Data Storage, Data Residency & Governance Policy

PRACTICE121 PVT LTD
Trading as Practice121

1. Purpose and Scope

1.1 This Data Storage, Data Residency & Governance Policy establishes the architecture, security standards, retention timelines, and lifecycle management for all data processed across the Practice121 platform.

1.2 This Policy applies to all practitioners, medical officers, trainees, practice staff, and authorized administrators operating within the Practice121 ecosystem.

2. Legislative and Governance Alignment

This Policy strictly enforces compliance with:

• The Personal Data Protection Act, No. 9 of 2022 and the Personal Data Protection (Amendment) Act, No. 22 of 2025;
• Cross-border data transfer rules under Section 26 of the PDPA (as amended);
• Statutory medical record retention directives set by the Ministry of Health, Sri Lanka Medical Council (SLMC), and Private Health Services Regulatory Council (PHSRC);
• ISO/IEC 27001 standards for Information Security Management.

3. Data Classification

System data is categorized into four distinct classes:

1. Audio Data: Live audio streams captured during clinical consultations via the ambient scribe.
2. Clinical Data & Generated Notes: EPR entries, patient demographics, transcripts, AI-generated clinical summaries, e-prescriptions, lab orders, and referral letters.
3. Identity & Credential Data: SLMC numbers, NICs, qualifications, e-signatures, MFA logs, and practice PHSRC location details.
4. Metadata & System Analytics: Session IDs, timestamps, immutable access logs, and de-identified aggregate health metrics.

4. Data Residency & Cross-Border Governance

4.1 Regional Hosting Architecture: All primary databases, patient EPR storage, e-prescription records, and backup facilities are hosted in enterprise-grade Google Cloud Platform Singapore region (asia-southeast1).

4.2 Cross-Border Compliance (PDPA Sec 26): All cross-border data routing and storage adhere strictly to Section 26 of the Personal Data Protection Act (as amended). Data transfers outside Sri Lanka occur solely to compliant infrastructure regions offering legally binding recipient commitments and technical safeguards equivalent to Sri Lankan standards.

4.3 No Unauthorized Replications: No Clinical Data, Audio Data, or Patient Identifiers are copied, mirrored, or backed up to unapproved international jurisdictions.

5. Audio Data Streaming & Real-Time Lifecycle

5.1 Real-Time Streaming Only: Consultation audio is captured via memory-bound, encrypted, segmented streaming protocols.

5.2 Zero Audio Retention: Audio segments are never saved to permanent disk storage, cached, archived, or retrievable after processing.

5.3 Immediate Purge: Audio data is automatically and permanently purged from volatile memory immediately upon completion of note generation or upon resolution of a technical connection break.

6. Storage Security Safeguards

6.1 Encryption Standards:

• Data in Transit: Secured using TLS 1.3 encryption for all platform communications, API calls, and streaming modules.
• Data at Rest: All databases, file stores, and backups are encrypted using standard AES-256 encryption.

6.2 Multi-Tenancy & Logical Segregation: Patient records and practice data are logically segregated by unique Practice IDs and Location IDs. Strictly no co-mingling of tenant data occurs.

6.3 Access Control: System access is restricted via strict Role-Based Access Control (RBAC), Least Privilege principles, and mandatory Multi-Factor Authentication (MFA) for all practitioner accounts.

6.4 Immutable Audit Logging: All system interactions—including record viewing, editing, note generation, e-signature application, and data exports—are recorded in write-once immutable audit logs.

7. Retention and Deletion Lifecycle

7.1 Clinical Record Retention: Clinical notes, EPR entries, e-prescriptions, and diagnostic orders are retained for the statutory period required by Sri Lankan health record laws and medical regulations.

7.2 Patient-Requested Erasure: Requests for personal data erasure under Section 16 of the PDPA are processed in accordance with legal obligations. Where medical record laws mandate retention for evidentiary or public health purposes, data is archived with processing restricted pursuant to Section 15 of the PDPA.

7.3 Account Termination: Upon account termination, data retention adheres to statutory audit requirements, after which records are securely destroyed using cryptographic erasure.

8. Practice Management & Third-Party Systems Integration

When a practitioner exports, prints, or transfers Generated Notes, e-prescriptions, or orders to external clinic software or third-party systems, data governance responsibility for the exported copy transfers to the receiving entity in accordance with its privacy policies and Sri Lankan law.

9. Governance Enquiries

For data architecture, compliance, or storage inquiries, contact:

Data Governance Team
PRACTICE121 PVT LTD
Email: info@practice121.com
Website: www.practice121.com