpenORDO, Chandigarh, India