1. PARTIES
- Data Fiduciary: SRIT India Limited, TC 24/3088/2, Ushasandya Building, Dotspace Business Centre, PMG TTC Road, Kowdiar, Thiruvananthapuram Kerala 695003 India (CIN: U72200KA1999PLC025692).
- Data Processor: The third-party processor identified in the Schedule executed with this Agreement. The processors currently engaged by the Data Fiduciary are listed in Section 5. A separate counterpart of this Agreement is executed with each processor, recording that processor's legal name, registered address and registration number.
2. DEFINITIONS
| Term |
Definition |
| Data Fiduciary |
SRIT India Limited — determines purpose and means of processing Personal Data. |
| Data Processor |
The third-party vendor executing this Agreement, processing Personal Data only per OPLive App's instructions. |
| Processing Instructions |
Written instructions from Data Fiduciary specifying scope, nature, purpose, and duration of processing. |
| Sub-processor |
Any third party engaged by the Data Processor to process Personal Data under this Agreement. |
| Personal Data Breach |
Accidental or unauthorised access, use, disclosure, alteration, or destruction of Personal Data. |
3. DATA PROCESSOR OBLIGATIONS
Process Personal Data strictly in accordance with documented instructions issued by OPLive App and solely for the purposes specified under this Agreement. The Data Processor shall not use, disclose, sell, share, analyse, or otherwise process Personal Data for its own purposes or for any third party.
- Ensure that all personnel and approved Sub-processors with access to Personal Data are bound by legally enforceable confidentiality obligations that survive termination of their engagement.
- Implement appropriate technical, organisational, and administrative security measures, including encryption, access controls, authentication, logging, and regular security monitoring, to protect Personal Data against unauthorised access, disclosure, alteration, or loss.
- Not engage Sub-processors without prior written authorisation from OPLive App.
- Assist OPLive App in fulfilling Data Principal rights (access, correction, erasure).
- Notify OPLive App in writing within twenty-four (24) hours of becoming aware of any actual or suspected Personal Data Breach, promptly contain the incident, cooperate fully in investigation and remediation, and provide all information reasonably required by OPLive App.
- Upon termination or expiry of this Agreement, return or securely delete all Personal Data (including copies, backups where technically feasible), and provide written certification of such deletion, unless retention is required by applicable law.
- Cooperate fully with compliance audits or reasonable information requests by OPLive App relating to data processing activities and promptly remedy any identified non-compliance.
4. SCHEDULE 1 — PROCESSING DETAILS (TEMPLATE, COMPLETED PER PROCESSOR)
Note: The table immediately below is a blank template. The bracketed entries in it are field prompts, not unfilled details. A completed copy of this table is executed with each processor. The processors currently engaged by the Data Fiduciary, together with their completed details, are set out in Section 5.
| Term |
Definition |
| Vendor Name |
[TO BE INSERTED] |
| Nature of Service |
[e.g., Cloud Hosting / Payment Processing / SMS / Analytics] |
| Categories of Data Processed |
[e.g., Identity data / Health data / Payment data / Technical data] |
| Purpose |
[e.g., Cloud storage of encrypted consultation records] |
| Retention Period |
[Specific period or 'Duration of commercial agreement + 30 days'] |
| Location of Processing |
[India / Overseas — specify country and region] |
| Sub-processors Approved |
[List any pre-approved sub-processors] |
4.1 Ownership and Use of Personal Data
All Personal Data processed under this Agreement shall remain under the control of the Data Fiduciary and shall be processed only for the authorised purposes specified by OPLive App. No ownership or other rights in the Personal Data are transferred to the Data Processor under this Agreement.
5. THIRD-PARTY PROCESSORS AND SUB-PROCESSORS
The Data Fiduciary engages the following third-party processors. Each such processor shall process Personal Data only on the documented instructions of the Data Fiduciary, shall be bound by written terms no less protective than this Agreement, and shall not engage any further sub-processor without prior written authorisation. The Data Fiduciary shall maintain and update this list; any new third-party processor must be approved in writing before Personal Data is shared with it.
