This addendum forms part of the agreement between the hospital (the data fiduciary) and SSAyush (the data processor) under the Digital Personal Data Protection Act.

SSAyush processes personal data only on documented instructions from the hospital, keeps it in ap-south-1, applies the technical and organisational measures described on the trust page, and assists the hospital with data-principal requests.

Sub-processors are listed in the signed copy of this addendum. SSAyush gives notice before adding one, and the hospital may object.

On termination SSAyush returns the data and deletes its copies, except where retention is required by law.