Privacy and Data Sharing Policy
Platform: Easy Second Opinion
Jurisdiction: Republic of India
Statutory Framework: Digital Personal Data Protection Act, 2023 (DPDP Act); Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; Information Technology Act, 2000.
International Alignment: Benchmarked against the EU General Data Protection Regulation (GDPR) and the US Health Insurance Portability and Accountability Act (HIPAA) Security Standards.
Effective Date: 19/09/2026
1.	Introduction and Data Fiduciary Identity
Easy Second Opinion ("Company", "we", "us") operates as a "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 (DPDP Act). We recognize the profoundly sensitive nature of personal health data and are committed to executing absolute confidentiality, data minimization, and industry-standard security.
This Privacy and Data Sharing Policy ("Privacy Policy") governs how we collect, process, store, encrypt, transfer, and protect your digital personal data and Sensitive Personal Data or Information (SPDI).

2.	Classes of Data Collected
We collect only the information strictly necessary to facilitate high-precision medical second opinions and maintain regulatory compliance:
Identity and Demographic Data: Full legal name, gender, date of birth, age, residential address, nationality, national identity proofs (where requested for fraud mitigation or KYC), primary telephone number, and email address.
Sensitive Personal Data or Information (SPDI) / Health Data:
Comprehensive medical history, past surgical notes, discharge summaries, family history, and outpatient prescriptions.
Pathological, histological, cytological, and genetic diagnostic test outputs.
Radiological examinations in native digital formats (DICOM, CT, MRI, Ultrasound, X-ray) or secondary formats (JPEG, PNG, PDF).
Teleconsultation Records: Encrypted clinical notes made by the RMP, audio/video consultation session metadata (duration, connection IP, timestamp), and secure platform messaging logs.
Billing and Transaction Metadata: Digital payment reference numbers, masked card tokens, invoicing addresses, and taxation 
identifiers. (Full credit/debit card numbers, CVVs, and banking passwords are never captured or retained on our infrastructure).
Technical Telemetry: IP address, device fingerprints, operating system specifications, browser attributes, and authenticated session cookies.

3.	Lawful Basis and Purpose Limitation of Processing
Under the DPDP Act 2023, data processing occurs on the lawful basis of Informed, Specific Consent and Statutory Healthcare Compliance. Data is processed solely for:
Matching and assigning medical dossiers to qualified, independent RMPs.
Permitting RMPs to analyze patient records, deliberate on clinical findings, and generate a Second Opinion Report.
Managing billing, authentication, customer support, and system health.
Complying with regulatory obligations under the NMC Telemedicine Practice Guidelines, Indian Medical Council (Professional Conduct, Etiquette, and Ethics) Regulations, 2002, and judicial subpoenas.
Strict Prohibition on Generative AI and Commercial Exploitation:
We explicitly pledge that your identifiable health records, imaging files, and consultation transcripts will never be sold, rented, leased, or licensed to data brokers, pharmaceutical marketers, or third-party advertisers. Furthermore, no identifiable or pseudonymous patient data will be ingested into, utilized for, or processed to train any commercial Large Language Model (LLM) or Generative Artificial Intelligence (GenAI) system without a distinct, affirmative, and separate consent agreement.

4.	Architecture of Data Sharing and Onward Transfer
Data is shared exclusively on a strict "need-to-know" basis with authorized entities who are legally bound by confidentiality agreements matching the standards of this Privacy Policy:
Empanelled RMPs: Registered Medical Practitioners reviewing the case. RMPs are bound by statutory medical ethics, confidentiality laws, and stringent platform non-disclosure agreements.
Authorized Technological Processors (Data Processors): Enterprise cloud infrastructure providers (e.g., Amazon Web Services [AWS], Microsoft Azure) maintaining data centers compliant with ISO/IEC 27001, SOC 2 Type II, and HIPAA security guidelines.
Payment Gateways: RBI-authorized payment processors receiving only transaction-specific identifiers to complete financial settlements.
Judicial and Regulatory Enactments: Data will only be disclosed to external government entities, law enforcement, or courts of competent jurisdiction pursuant to an official, legally enforceable summons, warrant, or statutory order under Indian law.

