Health Data Processing, Artificial Intelligence (AI), ABDM & Consent Management Policy

1. Guiding Principles for Health Data

Health data is deeply personal and demands the highest tier of confidentiality, integrity, and stewardship. Our processing philosophy rests on five immutable tenets:

2. Taxonomy of Health & Clinical Records

Within QwikPro platforms, "Health Data" includes several distinct categories:

• Electronic Health Records (EHR) & Clinical Notes: Doctor consultation summaries, symptom documentation, diagnosis codes, clinical impressions, follow-up advice, and clinical referral letters created within QwikDoc by treating medical practitioners.
• Prescription Data: Formulations, dosage instructions, active chemical compounds, duration, and doctor signatures issued for patient medication fulfillment.
• Diagnostic Lab & Radiology Reports: Laboratory test values (e.g., lipid profiles, complete blood counts, glycemic metrics), pathology interpretations, ultrasound observations, and radiological imaging reports.
• Self-Reported Health Metrics: Patient-recorded blood pressure logs, blood sugar checks, body weight, vaccination histories, and dietary notes entered in QwikCare.
• ABHA Identifier Profiles: The 14-digit Ayushman Bharat Health Account number, ABHA address (e.g., username@abdm), linked health records, and associated consent artifact logs.

3. ABDM-Aligned Interoperability & Consent Architecture

To advance national digital health interoperability under the Ayushman Bharat Digital Mission (ABDM) overseen by the National Health Authority (NHA), QwikPro implements ABDM-aligned workflows where supported:

• ABHA Number & Address Integration: Enables patients to securely create, link, or authenticate their 14-digit ABHA number using Aadhaar or mobile OTP protocols compliant with UIDAI and ABDM security standards.
• Consent Manager Architecture: Digital health records are shared across the national network exclusively upon execution of an electronic Consent Artifact. The consent artifact defines:
  • The requesting entity (Health Information User — HIU);
  • The supplying entity (Health Information Provider — HIP);
  • The exact categories of health data requested (e.g., diagnostic reports only);
  • The validity period of the consent; and
  • The clinical purpose for data retrieval.
• Data in Transit & Decentralization: In accordance with ABDM architectural principles, health records reside with their original custodians (hospitals, diagnostic labs, clinics). When transferred via ABDM networks, data is encrypted end-to-end, decryptable solely by the intended recipient via secure keys.
• Interoperability Standards: Where applicable, clinical documents are organized using Fast Healthcare Interoperability Resources (FHIR) compliant schema profiles recommended by the Government of India.

4. Artificial Intelligence (AI) & Automated Extraction

To reduce administrative burdens on clinicians and simplify records for patients, QwikPro utilizes proprietary and integrated machine learning algorithms and computer vision techniques:

5. AI Clinical Boundaries & Human-in-the-Loop

We enforce a rigorous Human-in-the-Loop (HITL) standard. Any structured information extracted by automated algorithms must be validated and confirmed by the human user (patient, doctor, or pharmacist) before clinical reliance or billing finalization.

6. Model Governance, Anonymization & Privacy

We apply strict protocols to ensure that AI modules respect patient confidentiality:

• No Unconsented Model Training: Identifiable patient medical records are never used to train public generative models.
• De-Identification Protocols: Where aggregated data is evaluated for algorithm accuracy enhancement or latency optimization, records undergo strict de-identification removing names, phone numbers, Aadhaar details, and exact addresses.
• Algorithmic Bias Auditing: Extraction tools are continuously evaluated to ensure consistent parsing across disparate handwriting styles, report formats, and clinical terminology.

7. Technical Safeguards & Encryption Standards

Health data processed on our platform is protected by enterprise-grade cryptographic controls:

• Encryption in Transit: All HTTP communications leverage Transport Layer Security (TLS 1.3) with modern cipher suites. Unencrypted plaintext transmissions are strictly blocked.
• Encryption at Rest: Database tables, document stores, and file caches holding health records are encrypted using military-grade AES-256 encryption.
• Strict Identity & Access Management (IAM): Access permissions are role-segregated. Technical support staff cannot access patient clinical records unless granted temporary, auditable, permissioned access for troubleshooting.
• Comprehensive Audit Trails: Every view, download, export, or consent grant related to a health record generates an immutable access log timestamped for regulatory inspection.

8. User Rights, Portability & Record Deletion

In accordance with the Digital Personal Data Protection Act, 2023, and ABDM principles:

• Data Portability: Users can export their digital health records in standard portable formats (such as PDF or structured JSON/FHIR) through QwikCare at any time.
• Right to Rectification: If an OCR scan has misinterpreted a clinical parameter, you or your treating physician can edit and correct the extracted field.
• Right to Erasure: Patients may request the deletion of uploaded records from their QwikCare account. Note: Deletion from the patient portal does not erase records legally maintained within a hospital's or doctor's independent clinic register (QwikDoc) where clinical retention is mandated by law.

9. Third-Party Intermediaries & Integration Partners

When you authorize integrations (such as transmitting an e-prescription to a pharmacy through ONDC, or retrieving a laboratory report from an accredited pathology lab), data is transferred over authenticated API endpoints. Third-party entities operate under their respective privacy notices and professional statutory regulations once data has been transferred with your consent.

10. Clinical Retention & Data Lifecycle

Health information is retained in conformance with clinical record retention guidelines promulgated by the National Medical Commission and state healthcare establishment regulations. Unless required by statutory proceedings or active medical care continuity, diagnostic archives are managed according to defined lifecycle policies and securely destroyed upon expiration of lawful retention terms.

11. Data Protection Inquiries & Grievances

For technical data inquiries, consent revocation, ABHA linking issues, or privacy concerns regarding health data processing or AI/OCR modules, users may contact our Data Protection and Grievance Desk at [email protected] (CC: [email protected]).

Where a grievance pertains to an algorithmic or OCR extraction discrepancy, QwikPro investigates the platform parsing functionality but does not alter clinical interpretation, which remains the professional responsibility of the treating medical practitioner. For our complete escalation hierarchy, statutory timelines, and investigation procedures, please refer to our dedicated Grievance Redressal Policy.