MedeilPlus Privacy Policy

2.1 Vanuston as controller / data fiduciary: For website, sales, account-management, invoicing, support, communications, platform-security and similar business-administration data, Vanuston generally acts as the entity responsible for the relevant processing, subject to applicable law.

2.2 Vanuston as processor: For Customer Data processed through the Platform on behalf of a healthcare organisation, Vanuston generally acts as a processor/service provider. The relevant customer is responsible for identifying the appropriate lawful basis, issuing privacy notices, managing patient or user requests, configuring access, retaining records and obtaining consent where required. The DPA governs those processing activities and prevails if it conflicts with this Policy.

2.3 Definitions: "Customer" means the organisation that subscribes to or uses the Services. "Customer Data" means information submitted to or generated in the Services by or for Customer. "Personal Data" means information relating to an identified or identifiable individual, as defined by applicable law. "Platform" means the MedeilPlus software, interfaces and related services.

3.1 Website, enquiries and commercial contacts

• Name, business email address, telephone number, organisation, designation and enquiry details.

• Information submitted in demo, contact, trial, event, partner, job or request forms.

• Website and cookie-related information, including IP address, browser, device, pages viewed, referral information, approximate location derived from IP and interaction information, where such collection is enabled.

3.2 Account, organisation and billing administration

• Organisation name, entity and tax details, business addresses, sites, selected modules, deployment model, authorised contacts, user identifiers, role and verification status.

• Contract, order, subscription, invoice, payment-status, support-entitlement and agreement-acceptance records. Payment-card data should be processed by the applicable payment provider and not stored by Vanuston except as necessary for transaction administration.

• Clickwrap/e-signature evidence, including agreement name and version, acceptance timestamp, user/organisation identifier, IP address, session or device information and a record of the text/version presented.

3.3 Platform, security and support data

• Authorised-user profile information, authentication events, access permissions, audit logs, IP address, device/browser data, session information, error logs, diagnostic information and security events.

• Support correspondence, service requests, attachments, call or meeting records where notice and consent are provided as required, and incident-management records.

3.4 Customer Data processed for Customers

Depending on the modules Customer enables, Customer Data may include patient identifiers, contact details, demographics, appointment records, clinical notes, medication, prescription, laboratory, imaging, billing, insurance, inventory, supply-chain, rehabilitation, workforce, public-health or other operational information. Certain information may be sensitive or subject to enhanced protections under applicable law. Vanuston does not require Customers to enter more Personal Data than is necessary for their intended and lawful use of the Services.

Vanuston may process Personal Data for the following purposes, subject to applicable law and the role described above:

• Provide, administer, secure, maintain, support and improve the Services; create and manage accounts; process orders and payments; and communicate operational notices.

• Authenticate users, manage authorisation, maintain audit trails, prevent fraud and abuse, investigate incidents, protect systems and meet legal or contractual obligations.

• Respond to enquiries and support requests, conduct implementation and training, manage customer relationships and measure service performance.

• Send marketing communications only where permitted and subject to available opt-out or consent choices. Operational, security, legal and service communications are not marketing communications.

• Process Customer Data solely as needed to provide the Platform and related Services, comply with documented Customer instructions, maintain security, prevent misuse, meet legal obligations and as otherwise stated in the DPA.

Where Indian law applies, Vanuston processes Personal Data with consent where consent is required, for specified lawful purposes, to perform a contract or take requested pre-contractual steps, to comply with law, to protect security and prevent fraud, or on another basis available under applicable law. Where another data-protection regime applies, Vanuston will rely on the relevant legal ground under that regime.

Customers are responsible for determining and documenting the lawful basis for their processing of Customer Data, including patient and workforce data. Consent should not be bundled with non-essential processing and may be withdrawn where applicable. Withdrawal does not necessarily require deletion where continued retention or processing is required or permitted by law, necessary for the provision of requested services, or subject to a legal claim, record-retention or safety obligation.

Vanuston does not sell Personal Data. We may disclose Personal Data only as appropriate for the purposes described in this Policy and subject to applicable law:

• To Customer and authorised users, for Customer Data and account administration.

• To approved service providers and sub-processors that assist with hosting, infrastructure, authentication, communications, payment processing, support, security, professional services or other service delivery functions, subject to contractual confidentiality and data-protection obligations.

• To affiliates, advisers, auditors, insurers, financing sources or parties involved in a corporate transaction, subject to appropriate safeguards and lawful requirements.

• To competent public authorities, regulators, courts or law-enforcement bodies where disclosure is required by applicable law, legal process or a valid request, and, where lawful and practicable, after notice to Customer or the affected person.

• With other recipients at the direction of Customer or the individual, or with consent where required.

The current sub-processor list, where applicable, is maintained in the DPA, Customer portal or another notice communicated to Customers. Before publication, Vanuston must ensure this Policy links only to a genuine, maintained sub-processor list.

