Corporate Compliance Policy & Technical Governance Framework
At OneHealthGrid (engineered and operated by Routeget Technologies Consulting Pvt. Ltd.), regulatory compliance is architected directly into our cloud infrastructure, databases, payment workflows, HL7 FHIR® APIs, and inbuilt Model Context Protocol (MCP) servers. This Corporate Compliance Policy serves as both our public declaration of adherence to national and international standards and our operational blueprint for SecOps, DevOps, and clinical data stewardship.
4 Critical Compliance Pillars Governing OneHealthGrid
1. NHA ABDM & HL7 FHIR® R4
Strict adherence to National Health Authority (NHA) Health Data Management Policy (HDMP), CERT-In empanelled WASA certification, HIP/HIU electronic consent artefacts, and FHIR R4 schemas.
2. DPDP Act 2023 & Database Security
Compliance with India’s Digital Personal Data Protection Act 2023, IT Act 2000 (SPDI Rules), and HIPAA/GDPR principles via AES-256 encryption at rest, TLS 1.3 in transit, and tenant isolation.
3. PCI-DSS v4.0 & RBI Payment Rules
Zero storage of raw credit/debit PAN or CVV data, RBI-compliant card tokenization, HMAC-SHA256 webhook verification, and automated ledger reconciliation with Microsoft Dynamics 365 Finance.
4. ISO 27001, CERT-In & AI/MCP Safety
CIS-hardened container runtimes, <=72h critical CVE patching, RPO <=15m / RTO <=2h disaster recovery, 180-day NTP-synced audit logs, and zero-training guardrails on inbuilt MCP servers.
Policy & Ops Modules
“OneHealthGrid is engineered in strict alignment with India’s DPDP Act 2023, NHA ABDM (CERT-In WASA) standards, HL7 FHIR® R4, ISO/IEC 27001:2022 controls, and PCI-DSS v4.0 payment tokenization. All clinical, institutional, and citizen health records are protected with AES-256 encryption at rest, TLS 1.3 in transit, and immutable RBAC audit trails.”
Request WASA audit summaries, SOC 2 / ISO 27001 control mappings, or report a compliance concern:
✉ compliance@onehealthgrid.com →
01. Document Purpose & Scope
This Corporate Compliance Policy establishes mandatory technical, financial, and regulatory controls across all OneHealthGrid environments, personnel, cloud workloads, APIs, and third-party sub-processors.
1.1 Purpose: This Corporate Compliance Policy (Policy ID: OHG-CCO-POL-2026.4) defines the binding technical, operational, financial, and regulatory governance framework maintained by Routeget Technologies Consulting Pvt. Ltd. for the OneHealthGrid digital health platform (https://onehealthgrid.com). It serves both as an authoritative public assurance to our B2B healthcare institutions, B2G public health authorities, and citizens, and as an enforceable internal standard for our engineering, DevOps, SecOps, and finance teams.
✓ Systems & Environments in Scope
Applies to all production, staging, disaster-recovery, and developer sandbox environments powering OneHealthGrid’s HIS, EHR, LIMS, RIS, Pharmacy, Telemedicine, Public Health Surveillance, NHA ABDM (HIP/HIU/ABHA) connectors, HL7 FHIR® R4 APIs, inbuilt Model Context Protocol (MCP) servers, and Microsoft Dynamics 365 Finance ERP bridges.
✓ Personnel & Entities in Scope
Binding upon all full-time employees, site reliability engineers (SREs), managed services operators, contractors, and vetted cloud/payment sub-processors of Routeget Technologies Consulting Pvt. Ltd., as well as B2B/B2G tenant administrators and API integration partners connecting to our ecosystem.
02. Financial, ERP & Payment Gateway Compliance
OneHealthGrid enforces strict PCI-DSS v4.0 (SAQ-A) and RBI tokenization compliance. We never store, log, or transmit raw credit/debit card numbers (PAN), CVVs, or UPI PINs on our servers, and all enterprise financial postings are cryptographically reconciled with Microsoft Dynamics 365 Finance.
