OneHealth ID (OH-ID) Privacy Policy

1. Architectural Privacy Commitment

OneHealth ID (OH-ID) is engineered from the ground up on zero-knowledge verification principles. Raw electronic health records (EHR), clinical consultation notes, and private test observations are cryptographically safeguarded in tenant-isolated PostgreSQL schemas and are never sold, rented, or exposed across unauthorized organizational boundaries.

2. Data Collected & Purpose Limitation

• Practitioner Credentials: Primary registered mobile numbers and authenticated credentials are used solely for identity verification and role-based access control (RBAC).
• Patient Health Information: Demographic identifiers and clinical encounters are processed exclusively for authorized clinical care, medication orders, and hospital billing.
• Audit Logs: Immutable server-side access logs are retained for regulatory compliance and security anomaly detection.

3. Regulatory & Statutory Standards

OH-ID operations comply with the Indian Digital Personal Data Protection (DPDP) Act, Ayushman Bharat Digital Mission (ABDM) data consent frameworks, and applicable healthcare information protection statutes.