5.1 Twilio — Video Conferencing Add-On
| Field |
Detail |
| Vendor Name |
Twilio Inc. (Programmable Video / Video Conferencing add-on), 101 Spear Street, First Floor, San Francisco, CA 94105, USA |
| Nature of Service |
Real-time video and audio conferencing infrastructure used for online consultations between Users on OPLive App and practitioners on OPLive Dr, including session signalling and media relay. |
| Categories of Data Processed |
Identity data (name/display name), technical data (IP address, device and network metadata), session metadata (participant IDs, call start/end time, duration). Video/audio streams are relayed in transit; no recording is enabled unless expressly instructed in writing by the Data Fiduciary. |
| Purpose |
Hosting and relaying live video consultation sessions within the OPLive platform. |
| Retention Period |
Session metadata: 30 days from session end. Media content: not stored (transit only), unless recording is expressly enabled in writing by the Data Fiduciary, in which case a retention period shall be agreed in writing before recording is enabled. Recording is not enabled as at the effective date of this Agreement. |
| Location of Processing |
Overseas — United States and Twilio regional edge locations; Indian media region to be selected where available. |
| Sub-processors Approved |
Twilio group entities and its cloud infrastructure providers, as disclosed in Twilio's published sub-processor list. Any addition requires prior written authorisation from the Data Fiduciary. |
5.2 Microsoft Azure — Cloud Hosting
| Field |
Detail |
| Vendor Name |
Microsoft Azure — Microsoft Corporation or Microsoft Regional Sales Pte. Ltd. |
| Nature of Service |
Cloud infrastructure and platform services — compute, storage, database, backup and related managed services hosting the OPLive platform. |
| Categories of Data Processed |
All categories of User data stored on the platform, including identity data, contact data, health/consultation records, payment metadata and technical/log data — stored in encrypted form. |
| Purpose |
Hosting, storage, backup and disaster recovery of OPLive App, OPLive Dr and their supporting databases. |
| Retention Period |
Duration of the commercial agreement + 30 days for deletion of backups and residual copies. |
| Location of Processing |
India — Azure Central India and South India regions. No transfer of Personal Data outside India without the prior written authorisation of the Data Fiduciary, save for support access under Microsoft's standard terms. |
| Sub-processors Approved |
Microsoft group entities and sub-processors listed in the Microsoft Online Services sub-processor list. Any addition requires prior written authorisation from the Data Fiduciary. |
5.3 SMSBuddy — SMS Gateway
| Field |
Detail |
| Vendor Name |
SMSBuddy (VA Networks - Ernakulam, Kerala, India) |
| Nature of Service |
SMS gateway services — transmission of transactional SMS, one-time passwords (OTPs), appointment and consultation notifications to Users. |
| Categories of Data Processed |
Contact data (mobile number), message content (OTPs, appointment and reminder text), delivery metadata (timestamps, delivery status, sender ID). |
| Purpose |
Delivery of transactional and authentication SMS messages to Users. No promotional or marketing use is permitted. |
| Retention Period |
Delivery logs: 90 days. Message content: not retained beyond the period necessary for delivery and regulatory/TRAI compliance. |
| Location of Processing |
India. |
| Sub-processors Approved |
Telecom operators and aggregators required for message delivery under TRAI DLT regulations. Any other sub-processor requires prior written authorisation from the Data Fiduciary. |
5.4 Razorpay — Payment Gateway
| Field |
Detail |
| Vendor Name |
Razorpay Software Private Limited, 1st Floor, SJR Cyber, 22 Laskar Hosur Road, Adugodi, Bengaluru, Karnataka 560030, India. |
| Nature of Service |
Online payment gateway and payment aggregator services (RBI-authorised) for collection of consultation and subscription fees from Users, including refunds and settlement. |
| Categories of Data Processed |
Identity data (name), contact data (email, mobile number), payment data (card token, UPI ID, bank/VPA details, transaction amount and status), technical data (IP address, device data) and fraud-prevention signals. Full card details are handled within Razorpay's PCI-DSS environment and are not stored by the Data Fiduciary. |
| Purpose |
Processing of payments, refunds, settlements, chargebacks and payment fraud prevention. |
| Retention Period |
Transaction records retained for the period required under RBI directions and applicable tax and accounting law (currently eight (8) years), and thereafter deleted. |
| Location of Processing |
India. Payment transaction data is stored in India in accordance with the RBI Storage of Payment System Data directive. |
| Sub-processors Approved |
Razorpay group entities, sponsor/acquiring banks, card networks, NPCI and its cloud infrastructure providers, as required to complete a transaction. Any other sub-processor requires prior written authorisation from the Data Fiduciary. |
5.5 SBIePay (State Bank of India) — Payment Gateway
| Field |
Detail |
| Vendor Name |
SBIePay — State Bank of India / SBIePay payment aggregator, State Bank Bhavan, Madame Cama Road, Nariman Point, Mumbai 400021, India. |
| Nature of Service |
Bank-operated payment gateway / aggregator services for collection of User payments via net banking, cards and UPI, including settlement to the Data Fiduciary's account. |
| Categories of Data Processed |
Identity data (name), contact data (email, mobile number), payment data (card token, UPI ID, net-banking reference, bank account and transaction details), transaction metadata and technical data (IP address). |
