Compliance

Overview

As a platform handling health records and financial transactions in India, Odento is designed from the ground up to comply with Indian regulatory requirements. Our compliance program covers four areas: health data standards (ABDM), data protection (DPDP Act 2023), data residency (India only), and tax compliance (GST).

ABDM Compliance

Odento integrates with the Ayushman Bharat Digital Mission (ABDM) — India's national digital health infrastructure. This integration enables patients to link their Ayushman Bharat Health Account (ABHA) with their Odento patient record, and allows health records to be shared across the ABDM network with patient consent.

ABDM Integration Features

• ABHA creation: Patients can create an ABHA ID directly from the Odento patient portal.
• ABHA linking: Existing ABHA IDs can be linked to the Odento patient record.
• Health record sharing: Patient records can be shared with other ABDM-registered providers via the ABDM consent framework.
• Consent management: Patients control what data is shared, with whom, and for how long. All consent grants and revocations are logged.
• FHIR compatibility: Health records are exported in FHIR R4 format for ABDM interoperability.
• HIU/HIP integration: Odento acts as both a Health Information Provider (HIP) and Health Information User (HIU).

Consent Flow

1. Patient grants consent in Odento patient portal
   ├── Selects data type (lab reports, prescriptions, etc.)
   ├── Selects recipient (another ABDM provider)
   └── Sets validity period (e.g., 30 days)

2. Odento sends consent request to ABDM consent manager
   ├── Consent artifact created
   └── Patient verifies via ABDM app

3. Recipient requests data
   ├── ABDM consent manager verifies consent
   ├── Odento (as HIP) validates request
   └── Data shared via FHIR R4 over encrypted channel

4. Consent expiry or revocation
   ├── Auto-revoke on expiry
   ├── Patient can revoke at any time
   └── All access logged for audit

Data Residency (India Only)

All Odento data — primary database, file storage, backups, cache, and logs — is stored and processed exclusively in India. Specifically, all infrastructure runs in the Google Cloud asia-south1 (Mumbai) region. No data is replicated to or accessible from any other country.

What Stays in India

• Primary PostgreSQL database (Compute Engine VM, Mumbai)
• Redis cache (same VM, Mumbai)
• File storage (GCS bucket, Mumbai region)
• Database backups (GCS, Mumbai region)
• Application logs (Mumbai region)
• Audit logs (Mumbai region, 7-year retention)
• Encryption keys (Cloud KMS, Mumbai region)

Cross-Border Data Transfer

Odento does not transfer personal or health data outside India. The only data that leaves India is non-personal operational data sent to external SaaS providers:

• Error tracking (Sentry): Stack traces and error metadata (no patient data).
• Analytics (PostHog): Aggregated usage metrics (no patient data).
• Push notifications (OneSignal): Device tokens and notification content (no medical data).

All external API calls (Razorpay, WhatsApp, Google) transmit only the data necessary for the specific operation (e.g., payment amount for Razorpay, message content for WhatsApp). No bulk data export to external services.

DPDP Act 2023

The Digital Personal Data Protection (DPDP) Act 2023 is India's comprehensive data protection law. Odento is designed to comply with the DPDP Act as both a data fiduciary (for our own operations) and a data processor (on behalf of our customers).

DPDP Act Compliance Measures

• Consent collection: Explicit, informed consent for data collection. Patients can withdraw consent at any time.
• Purpose limitation: Data is used only for the purpose for which consent was given.
• Data minimization: Only necessary data is collected. No excessive data harvesting.
• Storage limitation: Data is retained only as long as necessary (per medical records regulations) and then deleted.
• Accuracy: Patients can review and correct their data. Corrections are logged.
• Security safeguards: Encryption, access control, and audit logging (see Data Protection documentation).
• Breach notification: Data breaches are reported to the Data Protection Board and affected users within 72 hours.
• Data principal rights: Right to access, correction, erasure, and grievance redressal.
• Grievance officer: A designated grievance officer is available at grievance@odento.app.

GST Compliance

Odento generates GST-compliant invoices for all taxable transactions. When you configure your GSTIN in the payment settings, every invoice includes the required GST fields and the correct tax calculation based on the place of supply.

GST Compliance Features

• Automatic CGST/SGST calculation for intra-state transactions
• Automatic IGST calculation for inter-state transactions
• HSN/SAC code mapping (9987 for health care services)
• Sequential invoice numbering with configurable format
• GSTR-1 and GSTR-3B export in portal-compatible format
• Reverse charge mechanism support
• Place of supply determination based on patient address
• Export of purchase and sales registers

For detailed GST setup, see the Payment Gateways GST section.

Medical Records Standards

Odento follows Indian medical records standards for dental practices:

• Retention period: Patient records retained for 7 years (adults) or until age 25 (minors), per MCI guidelines.
• Record format: Structured clinical notes with timestamps, dentist signature, and treatment codes.
• Access control: Only authorized dental professionals can access clinical records. Patient consent required for sharing.
• Amendment: Records can be amended with an audit trail (original entry preserved, amendment logged with reason).
• Electronic signatures: Digital signatures on treatment plans and prescriptions are legally valid under the IT Act 2000.
• FHIR R4 export: Records can be exported in FHIR R4 format for ABDM interoperability.

Compliance Contact

For compliance-related questions, audits, or data requests:

• Compliance team: compliance@odento.app
• Grievance officer: grievance@odento.app
• Data Protection Officer: dpo@odento.app
• Security incidents: security@odento.app