# Privacy Policy

- Link: https://onehealthgrid.com/privacy-policy/
- Published: 2026-11-03T07:30:41+05:30
- Author: imagpt

DATA PRIVACY, SECURITY & REGULATORY TRUST

# Privacy Policy & Data Governance Notice

At **OneHealthGrid** (operated by **Routeget Technologies Consulting Pvt. Ltd.**),
we believe that privacy is the foundation of healthcare trust. This Layered Privacy
Notice explains—in plain, transparent language—how we collect, process, safeguard,
and govern personal and healthcare data across our B2B/B2G digital health platform,
ABDM integrations, open APIs, and inbuilt MCP servers.

Effective Date: November 5, 2026Aligned with: India DPDP Act 2023 & IT Act 2000Healthcare
Standards: ABDM HDMP, HL7 FHIR® & HIPAA/GDPR Principles

LAYER 1 — EXECUTIVE SUMMARY (TL;DR)

## Privacy at a Glance: Our 4 Core Commitments

60-Second Read for Busy Stakeholders

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-tldr-1-role.svg)

### 1. Clear Role Separation

For B2B/B2G clinical operations (EHR/HIS/LIMS), your Hospital or Government Health
Department is the **Data Fiduciary**; OneHealthGrid acts strictly as your **Data
Processor**.

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-tldr-2-nosell.
svg)

### 2. Zero Data Monetization

We **never sell, rent, or trade** patient health records, ABHA IDs, prescriptions,
or diagnostic results to advertisers, brokers, or unauthorized third parties.

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-tldr-3-consent.
svg)

### 3. Consent-Led ABDM & AI

ABDM record exchange occurs strictly via verifiable electronic consent artefacts.
Our inbuilt MCP servers and AI tools **never train public LLMs** on clinical data.

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-tldr-4-standards.
svg)

### 4. Defense-in-Depth Security

All data is protected with TLS 1.3 encryption in transit, AES-256 encryption at 
rest, role-based access control (RBAC), immutable audit logs, and India data residency.

QUICK NAVIGATION

Table of Contents

[01. Introduction & Commitment](https://onehealthgrid.com/privacy-policy/#sec-1)
[02. What Data We Collect & Why](https://onehealthgrid.com/privacy-policy/#sec-2)
[03. How We Use Your Data](https://onehealthgrid.com/privacy-policy/#sec-3)[04. Who We Share Data With](https://onehealthgrid.com/privacy-policy/#sec-4)
[05. Cookies & Tracking Tech](https://onehealthgrid.com/privacy-policy/#sec-5)[06. Your Rights & Choices](https://onehealthgrid.com/privacy-policy/#sec-6)
[07. Data Retention & Security](https://onehealthgrid.com/privacy-policy/#sec-7)
[08. Contact Us & Grievance Officer](https://onehealthgrid.com/privacy-policy/#sec-8)

---

Data Protection & Grievance Officer

Need to exercise your DPDP Act rights, revoke ABHA consent, or request a B2B Data
Processing Agreement (DPA)?

[✉ privacy@onehealthgrid.com →](https://onehealthgrid.com/privacy-policy/privacy@onehealthgrid.com)

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-sec-1-intro.svg)

## 01. Introduction & Our Commitment

KEY TAKEAWAY (TL;DR)

Healthcare runs on trust. Whether you are a hospital administrator digitizing clinical
workflows, a state public health official managing population-scale programs, a 
clinician caring for patients, or a citizen accessing your ABHA-linked health records,
we treat your data with the highest degree of legal, technical, and ethical stewardship.

Welcome to **OneHealthGrid** ([https://onehealthgrid.com](https://onehealthgrid.com)),
an AI-ready, interoperable digital healthcare platform owned and operated by **Routeget
Technologies Consulting Pvt. Ltd.** (“OneHealthGrid”, “Routeget”, “we”, “us”, or“
our”).