| Purpose |
Authorisation, processing and settlement of User payments, refunds and reconciliation. |
| Retention Period |
Transaction records retained for the period required under RBI directions and applicable tax and accounting law (currently eight (8) years), and thereafter deleted. |
| Location of Processing |
India. Payment transaction data is stored in India in accordance with the RBI Storage of Payment System Data directive. |
| Sub-processors Approved |
SBI group entities, acquiring and issuing banks, card networks and NPCI, as required to complete a transaction. Any other sub-processor requires prior written authorisation from the Data Fiduciary. |
5.6 Google Firebase — Push Notifications (FCM)
| Field |
Detail |
| Vendor Name |
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA |
| Nature of Service |
Push notification and cloud messaging services — Firebase Cloud Messaging (FCM) |
| Categories of Data Processed |
Device identifiers and Firebase Cloud Messaging registration tokens; mobile application identifiers and device/app information; notification delivery and technical metadata; IP address and network-related technical information, where applicable; notification payload data where included by the application; and delivery, diagnostic and messaging-related event information. No health data, consultation content or prescription information is included in notification payloads. |
| Purpose |
Delivery of push notifications to registered Android and iOS devices, comprising transactional and service-related notifications, application event notifications, device and account-related notifications, reminders and alerts, and notifications triggered by backend events. The Data Fiduciary shall minimise the information included in notification payloads and shall not include sensitive personal data, health data or consultation content directly within push notification content. |
| Retention Period |
FCM-related data is retained in accordance with Google's applicable service terms, data processing terms and Firebase service policies. Application-level notification and device-token data is retained only for as long as necessary to provide the notification service, and is deleted within thirty (30) days of the token becoming invalid or ceasing to be associated with the User's account. |
| Location of Processing |
Overseas. Firebase Cloud Messaging operates on Google's global infrastructure and does not offer a regional data-residency option; processing and storage locations may vary by Google infrastructure. Transfer outside India is accordingly governed by the cross-border clause below. Where OPLive App uses other Firebase or Google Cloud services for which regional data-location controls are available, those controls shall be configured to an Indian region. |
| Sub-processors Approved |
Google LLC and its relevant affiliates and service infrastructure providers involved in operating Firebase Cloud Messaging, subject to Google's applicable sub-processor and data-processing terms. Any addition requires prior written authorisation from the Data Fiduciary. |
| Additional Security and Privacy Measures |
FCM registration tokens are treated as technical device identifiers and are not exposed publicly. Notification payloads shall contain only the minimum information required, and shall not include sensitive personal or health information. Access to Firebase and Google Cloud services is restricted to authorised personnel. Device tokens are removed or refreshed when they become invalid or when the associated User or device is no longer active. TLS/HTTPS is used for all communication with Firebase services. |
Cross-border transfer and data localisation: Where a third-party processor stores or processes Personal Data outside India (including Twilio and Google Firebase), such transfer shall comply with Section 16 of the Digital Personal Data Protection Act, 2023 and any restrictions notified by the Central Government. Payment system data processed by the payment gateways listed above shall be stored only in India in accordance with the Reserve Bank of India's Storage of Payment System Data directive. Each processor shall notify the Data Fiduciary of any change in the country of storage before it takes effect.
5.7 Verification of Processor Particulars
The Data Fiduciary shall verify every entry in this Section against the executed contract with the relevant processor, and shall record the processor's full legal name, registered address and registration number for each. That verification shall be carried out before this Agreement is relied upon in any regulatory filing or disclosure, on each change of processor, and in any event at least once in every twelve (12) months. Any particular shown in square brackets is outstanding and shall be completed before execution of the relevant counterpart. The absence of a particular does not affect the obligations of the processor under Sections 3 and 5.
6. LIABILITY AND GOVERNING LAW
The Data Processor shall indemnify, defend, and hold harmless SRIT India Limited, its directors, officers, employees, affiliates, successors, and assigns against any claims, losses, liabilities, penalties, damages, costs (including reasonable legal fees), or regulatory actions arising out of: (i) breach of this Agreement; (ii) any Personal Data Breach attributable to the Data Processor or its Sub-processors; (iii) unauthorised processing or disclosure of Personal Data; or (iv) non-compliance with applicable data protection laws. This Agreement shall be governed by the laws of India, and the courts at Trivandrum, Kerala shall have exclusive jurisdiction.