Terms & Conditions
1. Introduction and Scope
These Terms and Conditions ("Agreement") govern the use of the MobiLab Point-of-Care Diagnostics Application (the "Application"), which is Software as a Medical Device (SaMD) developed, manufactured, and maintained by Primary Healthtech Private Limited trading as MobiLab Healthcare (the "Company").
The Application is regulated as an In Vitro Diagnostic (IVD) medical device under the Medical Device Rules, 2017 (MDR 2017) and notified CDSCO guidelines, and is intended for use by authorized laboratory operators and technicians at point-of-care facilities for conducting medical diagnostic tests, managing patient bookings, and generating laboratory reports.
By accessing or using this Application, the User acknowledges that they have read, understood, and agree to be bound by these Terms and Conditions, as well as all applicable policies, guidelines, regulatory requirements, and SOPs.
1.1 Application Purpose and Intended Use
The MobiLab Application facilitates:
• Patient registration and booking management
• Diagnostic test conduction including CBC (Complete Blood Count), biochemistry panels (Albumin, Hemoglobin, Total Protein, Urea, ALP, and others), Fluorescence Immunoassay (FIA), urine analysis, serology, blood group, ESR, electrolyte, and thyroid testing
• Medical device connectivity (DUO Analyzer via USB, CBC Machine via Bluetooth, MobiMix Mixer)
• Reagent and lot management with Quality Control (QC) workflows
• Diagnostic report generation and transmission
• ABDM (Ayushman Bharat Digital Mission) integration via ABHA health records
• Operator training and competency assessment
1.2 Intended Users
This Application is intended for use by trained and authorized laboratory operators, technicians, and supervisory personnel at authorized healthcare facilities, diagnostic centers, and point-of-care testing (POCT) centers who have completed mandated training and competency assessment as prescribed by the Company.
2. REGULATORY COMPLIANCE FRAMEWORK
This Agreement is designed and implemented in accordance with the following regulatory and standards frameworks:
• Medical Device Rules (MDR), 2017 – IVD classification and CDSCO post-market surveillance requirements
• ISO/IEC 62304:2015 – Medical Device Software Lifecycle processes
• ISO 13485:2016 – Quality Management System for medical device manufacturers
• ISO 27001:2022 – Information Security Management System (ISMS)
• ISO 27701:2019 – Privacy Information Management System (PIMS)
• ISO 14971:2019 – Risk Management for medical devices
• Digital Personal Data Protection Act, 2023 (DPDP Act) – India
• ABDM Health Data Management Policy – Health information exchange standards
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
3. DEFINITIONS
Term
Application
User / Operator
Patient
PII
PHI
ABHA
Session
QC
Definition
The MobiLab Point-of-Care Diagnostics mobile application, classified as Software as a Medical Device (SaMD) / In Vitro Diagnostic (IVD) under CDSCO MDR 2017
An authorized laboratory technician, operator, or supervisor using the Application who has completed mandatory training and competency assessment
An individual whose personal and medical data is processed through the Application for diagnostic testing
Personally Identifiable Information, including patient name, date of birth, gender, phone number, health identifiers, and ABHA address
Protected Health Information, including diagnostic test results, sample data, medical reports, and clinical observations
Ayushman Bharat Health Account, a unique digital health identity issued under the Ayushman Bharat Digital Mission (ABDM)
A test conduction session identified by a unique session ID, encompassing one or more patient diagnostic tests performed by a single operator
Quality Control procedures including blank readings, control material testing, and calibration validation to ensure test accuracy and device functionality
4. USER ELIGIBILITY AND RESPONSIBILITIES
4.1 User Eligibility
The Application is intended exclusively for use by:
• Trained and authorized laboratory operators, technicians, and supervisory personnel
• Personnel who have successfully completed all mandatory training modules (Video Instruction, Multiple-Choice Questions (MCQs), Theory Examination, and Practical Assessment) within the MobiLab Training Center
• Personnel who have attained a minimum competency threshold in practical assessment (as defined by facility protocol)
• Users who have been issued valid authentication credentials (Phone number / email id & OTP) by their supervising facility administrator or the Company
• Personnel who have acknowledged these Terms and Conditions and agree to comply with all applicable SOPs and regulatory requirements
4.2 User Responsibilities and Obligations
Users are required and responsible for:
• Maintaining strict confidentiality of login credentials and not sharing access tokens, passwords, or authentication mechanisms with any other individual
• Ensuring that patient data is entered accurately, verified, and confirmed before initiating test conduction
• Following all Standard Operating Procedures (SOPs) for device connection, test execution, result reporting, and data transmission
• Performing mandatory Quality Control (QC) checks and blank readings before each diagnostic operation session
• Reporting any security incidents, unauthorized access attempts, data breaches, system anomalies, or suspected compromises to the designated Information Security Officer immediately
• Logging out of the Application after completing operations and never leaving an active session unattended
• Maintaining the device and Application updated to the latest released version as recommended or required by the Company
• Adhering to data protection protocols and ensuring that patient information is not disclosed or shared with unauthorized individuals
5. DATA COLLECTION, PROCESSING, AND STORAGE
In accordance with ISO 27701 (PIMS) and DPDP Act, 2023, this section details the categories of personal data collected, the purposes of processing, and the storage mechanisms employed.
