- Data fiduciary and processor roles
- The deploying organisation is ordinarily the data fiduciary; the platform operates as processor under a data processing agreement. Where the programme itself determines purposes — in aggregate research use, for example — it acts as fiduciary and says so.
- Lawful basis and notice
- Notice given at the point of collection in a language the data principal reads, with the purpose stated plainly. Emergency processing where consent cannot be obtained is recorded as such, with the basis and the justification captured.
- Consent and withdrawal
- Consent captured as a first-class, timestamped event, enforced automatically at every access, and withdrawable as easily as it was granted. History of access is retained after withdrawal; future access is not.
- Data minimisation
- Aadhaar and equivalent identifiers minimised or tokenised, never stored in the clear in the application database. Field-level encryption on the most sensitive attributes.
- Retention
- Schedules enforced by the system, not by operational memory. Retention periods differ by record type and jurisdiction and are configured per deployment.
- Data principal rights
- Access, correction, erasure and grievance redressal, with defined response times. Erasure is achievable precisely because clinical records are never written to the distributed ledger.
- Residency
- Data resident in India by default for Indian deployments, with residency configured per jurisdiction elsewhere.
- Breach response
- A maintained incident response plan covering detection, containment, notification to the Data Protection Board and to affected data principals, and post-incident review.
Why erasure and immutability are not in conflict here
This is the question every blockchain health system is asked, and most answer badly. Personal and clinical data lives in governed storage and can be erased. The ledger holds only integrity hashes, consent transitions and access anchors — material that proves a record was not altered without being a copy of it. Erasing the record leaves the proof of its former integrity intact and reveals nothing about the person.