DATA PROCESSING ADDENDUM (INDIA)

Last updated: May 13, 2026 — Version DPA_IN_2026_V1 (Digital Personal Data Protection Act, 2023)

This Data Processing Addendum (“Addendum”) is entered into between Dhanvantari AI Lab Private Limited (“Marketplace”) and the healthcare provider or entity accepting these terms (“Doctor” or “Data Fiduciary”). It supplements the Terms and Conditions and Privacy Policy that apply to your use of the Dhanvantari AI Lab Private Limited doctor platform and related services.

1. Scope and Roles

Roles: The Doctor acts as the Data Fiduciary under the DPDP Act, 2023. The Marketplace acts as the Data Processor, processing Personal Data solely on behalf of and under the instructions of the Doctor, where that processing is performed for the Doctor in connection with the Marketplace services.

Subject matter: Processing of patient health records, appointment details, and contact information to facilitate the Marketplace services (including scheduling, consultations, messaging, and related workflows made available through the platform).

2. Obligations of the Marketplace (Processor)

Instruction-based processing: The Marketplace shall process Personal Data only for the purposes of providing the services and in accordance with the Doctor’s documented instructions, except where applicable law requires otherwise.

Data security: The Marketplace shall implement reasonable security safeguards (including encryption and access controls) to help prevent personal data breaches, consistent with Section 8 of the DPDP Act and applicable rules.

Confidentiality: Personnel authorized to process Personal Data shall be subject to appropriate confidentiality obligations.

Sub-processors: The Doctor hereby provides a general authorization for the Marketplace to engage sub-processors (for example, cloud hosting providers in India) as disclosed or updated from time to time in accordance with the Privacy Policy and product notices. The Marketplace shall remain responsible for sub-processor compliance with the obligations of this Addendum to the extent required by law.

3. Data Principal (Patient) Rights & Dual-Role Processing

The Marketplace shall provide the Doctor with reasonable tools to help fulfill patient requests, including the right to access, correction, and erasure, where applicable under law and consistent with clinical and legal record-keeping requirements.

Marketplace records (processor on behalf of the Doctor)

For data processed on behalf of the Doctor (for example, clinical notes, consultation records, and hospital or clinic appointments facilitated through the platform), the Marketplace shall redirect patient requests to the Doctor as the Data Fiduciary. The Marketplace will not delete such data without the Doctor’s explicit instruction, except where required by law or where the Marketplace is lawfully entitled or required to act independently (for example, security or abuse prevention).

B2C records (Marketplace as Data Fiduciary)

For data collected directly by the Marketplace via its consumer-facing platform (for example, app account profile, device or usage data described in the Privacy Policy, or search history where applicable), the Marketplace shall process rights requests independently as a Data Fiduciary, in accordance with its Privacy Policy and the DPDP Act.

4. Breach Notification

In the event of a personal data breach affecting Personal Data processed under this Addendum on behalf of the Doctor, the Marketplace shall notify the Doctor without undue delay, and in any case within twenty-four (24) hours of becoming aware of the breach where feasible, so that the Doctor can assess and fulfill mandatory reporting obligations to the Data Protection Board (DPB) and affected individuals as applicable.

5. Data Localization

The Marketplace confirms that Personal Data covered by this Addendum and processed for the Indian marketplace is stored on servers located within the territory of India, unless transfer outside India is explicitly permitted under the DPDP Act and applicable rules and, where required, appropriate safeguards and transparency are provided.

6. Termination and Deletion

Upon termination of the Service relationship (or upon written request where contractually agreed), the Marketplace shall, at the choice of the Doctor and where technically feasible, delete or return Personal Data processed on behalf of the Doctor, unless retention is required under Indian law (for example, medical record retention mandates, audit, or dispute resolution).