As Data Fiduciary under the DPDP Act 2023, SRIT India Limited shall: process Personal Data only for specified lawful purposes; implement reasonable security safeguards; notify the Data Protection Board of India and affected Data Principals of Personal Data Breaches; ensure Data Processors act only per OPLive App's instructions; and erase data upon purpose fulfilment or consent withdrawal, subject to legal retention requirements. OPLive App shall process Personal Data only to the extent necessary for its legitimate business purposes and in accordance with applicable law. Nothing in this Policy shall be construed as creating any greater obligation than that imposed under applicable law.
All data transmitted between Users and the Applications (OPLive App and OPLive Dr) is protected using TLS 1.2 or higher encryption in transit. HTTPS is enforced for all communications.
Health data and Sensitive Personal Data are encrypted at rest using AES-256 encryption. Encryption keys are held in a managed key management service with restricted, logged administrative access and periodic rotation. Backup data is encrypted prior to storage.
Access to Personal Data is restricted on a need-to-know basis using Role-Based Access Controls (RBAC). Multi-factor authentication (MFA) is implemented for personnel with access to production systems. All access events are logged. Third-party vendor access is governed by Data Processing Agreements. Access to Personal Data shall be granted strictly on the principle of least privilege and shall be reviewed periodically. Access rights shall be promptly revoked upon cessation or change of employment, engagement, or business need.
OPLive App collects only the minimum Personal Data necessary for each specified purpose. Analytics and diagnostic reporting is aggregated and, where reporting is derived from it, is presented in a form that does not identify an individual User. This does not mean that no identifiers are collected: device identifiers, push notification tokens, application identifiers and IP address are processed by the analytics, messaging and communications processors recorded in the Data Processing Agreement, and are declared as collected data in OPLive App's app store privacy declarations. Such identifiers are used only for performance monitoring, security, service improvement and delivery of the Services, and are never used for advertising.
OPLive App conducts security reviews and vulnerability assessments at least annually and before each major release, and commissions penetration testing by qualified independent security professionals at least once every twelve months. Vulnerabilities are remediated on a risk-assessed basis, with critical severity issues targeted for remediation within seven (7) days of confirmation and high severity issues within thirty (30) days, save where a vendor fix is not available within that period, in which case compensating controls are applied and the position is recorded in the risk register.
Upon becoming aware of a suspected Personal Data Breach, OPLive App activates its incident response process as soon as practicable, assesses breach severity, and takes immediate containment steps.
OPLive App shall notify the Data Protection Board of India within the prescribed statutory timeline upon confirmation of a breach, including: nature of breach, categories and estimated number of Data Principals affected, likely consequences, and measures taken.
Where an incident falls within the categories of cyber security incident notified under the Directions issued by the Indian Computer Emergency Response Team (CERT-In) dated 28 April 2022, OPLive App shall report the incident to CERT-In within six (6) hours of becoming aware of it, in the manner and format prescribed. OPLive App maintains system logs for a rolling period of one hundred and eighty (180) days within India and synchronises system clocks to NTP sources as required by those Directions. This obligation applies in addition to, and does not displace, the notifications required under the DPDP Act.
Where a Personal Data Breach is likely to affect a Data Principal, OPLive App shall notify each affected User without undue delay, in clear and plain language, through the Applications and by email or SMS to the registered contact details. The notification shall describe the nature and extent of the breach, the categories of Personal Data involved, the likely consequences, the measures OPLive App has taken or proposes to take to mitigate harm, the steps the User may take to protect themselves, and the contact details of the Data Protection Officer.
A Breach Register is maintained recording all suspected and confirmed breaches, assessment details, notifications, and remedial actions. Retained for a minimum of 5 years.
DPO: Abdul Nayeem | Email: dpo@oplive.app | Phone: +91 7994436622
Data protection considerations are embedded into the design of new features. Data Protection Impact Assessments will be conducted where practicable for high-risk processing activities.
Employees handling Personal Data receive periodic awareness training on data protection obligations and security best practices.
OPLive App shall require vendors processing Personal Data on its behalf to execute appropriate data processing agreements and implement reasonable security measures proportionate to the nature of the processing. Vendor compliance may be reviewed periodically.
OPLive App reserves the right to update this Policy from time to time to reflect changes in applicable law, regulatory guidance, security standards, technological developments, or business operations.
A current list of the sub-processors engaged by OPLive App, together with the nature of the service provided, the categories of User data processed and the country of storage, is published at www.oplive.app/sub-processors. The corresponding contractual particulars are recorded in Clause 5 of the Data Processing Agreement. The list is maintained by the Data Protection Officer and is also available on request at dpo@oplive.app.
While OPLive App implements reasonable administrative, technical, and organisational safeguards to protect Personal Data, no electronic system or method of transmission or storage can be guaranteed to be completely secure. OPLive App shall continuously endeavour to maintain appropriate security measures in accordance with applicable law and industry practices.