Privacy Policy

1. Who this policy covers, and the roles of the parties

The Tool is used by healthcare institutions and the clinicians and administrators employed by them to assess AI-based screening devices before procurement and deployment. This policy applies to any individual who accesses or uses the Tool on behalf of a healthcare institution (“User”, “you”).

CeRAI operates and hosts the Tool. Each participating healthcare institution (“Institution”) determines what information its own staff enter into the Tool, and, as set out in Section 4 below, is the party that controls access to that information once entered. Where CeRAI acts strictly as an intermediary handling information under a contractual arrangement with an Institution and does not itself collect or determine the purpose of that information, the obligations under Rules 5 and 6 of the SPDI Rules rest primarily with the Institution as the body corporate collecting the information, consistent with the Government of India’s clarification on the application of the SPDI Rules to such intermediaries. CeRAI remains responsible for the reasonable security practices required under Rule 8 in respect of the infrastructure it operates. For Institution account and registration information, CeRAI collects and holds this information directly and for its own administrative purposes and is the body corporate in respect of that information. For assessment content entered by an Institution’s users, CeRAI’s role is limited to that of an intermediary operating the underlying infrastructure, as set out below.

2. Information we collect

The Tool collects the following categories of information:

• Institution account information: the participating healthcare Institution’s name, registered address, point of contact, email address, phone number, and date of registration or enrolment with the Tool. This information is collected and stored by CeRAI directly to administer Institution accounts and manage access to the Tool. Any information related to the Institution is not part of an assessment process or the report that CeRAI gets to see. This information will be available for the respective hospital entities to view, edit, or remove (temporarily or permanently) from the Tool’s database, conduct assessments, and generate assessment reports.
• Account and user information: name, email address, professional designation, department, and the name of the Institution you are affiliated with, collected when you register for or are provisioned access to the Tool.
• AI solution record: for each AI-based screening device assessed, a system-generated identifier, the solution’s name and type, the purpose and timeline of the assessment, and the officials or teams assigned to carry it out. The vendor’s name is recorded in encrypted form as part of the assessment query. Hospital institutions can access it, while CeRAI cannot access any information related to the vendor.
• Assessment responses: the answers, scores, decisions, and any accompanying notes that any user enters while completing the Tool’s Stage 1 (Appraisal and Procurement), Stage 2 (Pre-deployment), and Stage 3 (Integration) assessments. These responses concern the AI screening device being evaluated, for example its training data characteristics, integration requirements, vendor documentation, and clinical performance claims.
• Aggregate or statistical population information: where a question asks you to compare an AI vendor’s training or validation data against your own patient population (for instance, age, gender, or geographic representativeness), you may enter aggregate or statistical descriptions of that population.
• Feedback and support information: where a User submits a query, issue, or suggestion through the Tool’s feedback form, the Institution, the submitter, the submission date, the issue category, the description provided, and the status of that item.

The Tool is not designed to collect any sensitive health data, and Users must not enter information that identifies an individual patient, including patient names, identification numbers, or any information from which an individual patient could reasonably be identified. Where a field permits free text, Users remain responsible for ensuring no individually identifiable patient information is entered. Institutions are encouraged to instruct their staff accordingly as part of their own use of the Tool.

3. Purpose of collection and use

Information is collected and used only for the following purposes:

1. To authenticate Users to access the Tool to assess risks associated with an AI system using the AI risk assessment and mitigation framework, developed by CeRAI and DFL.
2. To generate the risk score, decision cues, and mitigation guidance associated with a given AI system, for safe deployment by the Institution that conducted it.
3. To maintain, secure, and improve the technical operation of the Tool.
4. To respond to support requests and, where a User has separately consented, to share anonymised or aggregated insights for research or publication purposes connected with CeRAI’s work on AI governance in healthcare.
5. To enable CeRAI, as operator of the Tool, to administer Institution accounts and user access, and to compile summary statistics on assessment activity across participating Institutions for its own administrative dashboard, without reference to the underlying assessment content of any single Institution.
6. To receive, log, and respond to feedback, queries, and support requests submitted through the Tool.

Information will not be used for any purpose beyond those stated above, in accordance with Rule 5(5) of the SPDI Rules.

4. Storage, security, and access

Personal information and any sensitive personal data or information entered into the Tool is encrypted at rest. Access to an Institution’s assessment data is restricted to that Institution and the personnel it authorises. CeRAI does not access, and by design cannot access, the decrypted content of an Institution’s assessment data; CeRAI’s role is limited to operating and securing the underlying infrastructure.

This Policy treats CeRAI access as follows:

1. Institution account and registration information (name, address, point of contact, enrolment status) is collected and controlled by CeRAI directly, as the party administering access to the Tool.
2. Assessment content — the Stage 1/2/3 responses, aggregate patient-population data, free text, and any AI vendor name — is not accessible to CeRAI in identifiable form. CeRAI’s administrative dashboard reflects only assessment-level metadata (status, dates, solution type, aggregate counts) without the Institution’s or the vendor’s identity attached.

CeRAI maintains reasonable security practices and procedures in accordance with Rule 8 of the SPDI Rules, including managerial, technical, operational, and physical security controls commensurate with the sensitivity of the information involved.

5. Consent

By registering for and using the Tool, Users consent to the collection and use of their information as described in this Policy. Where sensitive personal data or information is collected, such consent is obtained in writing (including by electronic means) prior to collection, as required under Rule 5(1) of the SPDI Rules. A User may withdraw consent at any time by writing to the Grievance Officer named in Section 8; where consent is withdrawn, CeRAI may be unable to continue providing access to the Tool to that User. As part of completing an assessment, each User is also asked to make a self-declaration, before that stage is submitted, confirming that the information entered is accurate to the best of their knowledge and that no individually identifiable patient information has been entered in any free-text field; this declaration is recorded together with the assessment stage it accompanies.

6. Disclosure of information

Information is not disclosed to any third party without the consent of the Institution or User concerned, except where such disclosure is necessary to comply with a legal obligation, is required by an order of a court or government authority under applicable law, or has already been agreed to under a contract between CeRAI and the relevant Institution. Any government agency seeking access to information under this Policy must make a request in writing, stating the purpose of the request, in accordance with Rule 6 of the SPDI Rules.

7. Data retention

Information is retained only for as long as necessary to fulfil the purposes described in Section 3, or as required by applicable law. An Institution may request deletion of its assessment data at any time by writing to the Grievance Officer.

An assessment that remains incomplete for 60 days from the date it was started is treated as abandoned and is not available to be resumed after that point.

8. Grievance Officer

In accordance with Rule 5(9) of the SPDI Rules, any complaints or queries regarding the processing of personal information or sensitive personal data or information under this Policy may be addressed to:

9. Review and correction

Users may review the personal information they have provided and request correction of any inaccuracy, in accordance with Rule 5(6) of the SPDI Rules, by writing to the Grievance Officer.

10. Changes to this policy

This Policy may be revised from time to time. Any material changes will be notified to Users through the Tool or by email, and the “Effective date” above will be updated accordingly.

11. Governing law

This Policy is governed by the laws of India, including the Information Technology Act, 2000 and the rules made thereunder. Any dispute arising under this Policy shall be subject to the jurisdiction of the courts at Chennai, Tamil Nadu.