5.1 Categories of Data Collected
5.1.1 Patient Personal Data (PII)
• Full name, date of birth, gender, height, and weight
• Phone number and email address (where applicable)
• Sample ID and Booking ID
• ABHA Address and ABHA Number (when ABDM integration is enabled)
5.1.2 Medical and Diagnostic Data (PHI)
• Test results from CBC, biochemistry panels (Albumin, Hemoglobin, Total Protein, Urea, ALP, and others), Fluorescence Immunoassay (FIA), urine analysis, serology, blood group, ESR, electrolyte, and thyroid tests
• Sample type (blood, serum, plasma, urine) and sample identifiers
• Device integration codes and serial numbers for device-to-application data transfer
• Blank readings, reagent lot details, expiry dates, and QC calibration data
• Timestamp and operator identification for each test
5.1.3 Operator Data
• Operator credentials (email, phone number, facility affiliation)
• Training progress, assessment scores, and competency status
• Session activity logs, device interaction records, and login/logout timestamps
5.1.4 Device and Technical Data
• Connected device identifiers (device ID, firmware version, battery percentage)
• Application version, build variant, and operating system information
• Network connectivity status, synchronization timestamps, and offline queue metrics
5.2 Purpose of Data Processing
Data is collected and processed strictly for the following legitimate purposes:
• Diagnostic service delivery: Conducting tests, generating accurate reports, managing patient workflows, and ensuring continuity of care
• Quality assurance: QC validation, reagent tracking, blank reading calibration, and device performance monitoring
• Regulatory compliance: ABDM/ABHA health record linking, post-market surveillance reporting, and CDSCO compliance documentation
• Training and competency: Operator skill assessment, certification maintenance, and competency verification
• Operational continuity: Offline data synchronization, backup, and recovery to ensure test results are not lost during network disruptions
• Security and incident response: Audit trails, anomaly detection, and breach investigation
5.3 Data Storage and Security
• Local storage: Authentication tokens, operator preferences, and device configuration are stored in encrypted SharedPreferences on the mobile device using AES-256 encryption
• Cloud storage: Patient data, test results, reports, and session records are stored on secure backend servers with role-based access controls, encryption at rest, and TLS/HTTPS encryption in transit
• Offline queue: When network connectivity is unavailable, test data is queued locally and synchronized with the backend server automatically when connectivity is restored
• Backup and redundancy: Backup copies are maintained on secure servers with documented recovery procedures
6. ABDM / ABHA DATA HANDLING
When ABDM integration is enabled by a facility:
• The Application may collect ABHA Address and ABHA Number for linking patient health records within the ABDM ecosystem
• Explicit patient consent is obtained prior to ABHA linking in accordance with the ABDM Health Data Management Policy and documented in the Application
• ABHA data is transmitted securely to ABDM-approved Health Information Providers (HIPs) and Health Information Users (HIUs) with encryption and authenticated channels
• The Company acts as a Health Information Provider and adheres to ABDM data-sharing consent frameworks and API standards
• Patients retain the right to revoke ABHA linking consent at any time through the ABDM mobile application or web portal
• The Company shall not use ABHA data for any purpose other than direct patient care and regulatory compliance
7. INFORMATION SECURITY MEASURES (ISMS – ISO 27001:2022)
The following information security controls are implemented in alignment with ISO 27001:2022 Annex A and comply with DPDP Act security requirements:
7.1 Access Control (A.9)
• Token-based authentication (OAuth 2.0 access token and refresh token) for all API communications
• Session expiry management with automatic re-authentication prompts (token validity: 1 hour for access, 7 days for refresh)
• Role-based access control (RBAC) to ensure only authorized operators can conduct tests and access patient data
• Multi-factor authentication (MFA) support for facility administrator accounts
7.2 Communications Security (A.13)
• All data transmitted between the Application and backend servers is encrypted using TLS 1.2 or higher (HTTPS)
