Privacy Policy

When your diagnostic laboratory signs up, we collect the lab administrator's name, email address, mobile phone number, lab business name, clinical establishment address, and billing details required to establish and maintain your cloud LIS tenant.

Demographics and diagnostic information entered by your laboratory staff — including patient names, age, gender, contact phone numbers, test requests, sample collection timestamps, and pathology test results. This data is the exclusive property of your laboratory and patient. OnePath Lab acts strictly as a Data Processor under Indian law.

Where opted by the patient and lab, ABHA numbers, ABHA PHR addresses, and transactional verification tokens under the Ayushman Bharat Digital Mission (ABDM). We adhere to National Health Authority (NHA) security guidelines for all health identifier sync.

System activity logs (page navigations, feature usage, user login events, and diagnostic print/dispatch events) to maintain data integrity, security auditing, and fraud prevention. Technical logs are retained for forensic analysis in compliance with national cyber regulations.

Under India's Digital Personal Data Protection (DPDP) Act, your diagnostic laboratory operates as the "Data Fiduciary" which determines the purpose and lawful basis for collecting patient clinical data. OnePath Lab operates strictly as a "Data Processor", processing data strictly on your laboratory's documented instructions and service contract.

Personal and clinical health data is processed solely for generating diagnostic reports, transmitting results to patients, managing lab finances, and facilitating care. We collect only what is strictly necessary for diagnostic and clinical operations.

Diagnostic records of patients under 18 years of age are processed only with verifiable parental or legal guardian consent obtained by the testing laboratory. OnePath Lab never undertakes behavioral tracking, profiling, or targeted advertising directed at minors.

For laboratories participating in ABDM Milestone 1 (M1), digital health records are linked and shared with patient health lockers strictly via explicit, token-based consent granted through government-approved channels (such as Aarogya Setu or ABHA apps).

To generate automated, pathologist-verified diagnostic reports, synchronize bi-directional analyzer machine data, deliver WhatsApp/SMS reports to patients on your behalf, and provide the complete LIS functionality.

We may use de-identified, non-traceable aggregate statistical data to enhance our AI clinical decision-support algorithms. This requires explicit opt-in consent and adheres to rigorous clinical de-identification protocols.

Managing subscription billing, generating GST-compliant tax invoices, and processing payments via PayU India and secure RBI-licensed banking gateways. Card and bank credentials are never stored on our application servers.

To diagnose technical issues, configure analyzer bridges, and deliver prompt onboarding and machine interfacing support to your lab staff.

All data exchanged between your browser and our cloud servers is protected with TLS 1.3 encryption. Patient records and medical databases are stored using AES-256 encryption at rest to prevent unauthorized access.

Hosted entirely on ISO 27001, SOC 2 Type II certified cloud infrastructure located in the AWS Asia Pacific (Mumbai) region. All personal health data strictly resides within the territory of India with zero unauthorized cross-border transfers.

Enforces strict permission tiers ensuring phlebotomists, receptionists, technicians, and consulting pathologists only access the patient and financial records necessary for their specific job functions.

Automated snapshots every 4 hours with encrypted 30-day multi-zone replication to ensure business continuity and zero clinical data loss.

Official Meta WhatsApp Cloud API gateways receive only the verified recipient phone number and encrypted diagnostic report link to fulfill delivery. Telecom partners are contractually bound under Data Processing Agreements (DPAs).

We do not sell, rent, monetize, or trade patient health records, laboratory financials, or contact details to pharmaceutical companies, insurance aggregators, or advertising networks. Ever.

We may disclose data only if legally required under valid orders from Indian judicial courts or competent public health authorities, with prompt notification provided to the concerned laboratory unless prohibited by law.

Under the Clinical Establishments Act and National Medical Commission (NMC) regulations, diagnostic investigation records and patient clinical reports must be maintained for mandatory medical retention periods (typically minimum 3 years). However, non-clinical data, promotional preferences, and inactive lab account details can be permanently erased upon written request under the DPDP Act.

Authorized lab administrators can export full clinical histories, patient master lists, test catalogs, and financial ledgers in CSV and PDF formats anytime from Settings > Data Export.

Inaccurate patient demographics or test parameters can be rectified directly through authorized lab workflows, with every revision tracked in our immutable audit history.

Patients have the statutory right to withdraw consent for non-essential communications (such as marketing announcements or AI assistance opt-in) and nominate an individual to exercise their rights in case of death or incapacity.

Statutory Grievance Redressal Officer (DPDP Act, 2023)

Dedicated Data Protection & Redressal Desk for India