Because OneHealthGrid operates at the intersection of **enterprise healthcare software(
B2B)**, **public health infrastructure (B2G)**, and **citizen-centric digital health
interoperability**, our privacy governance is structured around a clear legal distinction
under India’s **Digital Personal Data Protection Act, 2023 (DPDP Act)**, the **Information
Technology Act, 2000 (SPDI Rules)**, the **Ayushman Bharat Digital Mission (ABDM)
Health Data Management Policy**, and international frameworks (GDPR & HIPAA):

#### When We Act as a Data Fiduciary (Controller)

When you visit `onehealthgrid.com`, request a product demo, register for our Developer
Sandbox, subscribe to our updates, or contract with us as a B2B/B2G client, partner,
or vendor, we determine the purpose and means of processing your business contact,
account, and billing data.

#### When We Act as a Data Processor (Business Associate)

When a Hospital, Clinic, PHC, Diagnostic Lab, Pharmacy, NGO, or Government Health
Department uses OneHealthGrid’s HIS, EHR, LIMS, Telemedicine, or ABDM modules to
manage patient care, **the Healthcare Institution is the Data Fiduciary**, and OneHealthGrid
processes clinical/patient data strictly on their documented instructions.

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-sec-2-collect.
svg)

## 02. What Data We Collect & Why

KEY TAKEAWAY (TL;DR)

We only collect data that is necessary to deliver, secure, and improve our platform.
We separate the data you directly provide to us from technical telemetry collected
automatically and clinical records processed under B2B/B2G institutional agreements.

#### A. Data You Give Us Directly

 * **Business & Demo Inquiries:** Full name, work email, mobile number, organization/
   hospital name, designation, and organization type submitted via our Consultation,
   Contact, or Demo forms.
 * **Practitioner & Staff Accounts:** Clinician name, Healthcare Professional Registry(
   HPR) ID, role/department, facility affiliation (HFR ID), and authentication credentials.
 * **Developer & Partner Portal Data:** Developer name, organization, API client
   identifiers, OAuth2 callback URIs, and sandbox test logs.
 * **Billing & Financial Data:** GSTIN, corporate billing address, invoice records,
   and payment transaction references processed via PCI-DSS compliant payment gateways(
   we never store raw credit/debit card numbers or CVVs).

#### B. Data Collected Automatically

 * **Device & Network Telemetry:** IP address, browser type/version, operating system,
   screen resolution, and referring URLs.
 * **Platform Usage & Security Logs:** Login timestamps, session duration, API call
   latency, error traces, and role-based access audit trails required for healthcare
   security compliance.
 * **Cookies & Analytics Signals:** Page interaction events collected via Google
   Analytics 4 and campaign attribution signals via Meta (Facebook) Pixel on public
   marketing pages only.

#### C. Healthcare, ABDM & Citizen Data Processed on Behalf of Healthcare Institutions

When authorized by a subscribing healthcare provider or public health authority,
the platform processes Sensitive Personal Data / Digital Health Data—including patient
demographics, 14-digit **ABHA (Ayushman Bharat Health Account) numbers**, ABHA addresses,
OPD/IPD clinical encounters, e-Prescriptions, LIMS lab reports, radiology summaries,
PM-JAY / insurance claim artefacts, and electronic consent artefacts—strictly to
power clinical care, public health reporting, and patient-consented interoperability.

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-sec-3-use.svg)

## 03. How We Use Your Data (Strict Purpose Limitation)

KEY TAKEAWAY (TL;DR)

Your data is used strictly for the purpose for which it was collected. We never 
use patient health records for advertising, profiling, or training third-party foundation
AI models.

