Data protection

Data protection and HIPAA

Last updated: October 2026

Our position

ArogyaSync is designed with HIPAA principles in mind. It is not HIPAA certified, and it has not been independently audited against HIPAA. Our primary operating jurisdiction is India, where the Digital Personal Data Protection Act, 2023 applies.

What we do today

• Data travels between devices, apps and our servers over encrypted (TLS) connections.
• Stored data sits in Google Cloud in India (Mumbai region), which encrypts it at rest by default.
• People and devices sign in with their own credentials, and what each can see depends on their role.
• If the network drops, a device keeps readings only until it can send them.
• Every reading is time-stamped on a public ledger so records can be checked later.
• Users can ask for their account to be deleted from the account deletion page.

Business Associate Agreements

If your organisation needs a Business Associate Agreement, contact us and we will discuss what we can offer.

Contact

For data protection questions, contact compliance@arogyasync.com.