Data Processing Addendum

Your laboratory is the Controller (the Data Fiduciary under the Digital Personal Data Protection Act, 2023). You decide why and how patient data is processed, and you are responsible for patient notice and consent.

Sammed Technosol is the Processor (Data Processor). We process that data only on your documented instructions, which are the instructions given by your use of the software and the settings you choose.

This Addendum applies for as long as we hold personal data on your behalf: from the moment you switch on a cloud feature until deletion under clause 8. Data held only on your own machines is not processed by us at all — SamLab is offline-first, and nothing leaves your premises unless you enable a feature that sends it.

• Categories of data subject: your patients, referring doctors, and your own staff users.
• Categories of data: identifiers and contact details, test results and clinical values, billing records, and audit records of who did what in the software.
• Purpose: providing the cloud features you have switched on — synchronisation, backup, report delivery, messaging — and nothing else.

Test results are health data. We do not use them to train any model, we do not sell them, and we do not use them for any purpose of our own.

• We process only on your instructions, and will tell you if an instruction appears to us to breach applicable law.
• Everyone with access is bound by confidentiality.
• We maintain the technical and organisational measures described on our Security page.
• We assist you, so far as we reasonably can, with data-subject requests and with your own obligation to notify a breach.

Encryption in transit, encryption at rest with our providers, access limited to the individuals who need it, and audit records of access. We hold no ISO 27001 or SOC 2 certification and we do not claim one — see Security for exactly what we do and do not hold.

If we become aware of a personal-data breach affecting your data on our infrastructure, we will notify you without undue delay, and in any event within 72 hours of becoming aware, with the facts known at the time, the likely consequences, and what we are doing about it. Notifying a supervisory authority or the affected individuals remains your decision as Controller.

We use the sub-processors listed in clause 5 of our Privacy Policy, which is the current list. Each is bound by terms no less protective than these. We will give you reasonable notice before adding a sub-processor that processes your patient data, and you may terminate the affected cloud service if you object.

On termination, or on your written request, we delete the personal data we hold on your behalf within 90 days, except where we are required by law to retain it. Your own local database is unaffected — it is yours and it stays on your machines. You can export your data at any time while the service is live.

Some sub-processors operate outside India, and outside the EEA and the UK. Transfers are made only to deliver the service to you, and only to the countries named in our Privacy Policy. We do not currently offer Standard Contractual Clauses or a Business Associate Agreement, and we do not claim to.

On reasonable written notice, and not more than once a year unless a supervisory authority requires otherwise, we will answer a reasonable written security questionnaire and provide the information you need to demonstrate compliance with this Addendum.

This Addendum forms part of our Terms & Conditions. Where it conflicts with them on the processing of personal data, this Addendum prevails. Nothing in it limits your rights or ours under applicable data-protection law.

Sammed Technosol
1-JH-28, First Floor, Housing Board Colony, Dadabari, Kota, Rajasthan 324009, India
Email: sammedtechno@gmail.com · Phone: +91 9828400519