• Bluetooth communication with CBC devices uses standard Bluetooth Low Energy (BLE) security protocols with paired device verification
• USB serial communication with the DUO Analyzer is restricted to authenticated operator sessions and uses encrypted data transfer
7.3 Operations Security (A.12)
• Sensitive data (tokens, credentials, PII) is masked in application logs and audit records
• Application state is cleared upon session exit to prevent data leakage or unauthorized access
• Offline sync queue ensures data integrity during network interruptions with checksums and automatic retry mechanisms
• Error handling and exception logging are implemented without exposing sensitive information
7.4 Asset Management (A.8)
• Device identifiers are tracked per session for audit trail and traceability purposes
• Reagent lot information and expiry dates are maintained within the Application and monitored for compliance
• Firmware version and device health metrics are monitored during device connection
7.5 Incident Management (A.16)
• Users must report any suspected security incidents, unauthorized access, data anomalies, or breaches to the designated Information Security Officer immediately
• The Company maintains a documented incident response plan and will notify affected parties within regulatory timelines (as per DPDP Act requirements)
• Post-incident review and corrective actions will be documented and communicated to stakeholders
8. PRIVACY RIGHTS AND DATA SUBJECT RIGHTS (PIMS – ISO 27701:2019)
In compliance with ISO 27701:2019 and the Digital Personal Data Protection Act, 2023:
8.1 Consent and Legal Basis
• Patient data is collected and processed based on the legitimate purpose of diagnostic service delivery and healthcare provision
• Where required (e.g., ABHA linking, optional research participation), explicit patient consent is obtained, documented, and recorded in the Application
• Operators consent to the processing of their activity and training data for competency assessment, security audit, and regulatory compliance purposes
8.2 Data Subject Rights
Patients and operators have the following rights, subject to legal and regulatory requirements:
• Right of Access: Request a copy of personal data held by the Application
• Right to Correction: Request correction of inaccurate personal data
• Right to Erasure: Request deletion of personal data where there is no overriding legal or regulatory retention requirement
• Right to Data Portability: Request data in a structured, machine-readable format (e.g., CSV, JSON)
• Right to Withdraw Consent: Revoke consent for ABHA linking, optional data processing, or research participation
8.3 Data Retention
• Patient diagnostic data is retained for the period mandated by applicable healthcare regulations (generally 5 years from test date as per Clinical Establishment Act and facility protocols)
• Authentication tokens are retained only for the duration of the active session and cleared upon logout or session expiry
• Training records are retained for the duration of the operator's engagement with the facility plus 3 years
• Upon request or when data is no longer required, personal data will be securely erased using cryptographic or physical destruction methods in accordance with the Company's data disposal policy
9. MEDICAL DEVICE USAGE AND SOFTWARE AS MEDICAL DEVICE (SaMD) COMPLIANCE
9.1 Device Connection and Configuration
• The Application connects to medical diagnostic devices (DUO Analyzer, CBC Machine, MobiMix Mixer) via USB, Bluetooth Low Energy (BLE), and serial communication interfaces
• Users must ensure devices are properly calibrated, maintained, and connected before initiating tests
• The Application monitors device health metrics (battery percentage, firmware version, connection status) but does not replace manufacturer-prescribed maintenance schedules
• Device configuration and firmware updates shall be performed only by authorized personnel as per manufacturer and facility protocols
9.2 Software Lifecycle and Updates (ISO/IEC 62304)
• The Application is developed and maintained following ISO/IEC 62304:2015 (Medical Device Software Lifecycle) processes
• Software updates are released periodically and may include bug fixes, security patches, feature enhancements, and regulatory compliance updates
• Users may receive notifications of available updates; mandatory updates will be clearly marked and may be enforced for security or regulatory reasons