We process personal and institutional data exclusively for the following lawful 
purposes:

 * **Delivering & Operating the OneHealthGrid Ecosystem:** Provisioning HIS, EHR,
   LIMS, Pharmacy, Telemedicine, and Public Health modules; authenticating users;
   and maintaining 99.9%+ platform availability.
 * **Enabling ABDM & HL7 FHIR® Interoperability:** Facilitating ABHA creation/verification,
   Health Facility Registry (HFR) & Healthcare Professional Registry (HPR) workflows,
   and consent-based Health Information Provider (HIP) / Health Information User(
   HIU) record exchange through the National Health Authority (NHA) gateway.
 * **Powering Enterprise ERP & Financial Sync:** Synchronizing billing, general 
   ledger (GL), accounts payable/receivable (AP/AR), and inventory transactions 
   with enterprise systems such as Microsoft Dynamics 365 Finance when configured
   by the client organization.
 * **Executing Context-Rich AI & Inbuilt MCP Server Workflows:** Allowing authorized
   healthcare organizations to connect compliant AI assistants and co-pilots via
   our inbuilt **Model Context Protocol (MCP)** servers under strict tenant isolation,
   role-based access controls, and zero-training guarantees.
 * **B2B/B2G Communication, Support & Legal Compliance:** Responding to consultation
   requests, providing 24×7 L1/L2/L3 managed services support, processing subscription
   payments, and complying with statutory audits or lawful government directives.

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-sec-4-share.svg)

## 04. Who We Share Data With

KEY TAKEAWAY (TL;DR)

We only share data with vetted sub-processors, national health gateways (upon explicit
consent), or statutory authorities when legally required. Every third-party processor
is bound by strict confidentiality and data protection contracts.

We do not sell or rent personal data to any third party. We disclose data only in
the following controlled scenarios:

#### 1. National & State Digital Health Gateways

When triggered by an authorized clinician or patient with a valid electronic consent
artefact, data is exchanged with the **National Health Authority (NHA / ABDM HIE-
CM)**, **Ayushman Bharat (PM-JAY)**, or designated **State Health Information Systems(
HMIS)** via encrypted HL7 FHIR® APIs.

#### 2. Vetted Infrastructure & Payment Sub-Processors

We use enterprise cloud hosting providers (MeitY-empanelled / ISO 27001 certified
data centers in India), transactional email/SMS gateways for OTPs and appointment
alerts, and PCI-DSS compliant **Payment Gateways** for subscription and patient 
billing transactions.

#### 3. Client-Authorized Enterprise & AI Connectors

Where a client organization explicitly enables native integrations (e.g., **Microsoft
Dynamics 365 Finance**, PACS/lab analyzers, or enterprise AI platforms via our **
MCP Servers**), data flows strictly to the endpoints configured and authorized by
that client.

#### 4. Analytics & Legal/Statutory Authorities

On our public marketing website only, we share pseudonymous browsing metrics with**
Google Analytics** and **Meta (Facebook) Pixel**. We may also disclose information
if required by court order, CERT-In cybersecurity mandates, or applicable Indian
law.

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-sec-5-cookies.
svg)

## 05. Cookies and Tracking Technologies

KEY TAKEAWAY (TL;DR)

We use essential cookies to keep our platform secure, and analytics/marketing pixels(
Google Analytics & Meta Pixel) on our public website to understand how visitors 
discover our solutions. Clinical EHR/HIS workspaces are 100% free of third-party
ad trackers.

Cookies are small text files stored on your browser. Here is how we use them and
how you can control them at any time:

 * **Strictly Necessary & Security Cookies (Always Active):** Required for user 
   login sessions, CSRF security tokens, load balancing, and role-based access continuity.
   Without these, the platform cannot function securely.
 * **Analytics Cookies (Google Analytics 4):** Used on our public website (`onehealthgrid.
   com`) to measure page performance, visitor journeys, and content relevance in
   aggregate form.
 * **Marketing & Attribution Pixels (Facebook / Meta Pixel):** Used on public B2B
   landing pages to measure the effectiveness of our digital health awareness campaigns
   and deliver relevant enterprise updates. _Note: Meta Pixel is strictly restricted
   to public marketing pages and is never loaded inside authenticated clinical, 
   EHR, HIS, or patient portal environments._

**How to Opt Out Easily:** You can disable non-essential cookies anytime via your
browser settings, install the [Google Analytics Opt-Out Add-on](https://tools.google.com/dlpage/gaoptout),
or adjust your ad preferences in your Meta Account Settings.