5.	Cross-Border Data Transfers (Notice to International Patients)
Primary Processing in India: Easy Second Opinion operates its core digital platform and medical advisory infrastructure from the Republic of India.
Explicit Cross-Border Consent: If you access this Platform from foreign jurisdictions—including the United States, the European Economic Area (EEA), the United Kingdom, Canada, Australia, or the Gulf Cooperation Council (GCC)—you expressly acknowledge
and agree that your personal data and SPDI will be transferred to, hosted in, and processed within India.
Legal Harmonization: You acknowledge that Indian data protection standards (the DPDP Act, 2023) govern the handling of your data. While local statutes (such as the GDPR or HIPAA) may grant specific procedural rights in your domestic territory, you consent to the handling of your data under Indian jurisdiction, underpinned by our deployment of end-to-end encryption (AES-256 at rest, TLS 1.3 in transit) and enterprise access controls.

6.	Data Retention, Archival, and the Statutory Override
Statutory Clinical Retention (NMC Mandate): In strict accordance with the NMC Telemedicine Practice Guidelines, 2020, and the Indian Medical Council Regulations, every RMP and telemedicine platform is legally obligated to maintain an immutable record of clinical consultations, uploaded reports, and issued advice for a mandatory minimum period of three (3) years from the date of service execution.
Precedence Over Erasure Rights: The User understands that while privacy statutes (including the DPDP Act 2023 and GDPR) afford a "Right to Erasure" or "Right to be Forgotten," this right is legally subordinate to statutory, regulatory, and public health record-keeping obligations. If a User requests account deletion, the public-facing profile will be decommissioned; however, all clinical files, diagnostic uploads, and issued reports will be isolated, access-restricted, and archived for the mandated 3-year statutory term, after which they will be permanently purged using DoD-standard digital sanitation protocols.

Medico-Legal Retention: In cases where a formal legal dispute, chargeback claim, or clinical investigation has been initiated, records will be retained indefinitely until the full and final judicial resolution of the matter.

7.	Rights of the Data Principal
Under the DPDP Act 2023, you maintain the following actionable rights, exercisable by writing to our designated Data Protection Officer:
Right to Access Information: The right to obtain an authenticated summary of personal data being processed and the identities of Data Processors with whom such data has been shared.
Right to Correction and Updating: The right to rectify inaccurate, out-of-date, or incomplete personal demographic data. (Clinical assessments and signed second opinions cannot be retrospectively altered as they represent historical medical evaluations).
Right to Grievance Redressal: The right to accessible, timely resolution of complaints regarding data protection non-compliance.
Right to Nominate: The right to nominate an individual who, in the event of the Data Principal's death or incapacity, shall exercise their data rights.

8.	Data Security and Breach Management
We maintain rigorous administrative, technical, and physical safeguards:
All data transmissions across the Platform are encrypted using TLS 1.3 protocols.
All data repositories, databases, and backup stores are encrypted using military-grade AES-256 encryption.
Multi-Factor Authentication (MFA) and strict Role-Based Access Controls (RBAC) restrict internal personnel access to patient dossiers.
Breach Notification: In the event of a verified personal data breach, the Company will notify the Data Protection Board of India (DPBI) and affected Data Principals in accordance with statutory guidelines prescribed under the DPDP Act 2023.

9.	Statutory Data Protection Officer (DPO) and Inquiries
For any inquiries regarding this Privacy Policy, the exercise of data rights, or data security practices, contact our designated statutory officer:
Data Protection & Grievance Officer
Designation: Compliance & Data Security Lead
Corporate Address: Easy Second Opinion, [Insert Physical Address], Mumbai, Maharashtra – [Pin Code], India
Electronic Mail: dpo@easysecondopinion.com

Official Turnaround Time: Acknowledgment within 24 hours; formal resolution within thirty (30) calendar days.