| Data Category | Retention Period & Standard |
|---|---|
| Medical consultation records, diagnoses, notes | Retained for the period prescribed under applicable law, professional regulations, contractual obligations or OPLive's internal record retention requirements, whichever is longer. Where no mandatory period applies, OPLive may retain such records for up to five (5) years for clinical, legal, audit and dispute resolution purposes. |
| Digital prescriptions | Retained for the period prescribed under applicable law or for up to five (5) years, whichever is longer. |
| User account and identity data | Duration of account + 2 years post-closure. |
| Payment and financial records | 8 years (Income Tax Act, GST Law). |
| Consent records | Retained for the period reasonably necessary to demonstrate compliance with applicable law, defend legal claims and satisfy audit requirements. |
| Customer support and communication logs | 3 years (Consumer Protection Act). |
| System access and audit logs | 2 years (IT Rules 2021). |
| Marketing consent and opt-out records | Duration of consent + 1 year. |
| Data breach notification records | 5 years (DPDP Act, CERT-In). |
| Anonymised analytics data | Indefinite (not Personal Data). |
Electronic Personal Data shall be securely deleted, destroyed or rendered irrecoverable using industry-standard deletion methods appropriate to the storage medium and prevailing security practices. All deletion events shall be logged with the date, data category and authorised personnel.
Physical records and storage media containing Personal Data shall be securely destroyed using industry-standard methods appropriate to the type of media. Certificates of destruction, where applicable, shall be retained for three (3) years.
Backup copies containing Personal Data shall be securely deleted or overwritten in accordance with OPLive's backup retention schedule and applicable legal requirements.
Requests for data deletion (Right to Erasure) may be submitted to dpo@oplive.app. OPLive shall endeavour to process valid deletion requests within thirty (30) days, subject to applicable legal, regulatory, contractual and operational requirements. Medical records shall be retained for the applicable mandatory retention period notwithstanding any deletion request. Users shall be informed of such retention obligations at the time of their request.
Where Personal Data is retained beyond the applicable retention period for research, statistical analysis, product improvement or other lawful purposes, such data shall first be irreversibly anonymised so that no individual can be identified directly or indirectly.
Notwithstanding any deletion request, OPLive may retain Personal Data where such retention is required or permitted under applicable law, judicial or regulatory orders, contractual obligations, fraud prevention, dispute resolution, insurance requirements, taxation, audits, enforcement of legal rights, or ongoing investigations.
Nothing contained in this Policy shall require OPLive to delete or destroy any information where retention is required under applicable law, judicial order, regulatory direction or contractual obligation. OPLive shall not be liable for any inability to delete information where such retention is necessary to comply with applicable legal or regulatory requirements.
OPLive reserves the right to amend or update this Policy from time to time in accordance with applicable law and business requirements. The revised Policy shall become effective from the Effective Date stated therein and shall supersede all previous versions.
This Policy shall be reviewed at least annually by the Data Protection Officer. The Data Protection Officer may review and update this Policy more frequently where required by changes in applicable law, regulatory requirements, security incidents, business operations or internal compliance requirements.