PRACTICE121 PVT LTD
Trading as Practice121
1. Purpose and Scope
1.1 PRACTICE121 PVT LTD (Practice121, we, us, our) is committed to protecting the privacy, confidentiality, and security of Personal Data and Health Data entrusted to us.
1.2 This Privacy Policy governs the collection, processing, storage, disclosure, and protection of data acquired through our software platform, mobile applications, websites, and clinical workflow tools (including AI ambient scribing, Electronic Patient Records, telehealth, e-prescriptions, and community networks).
1.3 This Policy applies to healthcare practitioners, clinic administrators, locum professionals, and patients accessing our portal or services. It forms an integral, legally binding part of our Terms and Conditions.
2. Legislative Framework
2.1 We process personal and health data in strict compliance with applicable laws of Sri Lanka, including:
- Personal Data Protection Act, No. 9 of 2022 (and the Personal Data Protection (Amendment) Act, No. 22 of 2025);
- Directives and guidelines issued by the Data Protection Authority of Sri Lanka (DPA);
- Applicable Sri Lanka Medical Council (SLMC) and Private Health Services Regulatory Council (PHSRC) guidelines regarding medical records and professional secrecy.
2.2 Where mandatory statutory provisions conflict with this Policy, applicable Sri Lankan statutory requirements prevail.
3. Definitions
- Personal Data: Any information that can directly or indirectly identify a natural person, as defined under the Personal Data Protection Act.
- Special Categories of Personal Data / Health Data: Personal data relating to physical or mental health, medical history, diagnosis, treatment, prescriptions, genetic/biometric data, or health status.
- Data Subject: An identified or identifiable natural person (patient or practitioner) to whom the personal data relates.
- Controller: The healthcare practitioner or medical center that determines the purpose and means of processing patient health records.
- Processor: Practice121 PVT LTD, processing data on behalf of the Controller.
4. Information We Collect
4.1 Practitioner & Account Data: Full name, date of birth, NIC number, SLMC registration details, qualifications, practice addresses, telephone number, email address, e-signature, and MFA credentials.
4.2 Patient Data & Clinical Records: Demographic details, contact info, clinical consultation transcripts, EPR notes, medical history, e-prescriptions, lab orders, and referral letters uploaded or generated on the platform.
4.3 Ambient Audio Data: Consultation audio captured live via the AI scribe strictly for transcription.
4.4 Technical & Usage Information: Device identifiers, IP addresses, application logs, geolocation mapping for practice locations, and audit trails.
4.5 Billing & Financial Information: Bank details and payment transaction data processed via secure payment gateways.
5. Purpose of Data Collection and Processing
We process data strictly for explicit, lawful, and specified clinical and administrative purposes:
- Delivering ambient AI scribing, EPR, e-prescription, and telehealth functionalities;
- Verifying doctor credentials, SLMC status, and awarding Verification Badges;
- Establishing unique Practice IDs and federated Location IDs linked with PHSRC registrations;
- Facilitating the doctor community, locum bookings, umbrella referral systems, and pharmacy/lab links;
- Generating aggregate, non-identifiable statistical analytics for medical education and epidemiological tracking of disease outbreaks;
- Meeting legal, regulatory, and audit obligations under Sri Lankan law.
6. AI Model Governance & Data Minimization
6.1 NO Model Training on Patient Data: Patient Health Data, clinical transcripts, consultation audio, and EPR notes are NEVER used to train, retrain, fine-tune, or validate public, global, or commercial artificial intelligence models.
6.2 All audio streams are pseudonymized and encrypted in transit. Audio data is processed in temporary memory solely to yield structured text notes and is automatically purged upon completion.
7. Legal Basis for Processing
We process data on the following bases under Schedule I and II of the Personal Data Protection Act:
- Explicit consent from the data subject (or parent/guardian in the case of a minor);
- Performance of a service contract with the practitioner or practice;
- Medical diagnosis, care, treatment, and management of healthcare services by licensed professionals;
- Compliance with legal and statutory duties imposed by Sri Lankan law.
8. Data Disclosure and Third Parties
8.1 We do not sell, rent, or trade Personal Data or Health Data.
8.2 Information may be shared strictly under secure, confidential parameters with:
- Preferred laboratories and pharmacies selected by the practitioner ("My Labs" / "My Pharmacy") for order/prescription fulfilment;
- Authorized locum network practices where a shift booking is accepted;
- Cloud infrastructure providers bound by statutory processor contracts pursuant to Section 21 of the PDPA;
- Law enforcement, regulatory bodies, or courts when required by written Sri Lankan law.
9. Rights of Data Subjects
In accordance with Part II of the Personal Data Protection Act, No. 9 of 2022 (as amended):
- Right of Access: You may request access to and confirmation of personal data held about you.
- Right to Rectification: You may request correction of inaccurate or incomplete personal data.
- Right to Erasure / Deletion: You may request erasure of your data, subject to medical record retention laws and statutory legal requirements.
- Right to Withdraw Consent: You may withdraw consent at any time without affecting prior lawful processing.
- Response Timeline: We will respond to requests within one (1) month of receipt, extendable by up to two (2) additional months for complex cases with prior notice.
- Appeals: You have the right to appeal any decision to the Data Protection Authority of Sri Lanka.
10. Data Breach Response & Security Safeguards
10.1 We implement robust administrative, technical, and physical safeguards, including AES-256 encryption at rest, TLS 1.3 encryption in transit, strict Role-Based Access Controls (RBAC), and immutable audit logs.
10.2 In the event of a confirmed or suspected personal data breach, Practice121 will execute its Data Breach Incident Response Plan and notify the Data Protection Authority of Sri Lanka and affected data subjects as required under Section 23 of the PDPA.
11. App Store & Platform Disclosures
- Permissions Required: Microphone access (for real-time ambient scribe), Location access (for practice mapping/geo-location), and Storage access (for uploading credential documents/e-signatures).
- Account & Data Deletion: Users may request full account and personal data deletion via in-app settings or by contacting info@practice121.com, subject to health record retention mandates.
12. Data Protection Officer and Contact Details
For privacy queries, exercising data rights, or contacting our Data Protection Officer (DPO):
Data Protection Officer
PRACTICE121 PVT LTD
Email: info@practice121.com
Website: www.practice121.com