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-sec-6-rights.svg)

## 06. Your Rights & Choices (India DPDP Act, ABDM & Global)

KEY TAKEAWAY (TL;DR)

You have full control over your personal data—including the right to access, correct,
erase, withdraw consent, nominate a representative, and register a grievance.

Depending on your relationship with OneHealthGrid and your jurisdiction, you are
entitled to the following statutory rights:

#### Under India’s DPDP Act, 2023 (Data Principals)

 * **Right to Access Information:** Obtain a summary of your personal data being
   processed and the identities of all Data Fiduciaries/Processors with whom it 
   has been shared.
 * **Right to Correction & Erasure:** Request correction of inaccurate/incomplete
   data, updating of records, or erasure of personal data that is no longer necessary
   for the purpose collected (subject to statutory medical retention laws).
 * **Right to Withdraw Consent:** Withdraw your consent at any time with the same
   ease with which it was given.
 * **Right to Nominate:** Nominate another individual to exercise your rights in
   the event of death or incapacity.
 * **Right of Grievance Redressal:** Receive a timely resolution from our Data Protection&
   Grievance Officer before approaching the Data Protection Board of India.

#### Under ABDM (Patients) & International Laws (GDPR / CCPA)

 * **ABDM Consent Manager Controls:** Citizens using ABHA can view, grant, modify,
   or revoke electronic consent artefacts for health record sharing in real time
   via any ABDM-compliant Consent Manager app.
 * **EEA / UK Residents (GDPR):** Right to data portability, restriction of processing,
   objection to legitimate-interest processing, and lodging a complaint with a supervisory
   authority.
 * **California / US Users (CCPA/CPRA & HIPAA):** Right to know, right to delete,
   right to opt out of cross-context behavioral advertising, and non-discrimination.

_Important Note for Patients of Subscribing Hospitals/Clinics:_ Because your hospital
or clinic is the Data Fiduciary of your medical records, requests to amend clinical
notes or discharge summaries should be directed to your healthcare provider, and
we will assist them immediately in fulfilling your request.

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-sec-7-security.
svg)

## 07. Data Retention & Security Architecture

KEY TAKEAWAY (TL;DR)

We retain data only as long as required to fulfill contractual services or statutory
medical retention mandates, and protect every byte with enterprise-grade encryption,
zero-trust access controls, and continuous security monitoring.

#### How Long We Retain Data

 * **B2B/B2G Client Clinical Data:** Retained strictly in accordance with the client
   agreement and applicable Indian healthcare regulations (such as MoHFW / NMC EHR
   Standards and statutory medico-legal retention periods), and securely returned
   or deleted within 30–90 days of contract termination.
 * **Marketing & Demo Inquiries:** Retained for up to 24 months from your last interaction,
   or until you opt out or request deletion.
 * **Security & Audit Logs:** Retained in immutable form for a minimum of 180 days(
   in compliance with CERT-In directives) and up to 7 years for regulatory compliance
   audits.

#### How We Protect Your Data

 * **Encryption Everywhere:** TLS 1.3 encryption for all data in transit (APIs, 
   FHIR, MCP, web) and AES-256 encryption for databases, file storage, and backups
   at rest.
 * **Strict Access Governance:** Multi-Factor Authentication (MFA), OAuth 2.0 / 
   OpenID Connect, granular Role-Based Access Control (RBAC), and tenant-level isolation.
 * **Continuous Assurance:** 24×7 security operations monitoring, regular vulnerability
   assessment and penetration testing (VAPT), automated disaster recovery backups,
   and CERT-In aligned incident response protocols.

![](https://onehealthgrid.com/wp-content/uploads/2026/11/ohg-priv-sec-8-contact.
svg)

## 08. How to Contact Us & Grievance Redressal

KEY TAKEAWAY (TL;DR)

Have a question, privacy request, or compliance inquiry? Our Data Protection & Grievance
Officer is here to help and responds to all verified requests within statutory timelines.

