Privacy Policy & Data Governance Notice
At OneHealthGrid (operated by Routeget Technologies Consulting Pvt. Ltd.), we believe that privacy is the foundation of healthcare trust. This Layered Privacy Notice explains—in plain, transparent language—how we collect, process, safeguard, and govern personal and healthcare data across our B2B/B2G digital health platform, ABDM integrations, open APIs, and inbuilt MCP servers.
Privacy at a Glance: Our 4 Core Commitments
1. Clear Role Separation
For B2B/B2G clinical operations (EHR/HIS/LIMS), your Hospital or Government Health Department is the Data Fiduciary; OneHealthGrid acts strictly as your Data Processor.
2. Zero Data Monetization
We never sell, rent, or trade patient health records, ABHA IDs, prescriptions, or diagnostic results to advertisers, brokers, or unauthorized third parties.
3. Consent-Led ABDM & AI
ABDM record exchange occurs strictly via verifiable electronic consent artefacts. Our inbuilt MCP servers and AI tools never train public LLMs on clinical data.
4. Defense-in-Depth Security
All data is protected with TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access control (RBAC), immutable audit logs, and India data residency.
01. Introduction & Our Commitment
Healthcare runs on trust. Whether you are a hospital administrator digitizing clinical workflows, a state public health official managing population-scale programs, a clinician caring for patients, or a citizen accessing your ABHA-linked health records, we treat your data with the highest degree of legal, technical, and ethical stewardship.
Welcome to OneHealthGrid (https://onehealthgrid.com), an AI-ready, interoperable digital healthcare platform owned and operated by Routeget Technologies Consulting Pvt. Ltd. (“OneHealthGrid”, “Routeget”, “we”, “us”, or “our”).
Because OneHealthGrid operates at the intersection of enterprise healthcare software (B2B), public health infrastructure (B2G), and citizen-centric digital health interoperability, our privacy governance is structured around a clear legal distinction under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 (SPDI Rules), the Ayushman Bharat Digital Mission (ABDM) Health Data Management Policy, and international frameworks (GDPR & HIPAA):
When We Act as a Data Fiduciary (Controller)
When you visit onehealthgrid.com, request a product demo, register for our Developer Sandbox, subscribe to our updates, or contract with us as a B2B/B2G client, partner, or vendor, we determine the purpose and means of processing your business contact, account, and billing data.
When We Act as a Data Processor (Business Associate)
When a Hospital, Clinic, PHC, Diagnostic Lab, Pharmacy, NGO, or Government Health Department uses OneHealthGrid’s HIS, EHR, LIMS, Telemedicine, or ABDM modules to manage patient care, the Healthcare Institution is the Data Fiduciary, and OneHealthGrid processes clinical/patient data strictly on their documented instructions.
02. What Data We Collect & Why
We only collect data that is necessary to deliver, secure, and improve our platform. We separate the data you directly provide to us from technical telemetry collected automatically and clinical records processed under B2B/B2G institutional agreements.
A. Data You Give Us Directly
- Business & Demo Inquiries: Full name, work email, mobile number, organization/hospital name, designation, and organization type submitted via our Consultation, Contact, or Demo forms.
- Practitioner & Staff Accounts: Clinician name, Healthcare Professional Registry (HPR) ID, role/department, facility affiliation (HFR ID), and authentication credentials.
- Developer & Partner Portal Data: Developer name, organization, API client identifiers, OAuth2 callback URIs, and sandbox test logs.
- Billing & Financial Data: GSTIN, corporate billing address, invoice records, and payment transaction references processed via PCI-DSS compliant payment gateways (we never store raw credit/debit card numbers or CVVs).
B. Data Collected Automatically
- Device & Network Telemetry: IP address, browser type/version, operating system, screen resolution, and referring URLs.
- Platform Usage & Security Logs: Login timestamps, session duration, API call latency, error traces, and role-based access audit trails required for healthcare security compliance.
- Cookies & Analytics Signals: Page interaction events collected via Google Analytics 4 and campaign attribution signals via Meta (Facebook) Pixel on public marketing pages only.
C. Healthcare, ABDM & Citizen Data Processed on Behalf of Healthcare Institutions
When authorized by a subscribing healthcare provider or public health authority, the platform processes Sensitive Personal Data / Digital Health Data—including patient demographics, 14-digit ABHA (Ayushman Bharat Health Account) numbers, ABHA addresses, OPD/IPD clinical encounters, e-Prescriptions, LIMS lab reports, radiology summaries, PM-JAY / insurance claim artefacts, and electronic consent artefacts—strictly to power clinical care, public health reporting, and patient-consented interoperability.
03. How We Use Your Data (Strict Purpose Limitation)
Your data is used strictly for the purpose for which it was collected. We never use patient health records for advertising, profiling, or training third-party foundation AI models.
We process personal and institutional data exclusively for the following lawful purposes:
- Delivering & Operating the OneHealthGrid Ecosystem: Provisioning HIS, EHR, LIMS, Pharmacy, Telemedicine, and Public Health modules; authenticating users; and maintaining 99.9%+ platform availability.