Hosting, backup, support and processing locations depend on the selected deployment model and applicable Order Form. For cloud services, the intended primary hosting/data-residency location is [India / insert actual region]. Backup, disaster-recovery, support or sub-processor processing may occur in other locations only as described in the applicable DPA, Order Form and current sub-processor information, and subject to applicable legal requirements.

For private-cloud, on-premises or hybrid deployments, Customer may control all or part of the hosting environment. Customer remains responsible for the infrastructure and data transfers it controls unless the written agreement allocates that responsibility to Vanuston. Where cross-border transfers are made, the Parties will apply safeguards and transfer mechanisms required by applicable law.

Vanuston retains Personal Data only for as long as reasonably necessary for the stated purpose, contractual relationship, security, dispute resolution, legal requirements and legitimate record-keeping needs. Retention periods may differ by data category and deployment model. Customer Data retention, return and deletion are governed by the DPA, Order Form, applicable law, legal holds and technical backup cycles.

Suggested records for Vanuston to confirm before publication: account and contract records — [●]; security logs — [●]; support records — [●]; website analytics — [●]; backup retention — [●]. For Cloud Customer Data, the contract/DPA should specify the export window after termination and deletion process. For On-Premises deployments, Customer generally controls retention and deletion of its local data.

Vanuston uses technical and organisational measures designed to protect Personal Data appropriate to the nature of the Services and the risks involved. Measures may include access controls, role-based permissions, encryption where applicable, authentication controls, logging, monitoring, secure development practices, vulnerability management, backups, incident-response procedures and staff confidentiality obligations. Actual controls depend on the service, configuration and deployment model.

No system, network or transmission is completely secure. Customer is responsible for safeguarding credentials, enabling available security controls, restricting access, training its users, keeping Customer-controlled systems secure and promptly reporting suspected misuse or incidents. Vanuston will not request passwords through unsolicited communications.

Depending on applicable law and Vanuston's role, individuals may have rights to request information about processing, access Personal Data, correct or update inaccurate data, withdraw consent, seek erasure where applicable, nominate another person to exercise rights where permitted, raise a grievance, object to or restrict certain processing, or obtain data portability. These rights are not absolute and may be subject to identity verification, legal exemptions, third-party rights, security requirements and record-retention obligations.

For Personal Data for which Vanuston is responsible, submit a request to privacy@vanuston.com [confirm before publication] with the subject "Privacy Request". Provide enough information for us to verify identity and understand the request. For Patient or other Customer Data processed on behalf of a healthcare organisation, individuals should first contact the relevant healthcare organisation or Customer, which is generally best placed to verify identity and decide the request. Vanuston will assist Customers as required by the DPA and applicable law.

Vanuston will respond within the period required by applicable law. Where a request is refused or limited, we will provide an explanation where required. Individuals may also have a right to complain to the appropriate regulator or authority.

The Services are business-to-business healthcare and operational services and are not directed to children for independent consumer use. Customer may use the Platform to process data relating to minors, persons with disabilities or persons requiring a guardian. In such cases, Customer is responsible for ensuring that appropriate parent, guardian or authorised-representative notices, permissions and workflows are used as required by applicable law.

Customer must apply appropriate role, access and confidentiality controls to sensitive or high-risk data, including health, mental-health, genetic, reproductive, biometric or other protected information where processed. Vanuston's role remains limited to the technical processing agreed with Customer and applicable law.

Vanuston's websites may use cookies, local storage, pixels or similar technologies for essential operation, security, preferences, analytics and, where applicable, marketing. A cookie banner or preference centre should be used where required by law. You can manage browser settings; however, disabling certain technologies may affect website functionality.

Before publication, Vanuston must publish a current cookie notice identifying the technologies actually used and available choices.

We may update this Policy to reflect changes in the Services, processing practices, law or operational requirements. We will post the updated Policy with a revised "Last updated" date and, where required, provide additional notice or obtain new consent. The version in effect when Personal Data is processed will apply, subject to applicable law and contractual commitments.

For privacy questions, requests or complaints, contact: Privacy / Grievance Contact, Vanuston Intelligence Pvt. Ltd.; email: privacy@vanuston.com [confirm before publication]; postal address: [insert complete address]. Please do not send unnecessary clinical records or sensitive identity documents by unencrypted email. We may provide a secure method if further verification is needed.

If you are dissatisfied with our response, you may contact the appropriate data-protection authority or other competent authority as permitted by applicable law. Nothing in this Policy limits rights that cannot lawfully be limited.

This Policy is issued in English. Any translation is provided for convenience unless a signed or published notice expressly provides otherwise. In case of inconsistency, the English version prevails to the extent permitted by applicable law. This Policy should be read with the MedeilPlus Master Terms and Conditions, applicable DPA, Service Level Agreement, End User Agreement, Medical Liability Disclaimer, Cookie Notice and Customer-specific Order Form or deployment schedule.

By using the Services, you acknowledge that you have had an opportunity to read this Privacy Policy. Where consent is required, Vanuston or the relevant Customer will request it separately through an appropriate, clear and affirmative process. Continued use alone does not replace consent where consent is legally required.