Regulatory matrix

DRAFT — requires legal review

This document is a working draft prepared by the engineering team to describe how the platform is designed to support compliance. It is not legal advice and has not yet been reviewed by counsel. Do not rely on it as a final policy until this banner is removed.

The platform provides features that support compliance. It does not make a provider compliant or certified by itself; marketing states “supported” vs “certified” explicitly.

Law / standard	Product obligation	Release
DPDP Act 2023 + DPDP Rules 2025	Notices, consent/purpose records, data-principal rights workflow (access/correction/erasure with medical-retention exceptions), grievance officer, breach runbook (72 h), processor/subprocessor inventory & DPAs, guardian consent for minors, retention per entity, access-log retention	R0–R1
IT Act 2000 / SPDI Rules 2011	Privacy policy, reasonable security practices	R0
NMC Rx guidance & Telemedicine Practice Guidelines 2020	Generic names, capitals, registration number; teleconsult identity/consent/mode/Rx limits, logs	R1
Clinical Establishments Act	Registration number on documents, rate display, record retention	R1
NABL 112A / 133 (ISO 15189)	Traceability, authorised signatories, critical-value log, amendments, QC, NABL-mode report	R2
PCPNDT Act	Form F, registers, audit lock	R2
Drugs & Cosmetics Act (Schedule H/H1/X)	Registers, batch/expiry, pharmacist details	R4
GST / e-invoicing	Exempt vs taxable, HSN/SAC, credit notes, thresholds	R1
MTP Act	Restricted forms, confidentiality	Pack (R1+)
ABDM	Sandbox registration (R0); M1 ABHA create/verify/scan-and-share, HFR/HPR (R2); M2/M3 HIP/HIU via consent broker + DHIS dashboard (R3); FHIR bundle validation against ABDM profiles	R0 → R3
NABH digital health standards	Audit trails, consent, access control, quality indicators	R4–R5
Biomedical waste rules, MLC	Logs, flags	R4
CERT-In Directions 2022	Incident reporting within 6 hours; logs retained 180 days in India	R0