ABDM Consent Policy

1. Introduction

This ABDM Consent Policy ('Policy') governs the optional integration of the vcdoc.in platform ('vcdoc') with the Ayushman Bharat Digital Mission (ABDM) ecosystem, including the creation, linkage, and use of an Ayushman Bharat Health Account (ABHA) in connection with your health records maintained on the vcdoc platform.

ABDM integration on vcdoc is entirely optional. Your use of the core vcdoc services - online consultations, e-pharmacy, and e-diagnostics - is not conditional upon linking your ABHA or consenting to ABDM data sharing. If you choose not to participate, your health data will continue to be managed solely within the vcdoc platform in accordance with our Privacy Policy and Terms of Use.

2. About ABDM and ABHA

3. Creating or Linking Your ABHA

You may create a new ABHA or link an existing ABHA to your vcdoc account through the following steps:

• • Navigate to your vcdoc profile settings and select 'Link ABHA / Health Account'.
• • Enter your Aadhaar number or mobile number to initiate ABHA creation or linkage via the ABDM gateway.
• • Complete the OTP-based verification process.
• • Review and provide your explicit consent for ABDM data integration.

ABHA creation and linking is performed directly through the ABDM gateway operated by the National Health Authority and is subject to NHA's terms and conditions in addition to this Policy.

IMPORTANT: vcdoc does not store your Aadhaar number. Aadhaar-based verification is processed directly through the UIDAI / ABDM gateway using a secure, tokenised flow.

4. Consent Architecture

All health data sharing under the ABDM framework is governed by the principle of explicit, informed, and granular consent. vcdoc implements the ABDM Consent Manager model with the following features:

4.1 Consent Artefacts

Every request to access or share health data under ABDM generates a digitally signed Consent Artefact. A Consent Artefact specifies:

• • The identity of the Health Information User (HIU) requesting access
• • The specific categories of health information being requested (e.g., consultation notes, lab reports, prescriptions)
• • The date range of records covered by the consent
• • The purpose of data access (e.g., care delivery, second opinion, personal health record management)
• • The duration for which the consent is valid
• • The frequency of permitted access (one-time or recurring)

4.2 Patient Rights Under the Consent Framework

As a patient user of the ABDM-integrated vcdoc platform, you have the following rights:

• • Right to Grant Consent: You may grant consent for specific categories of health information to be accessed or shared for specific purposes and durations.
• • Right to Revoke Consent: You may revoke any consent at any time through the vcdoc application or the ABDM Consent Manager. Revocation is effective immediately and prevents any further access under the revoked Consent Artefact. Data already accessed prior to revocation cannot be retrieved.
• • Right to View Consent History: You may view a complete log of all consent artefacts - granted, revoked, and expired - through the ABDM Consent Locker accessible via your vcdoc profile or the ABHA application.
• • Right to Data Minimisation: You may limit consent to specific categories of health records, date ranges, or purposes. You are not required to grant blanket access to all health records.
• • Right to Notification: You will receive real-time notifications (via SMS and/or in-app alert) whenever a consent request is received, granted, or accessed.

5. Categories of Health Data Covered

The following categories of health information may be shared under the ABDM framework, subject to your explicit consent:

6. Data Security and Storage

Health data shared through the ABDM framework is transmitted in encrypted form using HL7 FHIR R4-compliant formats and ABDM-specified encryption standards. vcdoc does not store health records obtained via ABDM consent from other HIPs beyond the period specified in the Consent Artefact and the duration required for care delivery, except where required by applicable law.

vcdoc implements technical and organisational security measures including:

• • End-to-end encryption for all ABDM data flows
• • Role-Based Access Control (RBAC) to limit access to authorised clinical and technical personnel only
• • Audit logging of all data access events for regulatory compliance and patient transparency
• • Data localisation: all health data processed on the vcdoc platform is stored on servers located within the territory of India

7. Purposes of Data Access

vcdoc may request access to ABDM-linked health records for the following purposes only:

• • Care delivery: Enabling treating physicians on the vcdoc platform to review your health history for continuity of care
• • Second opinion: Sharing relevant records with a specialist to whom you have been referred
• • Personal health record management: Consolidating your health records into your vcdoc EHR for your own access and convenience

vcdoc will not access ABDM health data for research, analytics, or commercial purposes without your separate, explicit informed consent.

8. Interaction with the Digital Personal Data Protection Act, 2023

Health data constitutes 'sensitive personal data' within the meaning of the Digital Personal Data Protection Act, 2023. In addition to the ABDM Consent Manager framework, processing of health data on the vcdoc platform is subject to the requirements of the DPDPA 2023, including:

• • Obtaining free, specific, informed, unconditional, and unambiguous consent before processing sensitive health data
• • Providing a clear and accessible privacy notice describing the purpose, nature, and manner of data processing
• • Enabling the exercise of Data Principal rights including the right of access, correction, and erasure
• • Maintaining records of processing activities and implementing appropriate technical safeguards

9. Disabling ABDM Integration

You may disable ABDM integration and unlink your ABHA from your vcdoc account at any time through your vcdoc profile settings. Upon unlinking:

• • All existing consent artefacts linking your vcdoc account to ABHA will be revoked.
• • vcdoc will cease to submit health records to the ABDM ecosystem on your behalf.
• • Health records already submitted to ABDM prior to unlinking will remain in your ABHA profile and are governed by the ABDM Health Data Management Policy. Contact the National Health Authority (NHA) for removal of such records.
• • Your vcdoc EHR and health records stored on the vcdoc platform are not affected by unlinking your ABHA.

10. Grievance Redressal

For grievances specifically related to ABDM data sharing or consent management on the vcdoc platform, please contact:

11. Updates to This Policy

This ABDM Consent Policy will be updated as the ABDM ecosystem, applicable regulations, and vcdoc's participation in ABDM evolve. Material changes will be communicated to ABDM-linked users via email and/or a prominent notice on the platform at least 14 days before the changes take effect.

12. Definitions

For the purposes of this Policy:

• • ABDM means the Ayushman Bharat Digital Mission, operated by the National Health Authority of India.
• • ABHA means Ayushman Bharat Health Account, the unique health identifier issued to citizens under ABDM.
• • Consent Artefact means a digitally signed data structure that records the terms of a patient's consent for health data access under ABDM.
• • HIP means Health Information Provider - an entity that generates and stores patient health records and shares them under ABDM.
• • HIU means Health Information User - an entity that requests access to patient health records through ABDM for a specified purpose.
• • PHR means Personal Health Record - a longitudinal record of an individual's health data accessible under ABDM.
• • FHIR means Fast Healthcare Interoperability Resources - the international standard for healthcare data interoperability adopted by ABDM.