- Enabling ABDM & HL7 FHIR® Interoperability: Facilitating ABHA creation/verification, Health Facility Registry (HFR) & Healthcare Professional Registry (HPR) workflows, and consent-based Health Information Provider (HIP) / Health Information User (HIU) record exchange through the National Health Authority (NHA) gateway.
- Powering Enterprise ERP & Financial Sync: Synchronizing billing, general ledger (GL), accounts payable/receivable (AP/AR), and inventory transactions with enterprise systems such as Microsoft Dynamics 365 Finance when configured by the client organization.
- Executing Context-Rich AI & Inbuilt MCP Server Workflows: Allowing authorized healthcare organizations to connect compliant AI assistants and co-pilots via our inbuilt Model Context Protocol (MCP) servers under strict tenant isolation, role-based access controls, and zero-training guarantees.
- B2B/B2G Communication, Support & Legal Compliance: Responding to consultation requests, providing 24×7 L1/L2/L3 managed services support, processing subscription payments, and complying with statutory audits or lawful government directives.
04. Who We Share Data With
We only share data with vetted sub-processors, national health gateways (upon explicit consent), or statutory authorities when legally required. Every third-party processor is bound by strict confidentiality and data protection contracts.
We do not sell or rent personal data to any third party. We disclose data only in the following controlled scenarios:
1. National & State Digital Health Gateways
When triggered by an authorized clinician or patient with a valid electronic consent artefact, data is exchanged with the National Health Authority (NHA / ABDM HIE-CM), Ayushman Bharat (PM-JAY), or designated State Health Information Systems (HMIS) via encrypted HL7 FHIR® APIs.
2. Vetted Infrastructure & Payment Sub-Processors
We use enterprise cloud hosting providers (MeitY-empanelled / ISO 27001 certified data centers in India), transactional email/SMS gateways for OTPs and appointment alerts, and PCI-DSS compliant Payment Gateways for subscription and patient billing transactions.
3. Client-Authorized Enterprise & AI Connectors
Where a client organization explicitly enables native integrations (e.g., Microsoft Dynamics 365 Finance, PACS/lab analyzers, or enterprise AI platforms via our MCP Servers), data flows strictly to the endpoints configured and authorized by that client.
4. Analytics & Legal/Statutory Authorities
On our public marketing website only, we share pseudonymous browsing metrics with Google Analytics and Meta (Facebook) Pixel. We may also disclose information if required by court order, CERT-In cybersecurity mandates, or applicable Indian law.
05. Cookies and Tracking Technologies
We use essential cookies to keep our platform secure, and analytics/marketing pixels (Google Analytics & Meta Pixel) on our public website to understand how visitors discover our solutions. Clinical EHR/HIS workspaces are 100% free of third-party ad trackers.
Cookies are small text files stored on your browser. Here is how we use them and how you can control them at any time:
- Strictly Necessary & Security Cookies (Always Active): Required for user login sessions, CSRF security tokens, load balancing, and role-based access continuity. Without these, the platform cannot function securely.
- Analytics Cookies (Google Analytics 4): Used on our public website (
onehealthgrid.com) to measure page performance, visitor journeys, and content relevance in aggregate form. - Marketing & Attribution Pixels (Facebook / Meta Pixel): Used on public B2B landing pages to measure the effectiveness of our digital health awareness campaigns and deliver relevant enterprise updates. Note: Meta Pixel is strictly restricted to public marketing pages and is never loaded inside authenticated clinical, EHR, HIS, or patient portal environments.
How to Opt Out Easily: You can disable non-essential cookies anytime via your browser settings, install the Google Analytics Opt-Out Add-on, or adjust your ad preferences in your Meta Account Settings.
06. Your Rights & Choices (India DPDP Act, ABDM & Global)
You have full control over your personal data—including the right to access, correct, erase, withdraw consent, nominate a representative, and register a grievance.
Depending on your relationship with OneHealthGrid and your jurisdiction, you are entitled to the following statutory rights:
Under India’s DPDP Act, 2023 (Data Principals)
- Right to Access Information: Obtain a summary of your personal data being processed and the identities of all Data Fiduciaries/Processors with whom it has been shared.
- Right to Correction & Erasure: Request correction of inaccurate/incomplete data, updating of records, or erasure of personal data that is no longer necessary for the purpose collected (subject to statutory medical retention laws).
- Right to Withdraw Consent: Withdraw your consent at any time with the same ease with which it was given.
- Right to Nominate: Nominate another individual to exercise your rights in the event of death or incapacity.
- Right of Grievance Redressal: Receive a timely resolution from our Data Protection & Grievance Officer before approaching the Data Protection Board of India.
Under ABDM (Patients) & International Laws (GDPR / CCPA)
- ABDM Consent Manager Controls: Citizens using ABHA can view, grant, modify, or revoke electronic consent artefacts for health record sharing in real time via any ABDM-compliant Consent Manager app.
