Version 2026-10
zMed Data Processing Agreement — Hospital Platform
Version: 2026-10 · Last updated: 8 October 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between zMed Healthcare Technologies Private Limited (“zMed”) and the Customer. It applies whenever zMed processes personal data on the Customer’s behalf through the Platform. Words defined in the Terms have the same meaning here.
1. Roles and scope
1.1 For Patient Data, and any other personal data that the Customer or its Authorised Users enter into the Platform about patients, relatives, visitors and the Customer’s own staff in the course of care and hospital administration, the Customer is the Data Fiduciary and zMed is its Data Processor under the Digital Personal Data Protection Act 2023 (“DPDP Act”).
1.2 For the account, billing and sign-up data described in Part A of the Privacy Notice, zMed is a Data Fiduciary in its own right, and this DPA does not apply.
1.3 The subject matter, duration, nature and purpose of the processing, and the types of personal data and data principals, are set out in Annex 1.
1.4 The DPDP Act places the statutory duties on the Data Fiduciary and requires it to engage a processor only under a valid contract. This DPA is that contract.
2. The Customer’s instructions
2.1 zMed processes the personal data only on the Customer’s documented instructions. The Terms, this DPA, the Customer’s Order, the Customer’s configuration of the Platform, and the actions of its Authorised Users in the Platform are the Customer’s instructions.
2.2 zMed will tell the Customer if it believes an instruction breaks the law, and may pause acting on that instruction until the Customer confirms or changes it.
2.3 zMed will not process the personal data for its own purposes, sell it, use it for advertising, or use it to train artificial-intelligence models. The operational statistics described in clause 11.3 of the Terms contain no personal data of patients.
2.4 If the law requires zMed to process or disclose the personal data otherwise than on the Customer’s instructions, zMed will tell the Customer first unless the law forbids it.
3. The Customer’s obligations
The Customer is responsible for: the lawfulness of the personal data and of its instructions; the notices to, and consents of, data principals (including parents and guardians); deciding what is recorded and who among its staff may see it; responding to data principals; its own notifications to the Data Protection Board of India and to data principals; and retaining medical records for the periods the law requires.
4. Confidentiality and zMed personnel
4.1 zMed ensures that everyone it authorises to access the personal data is bound by a duty of confidentiality and accesses it only as needed to provide, secure and support the Platform.
4.2 zMed staff with platform-administrator roles are technically able to access any customer’s data. zMed limits those roles to the people who need them and reviews them when staff join, move or leave.
5. Security
5.1 zMed maintains the technical and organisational measures in Annex 2. zMed may change them, provided the overall level of protection is not reduced.
5.2 Annex 2 states plainly which measures are in place and which are not at its version date. The Customer has reviewed it and decides whether the measures are appropriate for the personal data it puts into the Platform.
6. Sub-processors
6.1 The Customer authorises zMed to engage the sub-processors in the Sub-processor List at the version date, for the purposes shown there. The list is provided on request.
6.2 zMed will give the Customer’s administrators at least 30 days’ notice by e-mail before adding or replacing a sub-processor that will process Patient Data. If the Customer objects on reasonable data-protection grounds within that period and the parties cannot agree a solution, the Customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees.
6.3 zMed binds each sub-processor by a written contract with data-protection obligations no less protective than this DPA, and remains responsible to the Customer for each sub-processor’s performance.
6.4 Optional features that send data to further recipients — AI features, electronic signature, ABDM, maps, patient messaging — are off unless the Customer switches them on or asks for them. The Sub-processor List shows the recipients for each.
7. Location of processing
7.1 zMed stores the personal data on infrastructure located in India.
7.2 zMed will not move storage of Patient Data outside India without the Customer’s prior written agreement. Sub-processors for optional features may process data outside India; the Sub-processor List shows where, and those features stay off unless the Customer switches them on.
8. Helping the Customer with data principals’ requests
8.1 If a data principal contacts zMed about personal data that zMed processes for the Customer, zMed will pass the request to the Customer without undue delay and will not answer it except to say that it has done so.
8.2 The Platform lets the Customer’s Authorised Users view, correct and print records. Where the Customer cannot fulfil a request (access, correction, completion, erasure, or withdrawal of consent) using the Platform’s own functions, zMed will give reasonable help on request.
9. Personal-data breaches
9.1 zMed will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting the Customer’s personal data.
9.2 The notice will be sent to the Customer’s administrator and billing e-mail addresses and will describe, as far as known: what happened, when, the data and approximate number of data principals and records affected, likely consequences, and what zMed has done and proposes to do. Further information follows as it becomes available.
9.3 zMed will take reasonable steps to contain and remedy the breach and will co-operate with the Customer’s own notifications. zMed will not notify the Board or data principals on the Customer’s behalf unless the Customer asks or the law requires.
10. Return and deletion
10.1 During the contract the Customer can export data using the export and print functions the modules provide.
10.2 At the end of the contract, clause 18.5 of the Terms applies: an Export Period, an export on request in a commonly used structured format, then deletion from live systems, with backups expiring in their ordinary cycle.
10.3 zMed may retain personal data only where, and for as long as, the law requires it, and will keep it confidential and process it no further.
10.4 zMed will confirm deletion in writing on request.
11. Information and audit
11.1 zMed will make available, on request and under confidentiality, the information reasonably needed to show that it meets this DPA: a description of its security measures, a summary of its most recent independent security assessment, and copies of any certificates it holds.
11.2 Not more than once a year, or after a personal-data breach affecting the Customer or when a regulator requires it, the Customer may audit zMed’s compliance with this DPA, on 30 days’ written notice, during business hours, without access to other customers’ data, at the Customer’s cost, and through an independent auditor bound by confidentiality where the Customer does not act itself. The parties will first consider whether the information in clause 11.1 answers the Customer’s need.
12. Liability, term and priority
12.1 Liability under this DPA is subject to the limits in the Terms.
12.2 This DPA lasts as long as zMed processes the personal data for the Customer.
12.3 If this DPA and the Terms conflict about personal data, this DPA prevails.
Annex 1 — Details of the processing
| Subject matter | Hosting and operation of the Platform for the Customer’s healthcare facilities |
| Duration | The term of the contract, plus the Export Period and deletion period |
| Nature | Collection (including from connected bedside devices), recording, storage, organisation, retrieval, display, transmission to recipients the Customer directs, generation of documents and reports, backup, deletion |
| Purpose | Enabling the Customer to register patients; record and manage care; order, bill and report; monitor connected devices; run hospital administration; and train its staff |
| Data principals | Patients; patients’ relatives, guardians and emergency contacts; the Customer’s staff and clinicians as they appear in records; referring doctors; visitors |
| Personal data | Identity and contact details; identifiers (hospital record number, ABHA number where provided, other identity documents where the Customer records them); demographic data; insurance and billing data; health data — history, findings, diagnoses, notes, orders, prescriptions, results, images, charts, vital signs and device waveforms; consent records and signatures; audio and video where teleconsultation, tele-ICU or recorded consent is used |
| Children’s data | Yes, where the Customer treats children; see Part B5 of the Privacy Notice |
| Frequency | Continuous |
Annex 2 — Technical and organisational measures
The description of measures is being finalised and will be published here before this document takes effect.
H. Certificates and attestations
zMed makes no certification claim in this DPA. Copies of certificates held are available on request.
Questions about these terms: contact@zmed.tech.