Data processing agreement

This DPA forms part of the terms between the practice (data fiduciary) and Gully System Pvt. Ltd. (data processor) for patient personal data processed through GullyMed.

Instructions

We process patient data only to provide the service and on the practice's documented instructions (including actions the practice takes in the console).

Security

Encryption in transit and at rest; per-practice row-level isolation in the database; append-only clinical records; audit logging of clinical and financial changes and of all support access.

Sub-processors

Amazon Web Services (Mumbai) — hosting and storage; MSG91 — SMS/WhatsApp delivery; Razorpay — payments on the practice's account; Cloudflare — DNS/TLS; Sentry — error monitoring (no patient content). We give 30 days' notice of changes.

Location

Patient data and media are stored in India.

Assistance

We assist with data-principal requests (access, correction, erasure), and notify the practice of a personal-data breach without undue delay.

Return and deletion

Export available in the console; deletion within 90 days of termination except where law requires retention.