• Use of outdated versions may be restricted or disabled for security and compliance reasons
9.3 Post-Market Surveillance and Adverse Event Reporting
• The Company maintains a post-market surveillance system and monitors for adverse events, device malfunctions, and software anomalies
• Users and facilities are required to report any adverse events, serious injuries, or suspected device failures to the Company and the relevant regulatory authorities (CDSCO) as mandated
• Adverse event reports must be submitted within the timelines specified by Medical Device Rules, 2017
10. TEST RESULT ACCURACY AND CLINICAL DISCLAIMER
10.1 Result Generation and Data Accuracy
Test results generated through the Application are dependent upon and subject to:
• The accuracy and calibration status of the connected diagnostic devices
• The quality and validity of reagents used (including lot number verification and expiry date compliance)
• The adherence to prescribed test protocols and standard operating procedures
• The proper handling and preparation of samples
• Operator competency and adherence to quality standards
10.2 Clinical Interpretation Disclaimer
• The Application serves as a data acquisition, processing, and reporting tool only and does not perform clinical interpretation of results
• Clinical interpretation of test results must be performed by qualified medical professionals (doctors, pathologists, or other authorized healthcare practitioners) who are licensed to practice medicine
• The Company does not assume liability for diagnostic decisions, treatment recommendations, or clinical outcomes made based on test results
• The User and healthcare facility are solely responsible for ensuring that qualified medical professionals review and interpret all diagnostic reports before they are communicated to patients
11. QUALITY CONTROL (QC) AND REAGENT MANAGEMENT
11.1 Mandatory QC Procedures
• Users must perform QC procedures (blank readings, control material testing, and calibration checks) as mandated by facility protocols before conducting patient diagnostic tests
• QC results are recorded within the Application and must meet facility-defined acceptance criteria before patient testing can proceed
• Failed QC results must be investigated and resolved before resuming patient testing
11.2 Reagent Tracking and Expiry Management
• The Application tracks reagent lot numbers, expiry dates, and usage history
• Alerts are generated when reagent lots are nearing expiry or have expired
• Expired reagents are flagged and prevented from use in patient testing
• QC reports are generated and retained for audit, compliance, and regulatory inspection purposes
12. TRAINING AND COMPETENCY REQUIREMENTS
• New operators must successfully complete all Training Center modules before being authorized to conduct live patient diagnostic tests
• Training modules include: Video Instruction, Multiple-Choice Questions (MCQ), Theory Examination, and Practical Assessment
• Practical assessment requires a connected and functional diagnostic device for hands-on demonstration
• Operators must achieve a minimum competency threshold (typically 70% or higher) on all assessments
• Training records, assessment scores, and competency status are maintained within the Application and can be reviewed by facility administrators for compliance verification
• Periodic retraining may be required as determined by regulatory updates, facility policy changes, or performance issues
13. OFFLINE MODE AND DATA SYNCHRONIZATION
• The Application supports offline operation for test conduction during network connectivity disruptions
• Test data captured in offline mode is stored securely in the device's local encrypted queue and synchronized with the backend server automatically when network connectivity is restored
• Users are responsible for ensuring that the device maintains sufficient storage capacity and battery life during offline operations
• The Company maintains automatic retry mechanisms with exponential backoff to ensure data synchronization even under intermittent network conditions
• In the event of data loss due to device failure during offline mode, the Company's liability is limited as per Section 15 of these Terms
14. INTELLECTUAL PROPERTY
• The Application, its source code, design, algorithms (including the Simulated Annealing test scheduler), user interface, documentation, and all associated intellectual property are the exclusive property of Primary Healthtech Private Limited / MobiLab Healthcare Pvt. Ltd.
