Data Processing Addendum (DPA)

For personal data entered into the Customer's WeDose tenant — including patient names and billing details, doctor names, and prescription records (“Pharmacy Data”) — the Customer is the Data Fiduciary under the DPDP Act, 2023, and Thinkwarelabs IT Private Limited is its Data Processor. This Addendum governs that processing.

For account and usage data, WeDose acts as an independent Data Fiduciary per our Privacy Policy.

We process Pharmacy Data only:

• (a) To provide, secure, support, and maintain the Platform;
• (b) On the Customer's documented instructions given through the Platform or in writing; or
• (c) As required by applicable law, in which case we will notify the Customer unless legally prohibited.

The Customer warrants that it has a valid lawful basis under the DPDP Act 2023, and has given all required notices and obtained all necessary consents to collect and process the personal data of its patients, doctors, and staff through the Platform.

The Customer warrants that its processing instructions to us comply fully with applicable Indian laws and regulatory requirements.

WeDose maintains robust technical and organizational security measures:

• Tenant isolation: Each pharmacy's data resides in its own isolated PostgreSQL schema — no shared tables across tenants.
• Encryption & Access Controls: TLS 1.3 encryption in transit, encrypted backups at rest, and role-based access controls for staff.
• Immutable Audit Logs: Complete audit logging of all stock adjustments, bills, and master-data edits with user ID, timestamp, and reason.
• Confidentiality Restrictions: Personnel access to Pharmacy Data is restricted to what is necessary for operations and support, under binding confidentiality obligations.

Pharmacy Data is hosted exclusively in India (AWS Mumbai, ap-south-1). Current authorized sub-processors:

• Cloud Hosting & Database: AWS Mumbai (ap-south-1) / India region infrastructure
• WhatsApp Alerts: Indian WhatsApp Business Solution Provider (Interakt / AiSensy) — receives destination phone numbers and digest content only
• Payments: Razorpay (PCI-DSS compliant)
• Transactional Email: AWS SES / Postmark

We will notify the Customer of sub-processor changes and remain fully responsible for their performance.

We will notify the Customer without undue delay, and in any case within 72 hours, of becoming aware of a personal data breach affecting Pharmacy Data.

The notification will include reasonable detail regarding the nature, scope, and mitigation measures, and we will cooperate with the Customer's obligations to the Data Protection Board of India and affected individuals under the DPDP Act.

Taking into account the nature of processing, we will assist the Customer in responding to requests from patients or other data principals (such as access, correction, or erasure), including through in-Platform tools and, where necessary, direct support.

On termination of the subscription, the Customer may export Pharmacy Data for thirty (30) days.

Thereafter, we delete Pharmacy Data from production systems within ninety (90) days, and from backups per the backup rotation cycle — except data the Customer instructs us in writing to preserve, or that we must retain by law.

This Addendum is governed by the laws of India and follows the dispute-resolution terms set out in the WeDose Terms & Conditions.

If the DPDP Rules impose additional processor obligations, the parties will cooperate in good faith to implement them. In case of conflict between this Addendum and the Terms regarding Pharmacy Data, this Addendum prevails.

DPA Enquiries: hello@wedose.in / grievance@wedose.in.