In accordance with the **Digital Personal Data Protection Act, 2023** and the **
Information Technology (Reasonable Security Practices and Procedures and Sensitive
Personal Data or Information) Rules, 2011**, you may contact our designated Data
Protection & Grievance Officer using the details below:

#### Data Fiduciary / Corporate Entity

**Routeget Technologies Consulting Pvt. Ltd.**
(Operating the **OneHealthGrid®**
Digital Health Platform)Website: [https://onehealthgrid.com](https://onehealthgrid.com)

#### Data Protection & Grievance Officer

**Designation:** Head of Data Privacy & Information Security
**Email:** [privacy@onehealthgrid.com](https://onehealthgrid.com/privacy-policy/privacy@onehealthgrid.com)/
[info@onehealthgrid.com](https://onehealthgrid.com/privacy-policy/info@onehealthgrid.com)**
Online Portal:** [https://onehealthgrid.com/contact-us/](https://onehealthgrid.com/contact-us/)**
Response SLA:** Acknowledgement within 24–48 hours; full resolution within 15 business
days.

LAYER 3 — DEEP-DIVE STATUTORY & TECHNICAL SCHEDULES

### Expandable Regulatory & Architecture Annexes


When operating as a Health Information Provider (HIP) or Health Information User(
HIU) bridge within the Ayushman Bharat Digital Mission (ABDM) ecosystem, OneHealthGrid
strictly enforces the NHA Health Data Management Policy: (1) No health record is
linked to an ABHA ID or shared across facilities without a cryptographically verifiable
electronic consent artefact; (2) Every consent artefact specifies purpose, date 
range, health information types (OPConsultation, Prescription, DiagnosticReport,
DischargeSummary, ImmunizationRecord), and expiry timestamp; and (3) HIU cached 
records are automatically purged upon consent expiry or revocation.


OneHealthGrid provides native Model Context Protocol (MCP) servers that allow healthcare
organizations to connect compliant AI models (e.g., Azure OpenAI, Amazon Bedrock,
Google Vertex AI, Anthropic Claude, or on-premise LLMs). All MCP interactions are
governed by: (1) Zero Training Guarantee—patient and institutional data exposed 
via MCP is never used to train or fine-tune public foundation models; (2) Ephemeral
Context Windows—clinical context retrieved via MCP is scoped strictly to the authenticated
clinician’s RBAC permissions; and (3) Full Auditability—every AI tool invocation
and prompt/response metadata event is logged for clinical governance.


Our public website and B2B demo portals are not directed at individuals under 18
years of age. Where pediatric, maternal-child health (RMNCH+A), or school immunization
records are processed within OneHealthGrid by a hospital, clinic, or government 
health program, such processing occurs strictly on the basis of verifiable parent
or lawful guardian consent obtained by the healthcare provider in compliance with
Section 9 of the DPDP Act, 2023. We never conduct behavioral tracking, profiling,
or targeted advertising directed at children.


Primary production databases storing clinical, EHR, HIS, and ABDM records for Indian
healthcare institutions and government authorities are hosted exclusively within
secure, MeitY-compliant / ISO 27001 certified data centers located in India. Any
cross-border transfer of B2B business contact or support telemetry data complies
strictly with Section 16 of the DPDP Act, 2023 and, where applicable, EU Standard
Contractual Clauses (SCCs).

## Need Our Enterprise Security Pack or a Signed Data Processing Agreement (DPA)?

Our compliance and legal engineering teams support hospitals, government health 
missions, and enterprise partners with DPDP Act readiness, ABDM sandbox certification,
VAPT reports, and custom BAA/DPA schedules.

 [  Request Security & Compliance Pack →  ](https://onehealthgrid.com/privacy-policy/#elementor-action%3Aaction%3Dpopup%3Aopen%26settings%3DeyJpZCI6IjExNDciLCJ0b2dnbGUiOmZhbHNlfQ%3D%3D)

 [  Contact Data Protection Officer  ](https://onehealthgrid.com/privacy-policy/privacy@onehealthgrid.com)