Data Processing Agreement

Template — for your institution's legal review. This DPA is provided so a college or hospital (the Data Fiduciary) has a starting document naming StatMD as its Data Processor under India's Digital Personal Data Protection Act, 2023 (DPDP Act). It is not legal advice. Have your legal team review and adapt it, then both parties sign. To execute a copy, email pharmacologybymd@gmail.com.

Version: July 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between the institution using StatMD (the “Data Fiduciary”) and PharmaByMD, operator of StatMD (the “Data Processor”), for the Processor's processing of Personal Data on the Fiduciary's behalf. Capitalised terms have the meanings given in the DPDP Act, 2023.

1. Subject matter & roles

The Fiduciary determines the purpose and means of processing student and faculty Personal Data; the Processor processes that data only to provide the StatMD service (live polling, quizzes, attendance, gradebooks, and CBME competency reporting) and only on the Fiduciary's documented instructions, including those given through the StatMD interface.

2. Categories of Data Principals & Personal Data

• Data Principals: faculty (account holders) and students (participants).
• Personal Data: names, institutional email addresses, roll numbers, class and department membership, quiz/exam responses and scores, attendance, and competency attainment.
• The Processor does not collect students' payment data. Faculty subscription payments are handled by a third-party payment gateway (Razorpay); the Processor stores only a payment reference, never card details.

3. Processor obligations

• Process Personal Data only on the Fiduciary's instructions and only for the purposes above;
• Keep Personal Data confidential and ensure personnel with access are bound by confidentiality;
• Implement reasonable security safeguards — encryption in transit, access controls, audit logging, and regular security review — to protect against personal data breaches;
• Assist the Fiduciary in responding to Data Principals exercising their rights (access, correction, erasure) — StatMD provides self-service data export and deletion-request tooling;
• Notify the Fiduciary without undue delay on becoming aware of a personal data breach affecting the Fiduciary's data, with the information the Fiduciary needs to meet its own notification duties to the Data Protection Board and affected principals;
• On termination, and at the Fiduciary's choice, delete or return all Personal Data and delete existing copies, save where retention is required by law.

4. Sub-processors

The Fiduciary authorises the Processor to engage the sub-processors needed to run the service — cloud hosting, transactional email, error monitoring, off-site backup, and the payment gateway. The Processor remains responsible for its sub-processors' compliance and will inform the Fiduciary of any intended change, giving the Fiduciary the opportunity to object.

5. Retention & deletion

Personal Data is retained for as long as the account is active or as the Fiduciary instructs. Faculty may export their data or request account deletion at any time from within StatMD; the Processor actions verified deletion requests, and deletion is completed within 30 days.

6. Location & transfers

The Processor will process Personal Data in accordance with the DPDP Act and any restrictions the Central Government notifies on transfer of personal data outside India. The current hosting region and sub-processor locations are available on request.

7. Audit

On reasonable written notice, the Processor will make available the information necessary to demonstrate compliance with this DPA and reasonably cooperate with the Fiduciary's audits.

8. Liability & term

This DPA runs for the duration of the service agreement. Liability is as set out in the parties' underlying agreement. Where this DPA conflicts with that agreement on data protection, this DPA governs.