- EEA / UK Residents (GDPR): Right to data portability, restriction of processing, objection to legitimate-interest processing, and lodging a complaint with a supervisory authority.
- California / US Users (CCPA/CPRA & HIPAA): Right to know, right to delete, right to opt out of cross-context behavioral advertising, and non-discrimination.
Important Note for Patients of Subscribing Hospitals/Clinics: Because your hospital or clinic is the Data Fiduciary of your medical records, requests to amend clinical notes or discharge summaries should be directed to your healthcare provider, and we will assist them immediately in fulfilling your request.
07. Data Retention & Security Architecture
We retain data only as long as required to fulfill contractual services or statutory medical retention mandates, and protect every byte with enterprise-grade encryption, zero-trust access controls, and continuous security monitoring.
How Long We Retain Data
- B2B/B2G Client Clinical Data: Retained strictly in accordance with the client agreement and applicable Indian healthcare regulations (such as MoHFW / NMC EHR Standards and statutory medico-legal retention periods), and securely returned or deleted within 30–90 days of contract termination.
- Marketing & Demo Inquiries: Retained for up to 24 months from your last interaction, or until you opt out or request deletion.
- Security & Audit Logs: Retained in immutable form for a minimum of 180 days (in compliance with CERT-In directives) and up to 7 years for regulatory compliance audits.
How We Protect Your Data
- Encryption Everywhere: TLS 1.3 encryption for all data in transit (APIs, FHIR, MCP, web) and AES-256 encryption for databases, file storage, and backups at rest.
- Strict Access Governance: Multi-Factor Authentication (MFA), OAuth 2.0 / OpenID Connect, granular Role-Based Access Control (RBAC), and tenant-level isolation.
- Continuous Assurance: 24×7 security operations monitoring, regular vulnerability assessment and penetration testing (VAPT), automated disaster recovery backups, and CERT-In aligned incident response protocols.
08. How to Contact Us & Grievance Redressal
Have a question, privacy request, or compliance inquiry? Our Data Protection & Grievance Officer is here to help and responds to all verified requests within statutory timelines.
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, you may contact our designated Data Protection & Grievance Officer using the details below:
Data Fiduciary / Corporate Entity
Routeget Technologies Consulting Pvt. Ltd.
(Operating the OneHealthGrid® Digital Health Platform)
Website: https://onehealthgrid.com
Data Protection & Grievance Officer
Designation: Head of Data Privacy & Information Security
Email: privacy@onehealthgrid.com / info@onehealthgrid.com
Online Portal: https://onehealthgrid.com/contact-us/
Response SLA: Acknowledgement within 24–48 hours; full resolution within 15 business days.
Expandable Regulatory & Architecture Annexes
When operating as a Health Information Provider (HIP) or Health Information User (HIU) bridge within the Ayushman Bharat Digital Mission (ABDM) ecosystem, OneHealthGrid strictly enforces the NHA Health Data Management Policy: (1) No health record is linked to an ABHA ID or shared across facilities without a cryptographically verifiable electronic consent artefact; (2) Every consent artefact specifies purpose, date range, health information types (OPConsultation, Prescription, DiagnosticReport, DischargeSummary, ImmunizationRecord), and expiry timestamp; and (3) HIU cached records are automatically purged upon consent expiry or revocation.
OneHealthGrid provides native Model Context Protocol (MCP) servers that allow healthcare organizations to connect compliant AI models (e.g., Azure OpenAI, Amazon Bedrock, Google Vertex AI, Anthropic Claude, or on-premise LLMs). All MCP interactions are governed by: (1) Zero Training Guarantee—patient and institutional data exposed via MCP is never used to train or fine-tune public foundation models; (2) Ephemeral Context Windows—clinical context retrieved via MCP is scoped strictly to the authenticated clinician’s RBAC permissions; and (3) Full Auditability—every AI tool invocation and prompt/response metadata event is logged for clinical governance.
Our public website and B2B demo portals are not directed at individuals under 18 years of age. Where pediatric, maternal-child health (RMNCH+A), or school immunization records are processed within OneHealthGrid by a hospital, clinic, or government health program, such processing occurs strictly on the basis of verifiable parent or lawful guardian consent obtained by the healthcare provider in compliance with Section 9 of the DPDP Act, 2023. We never conduct behavioral tracking, profiling, or targeted advertising directed at children.
Primary production databases storing clinical, EHR, HIS, and ABDM records for Indian healthcare institutions and government authorities are hosted exclusively within secure, MeitY-compliant / ISO 27001 certified data centers located in India. Any cross-border transfer of B2B business contact or support telemetry data complies strictly with Section 16 of the DPDP Act, 2023 and, where applicable, EU Standard Contractual Clauses (SCCs).
Need Our Enterprise Security Pack or a Signed Data Processing Agreement (DPA)?
Our compliance and legal engineering teams support hospitals, government health missions, and enterprise partners with DPDP Act readiness, ABDM sandbox certification, VAPT reports, and custom BAA/DPA schedules.