All B2B SaaS subscription billing, hospital patient billing collections, and public health grant disbursements processed through OneHealthGrid adhere to strict financial security controls:
- Zero Raw Card Data Storage (PCI-DSS v4.0 Isolation): OneHealthGrid operates under a strict cardholder-data-avoidance architecture. Raw Primary Account Numbers (PAN), magnetic stripe data, CAV2/CVC2/CVV2 security codes, and banking PINs never touch OneHealthGrid application memory, databases, or log files. All payment capture occurs via isolated, TLS 1.3 hosted checkouts or sandboxed iframes operated by RBI-authorized, PCI-DSS v4.0 Level 1 certified payment gateways.
- RBI Card-on-File Tokenization & Idempotency: Recurring B2B SaaS subscriptions and institutional auto-debits utilize strictly scoped cryptographic gateway tokens in compliance with Reserve Bank of India (RBI) Card-on-File (CoF) Tokenization Directives. Every payment API request includes a unique UUID v4
Idempotency-Keyto prevent duplicate charges during network retries. - Cryptographic Webhook Verification: Asynchronous payment confirmation callbacks from payment gateways are validated at the API gateway layer using HMAC-SHA256 signature verification, strict timestamp replay-window checks (≤300 seconds), and IP allowlisting before any invoice status is updated.
- Microsoft Dynamics 365 Finance Audit & Tax Integrity: Operational billing events (patient invoicing, pharmacy sales, inventory procurement, and SaaS receivables) synchronized with Microsoft Dynamics 365 Finance enforce double-entry General Ledger (GL) validation, immutable voucher numbering, GSTIN/HSN/SAC tax verification, and segregation of duties (SoD) between billing creators and financial approvers.
03. Data Governance, Cryptography & Database Security
All databases enforce AES-256-GCM encryption at rest with KMS/HSM key rotation, TLS 1.3 in transit, strict multi-tenant Row-Level Security (RLS), India data residency, and zero-training isolation for inbuilt MCP AI servers.
To comply with India’s DPDP Act, 2023, the IT Act, 2000 (SPDI Rules, 2011), the NHA ABDM Health Data Management Policy, and international HIPAA/GDPR security rules, OneHealthGrid enforces defense-in-depth database governance:
A. Cryptographic Standards (At-Rest & In-Transit)
- Data-at-Rest: All relational databases, FHIR document stores, object storage buckets (radiology PACS/lab PDFs), and backup snapshots are encrypted using AES-256-GCM. Encryption keys are managed via FIPS 140-2/140-3 compliant Cloud KMS/HSM with automated 90-day key rotation.
- Data-in-Transit: All external web, mobile, HL7 FHIR API, and MCP server traffic enforces TLS 1.3 (with TLS 1.2 Perfect Forward Secrecy fallback minimum). Service-to-service microservice and ABDM gateway traffic utilizes mutual TLS (mTLS) and FIDH (Financial/Health Information Data Encryption) Elliptic Curve Diffie-Hellman (ECDH Curve25519) payload encryption.
B. Database Isolation, Access & Residency
- Multi-Tenant Isolation: B2B/B2G tenants are logically isolated via mandatory
tenant_idRow-Level Security (RLS) policies at the database engine layer, or dedicated schema/VPC instances for statewide public health deployments. - Zero Public DB Exposure: Database clusters reside exclusively in private VPC subnets with no public IP addresses, accessible only via bastardized Zero-Trust ephemeral bastion sessions with MFA and short-lived IAM certificates.
- India Data Residency: All primary and disaster-recovery data centers storing Indian citizen health records and ABHA-linked artefacts are physically located within the Republic of India (MeitY-empanelled / Tier-IV cloud regions).
04. System Continuity, Patch Management & Infrastructure Compliance
Our cloud infrastructure runs on CIS-hardened, immutable container runtimes with automated vulnerability scanning, =99.9% target uptime), and quarterly validated Disaster Recovery drills (RPO <= 15 mins, RTO <= 2 hours).
