Healthcare data is among the most sensitive data a person owns. Compliance is not a marketing layer for us — it is encoded into the architecture, audited continuously, and surfaced transparently below. As we expand into new markets, our compliance posture will extend accordingly.
Eight regulatory and accreditation bodies cover the operational surface of Indian healthcare. Zeeva is built to satisfy all of them — at the architecture layer, not the policy layer. As we enter new markets, we'll surface the equivalent local frameworks here.
Full ABDM gateway certification. Health ID (ABHA), Health Locker, HIE-CM (Consent Manager), HFR (Facility Registry), and HPR (Healthcare Professional Registry) endpoints — all certified in Sandbox and Production.
Designated Data Fiduciary architecture. Consent-first data flows, granular per-record permissions, breach notification within 72 hours, full data principal rights surface — access, correction, erasure, portability.
Section 43A reasonable security practices. SPDI Rules 2011 compliance for sensitive personal data. Section 79 intermediary safe-harbour processes for grievance officer designation and content takedown.
Every clinician on the platform is verified against the NMC and state-council registries before activation. Telemedicine practice guidelines (2020) enforced for remote consultations. CME tracking integrated.
NABH (hospitals) and NABL (laboratories) accreditation status surfaced on every facility profile. Patients can filter for accredited care. Audit trails maintained for every clinical and laboratory transaction.
All insurer and TPA partners on the platform are IRDAI-registered. Claims processing follows IRDAI Health Insurance Regulations 2016 and the Health Claims Exchange (HCX) standards published by NHA.
AERB approval status verified for all imaging diagnostic centres operating CT, PET-CT, gamma camera, and other regulated equipment. Compliance status surfaced to patients booking imaging appointments.
Drug License (Form 20/21) verification for all pharmacies. Schedule H/H1/X enforcement at the e-prescription layer. Cold-chain monitoring hooks for distributors handling regulated biologics and vaccines.
For our India launch market, every byte of identifiable patient health data lives within Indian borders. Two regions for resilience. No cross-border processing of PHI. No shadow copies. As we expand into new markets, the same residency-by-region principle applies.
Aligned with DPDP Act 2023 §16 and the National Health Authority's Health Data Management Policy. Specific data-centre locations are disclosed under NDA to enterprise partners during procurement review.
Layered security controls covering identity, network, application, data-at-rest, data-in-transit, and operational practices. Audited annually and continuously monitored.
Under both the DPDP Act and IT Act, certain officer designations are mandatory. We publish them transparently. You can reach them directly, in any of three languages.
For grievances related to platform usage, intermediary obligations, or content. Acknowledges within 24 hours, resolves within 15 days as required by law.
For data principal rights — access, correction, erasure, portability, consent withdrawal. Independent reporting line to the board. Available in English, Hindi, and Telugu.
All policies are versioned. Material changes are notified to registered users via email and dashboard banner at least 30 days before they take effect, in accordance with DPDP §6.
Trust is not a slogan we put on a marketing page. It is a property of the architecture.
For enterprise procurement, we maintain a vendor security questionnaire library, evidence packs, audit reports, and a dedicated compliance contact. Reach out and we'll send the right document.