• Users are granted a limited, non-exclusive, non-transferable, revocable license to use the Application solely for its intended diagnostic purpose within the authorized facility
• Reverse engineering, decompilation, code disassembly, unauthorized modification, or attempted circumvention of security measures is strictly prohibited and may result in termination of access and legal action
• Unauthorized copying, distribution, or reproduction of the Application is prohibited and constitutes infringement of intellectual property rights
15. LIMITATION OF LIABILITY
• The Application is provided "as is" and "as available" for authorized diagnostic use at the facility
• The Company shall not be liable for indirect, incidental, consequential, or punitive damages (including lost profits, data loss, or business interruption) arising from the use or inability to use the Application
• The Company's total aggregate liability arising from or related to these Terms and the Application shall not exceed the total fees paid by the facility for the Application license in the twelve (12) months immediately preceding the event giving rise to liability
• The Company is not responsible for:
◦ Diagnostic errors arising from device malfunction, calibration issues, or maintenance failures
◦ Inaccurate results due to reagent quality issues, expired reagents, or contaminated samples
◦ User error, failure to follow prescribed testing protocols, or improper sample handling
◦ Network failures, internet service provider issues, or device communication failures outside the Application's control
◦ Loss or corruption of data due to device failure, storage media failure, or user negligence
16. TERMINATION
• The Company reserves the right to suspend or terminate access to the Application for:
◦ Material breach of these Terms and Conditions
◦ Security concerns, unauthorized access attempts, or suspected malicious activity
◦ Non-compliance with regulatory requirements or facility protocol violations
◦ Non-payment of license fees (if applicable)
• Upon termination, the operator's access credentials are immediately revoked and all locally stored session data is cleared from the device
• Patient data retained on backend servers shall be handled in accordance with the data retention policy (Section 8.3) and applicable healthcare regulations
17. UPDATES AND MODIFICATIONS
• The Company may update these Terms and Conditions periodically to reflect regulatory changes, feature updates, or operational improvements
• Material changes to these Terms will be communicated to users through in-app notifications, email, or facility administrator alerts
• The Application may prompt mandatory updates when new versions are available; continued use of outdated versions may be restricted for security and regulatory compliance reasons
• Continued use of the Application after notification of changes to these Terms constitutes acceptance of the revised Terms and Conditions
18. GOVERNING LAW AND DISPUTE RESOLUTION
• This Agreement shall be governed by and construed in accordance with the laws of India, without regard to conflict of laws principles
• Exclusive jurisdiction for any legal proceedings arising from this Agreement is vested in the courts located in Noida, Uttar Pradesh, India
• The parties agree to attempt resolution of disputes through good-faith negotiation and mediation before resorting to formal litigation
19. CONTACT INFORMATION AND DATA SUBJECT REQUESTS
For questions, data subject requests, or to report security incidents:
Data Protection Officer
Email Address
Phone Number
Registered Office
Manufacturing License
MFG/IVD/2025/000042
7042750444
Pranjal Tripathi
ACKNOWLEDGMENT AND ACCEPTANCE
By accessing, installing, or using the MobiLab Point-of-Care Diagnostics Application, the User acknowledges that:
1. They have read and fully understood these Terms and Conditions in their entirety
2. They agree to be bound by all provisions, obligations, and restrictions contained herein
3. They have the authority to bind the facility to these Terms and Conditions
4. They agree to comply with all applicable regulatory requirements, SOPs, and best practices in medical device use
5. They will report any adverse events, security incidents, or suspected device malfunctions to the Company and relevant regulatory authorities
This document constitutes the entire agreement between the User and Primary Healthtech Private Limited regarding the use of the MobiLab Application and supersedes all prior negotiations, understandings, and agreements.
Version 1.0 Effective Date: 17-03-2026 Next Review Date: 16-03-2027