Healthcare delivery requires resilient, always-on infrastructure. OneHealthGrid maintains strict operational continuity controls:
- Hardened Configurations & Runtime Isolation: All application workloads execute inside non-root, read-only root-filesystem containers hardened against CIS Benchmark Level 1/2 profiles. Production, staging, and developer sandbox workloads run in strictly segregated VPCs with independent IAM roles and network security groups (NSGs). Inbuilt MCP servers execute in stateless, sandboxed worker pods with strict memory/CPU quotas and outbound egress filtering.
- Vulnerability & Patch Management SLA: Automated container image scanning (SAST/DAST/SCA) runs on every CI/CD build. Infrastructure and OS patches follow a strict remediation SLA: Critical CVEs (CVSS ≥ 9.0) within 72 hours; High CVEs (CVSS 7.0–8.9) within 7 days; and Medium CVEs within 30 days, deployed via zero-downtime rolling or blue/green releases.
- Backup Architecture & Disaster Recovery (RPO / RTO): Production databases utilize continuous write-ahead log (WAL) archiving plus automated daily snapshots replicated across geographically separated Indian availability zones (3-2-1 Backup Rule) with Object Lock (immutability against ransomware). Our committed recovery targets are Recovery Point Objective (RPO) ≤ 15 minutes and Recovery Time Objective (RTO) ≤ 2 hours.
- Quarterly Backup Restoration Validation: Backups are never assumed valid until tested. Every quarter, our SRE team executes an automated restoration drill into an isolated recovery VPC, verifying cryptographic checksums, relational integrity, and FHIR API responsiveness.
05. Immutable Audit Trails & Statutory Incident Reporting
Every clinical record view, ABDM consent transaction, API call, and admin action is recorded in append-only WORM audit logs synchronized via NTP and retained for at least 180 days (CERT-In directive). Security incidents follow a strict statutory escalation clock (6 hours for CERT-In).
Complete observability and rapid regulatory escalation are mandatory across our platform:
- Immutable WORM Audit Logging: Every CRUD operation on patient health records (EHR/HIS/LIMS), ABDM consent artefact creation/revocation, MCP tool invocation, privilege elevation, and payment webhook event is written in real time to an append-only, tamper-evident Write-Once-Read-Many (WORM) log store with cryptographic hash chaining. Each log entry captures
timestamp_utc,actor_user_id,hpr_id,tenant_id,source_ip,action_type,resource_id, andhttp_status. - CERT-In Time Synchronization & 180-Day Retention: In compliance with the Indian Computer Emergency Response Team (CERT-In) Directions of April 28, 2022 under Section 70B(6) of the IT Act, 2000, all servers, containers, and database nodes synchronize system clocks via Network Time Protocol (NTP) tied to National Physical Laboratory (NPL) / NIC stratum servers, and ICT security logs are retained securely within India for a minimum of 180 rolling days (and up to 7+ years for statutory clinical/financial audit trails).
- Statutory Incident Response & Escalation Clock: Upon detection of a confirmed security breach, unauthorized clinical data access, or compliance exception, our Incident Response Team (IRT) and Chief Compliance Officer execute the following mandatory notification timeline:
- Within 1 Hour: Internal containment, compromised credential/token revocation, and notification to the Chief Compliance Officer (CCO) and Data Protection Officer (DPO).
- Within 6 Hours (CERT-In Mandate): Formal incident report submitted to CERT-In for qualifying cyber incidents as mandated under the IT Act, 2000.
- Within 24 Hours: Detailed incident notification and forensic mitigation brief delivered to affected B2B/B2G Healthcare Institution Data Fiduciaries.
- Within Statutory Window (DPDP Act / NHA): Notification to the Data Protection Board of India (DPBI), the National Health Authority (NHA) (if ABDM gateways are impacted), and affected Data Principals.
