DPDP Act, 2023 — Notice to Data Principals
Notice version 2026-08-27 · Applies to Operax Health Pvt. Ltd. (Data Fiduciary)
This is the itemised notice required under Section 5 of the Digital Personal Data Protection Act, 2023. It tells you exactly what personal data we seek, for which purposes, and how to exercise your rights.
Itemised list of personal data and purposes
Creating your account, authenticating you, and delivering the simulations you request. Required to provide Operax.
Data: Name, email, role, specialty, institution, session security logs · Retention: For the life of your account + 90 days
Storing your simulation attempts, scores, debriefs and competency progression so you and your program can track training.
Data: Case attempts, scores, timings, complication handling, AI mentor transcripts · Retention: 7 years (medical education record norms) or until withdrawn
Understanding how the platform is used so we can improve simulations and fix problems. Aggregated wherever possible.
Data: Page views, feature usage, device and browser type · Retention: 24 months
Recommending cases and drills based on your weak areas and PGY level.
Data: Performance history, specialty, learning goals · Retention: Until withdrawn
Emails about new case packs, features, webinars and offers.
Data: Name, email, engagement with our emails · Retention: Until withdrawn
Using de-identified performance data to publish surgical education research and improve our AI mentor.
Data: De-identified scores and interaction patterns · Retention: Until withdrawn
How to give, manage or withdraw consent
Consent is requested at sign-up and through the consent banner, purpose by purpose, with separate checkboxes. You may withdraw any optional consent at any time in the consent centre — withdrawal is as easy as giving consent. Withdrawal stops future processing for that purpose; it does not affect processing already carried out lawfully.
Your rights as a Data Principal
- Right to information about the personal data processed and with whom it is shared.
- Right to correction and erasure of inaccurate, incomplete or no-longer-needed data.
- Right to nominate a person to exercise your rights on death or incapacity.
- Right of grievance redressal before escalating to the Data Protection Board.
Your duties as a Data Principal
Do not impersonate another person, do not suppress material information, and do not file false or frivolous complaints. Provide only authentic information when exercising the right to correction.
Grievance and escalation
Contact our Grievance Officer using the details on the grievance redressal page. If unsatisfied, you may complain to the Data Protection Board of India.
Language
This notice is available in English and, on request to privacy@operax.health, in any language listed in the Eighth Schedule to the Constitution of India.