How we handle your data.
A plain-language summary of our posture. It is not a substitute for the full data agreement we provide to clinics at onboarding. Last reviewed June 2026.
What we handle
The clinic and patient records you create or import while using Lemma, registrations, encounters, notes, prescriptions, and documents you choose to bring in.
Where it’s processed
Patient data is processed in India, in AWS ap-south-1. We design our systems to keep Indian health data in India.
How it’s protected
Data is encrypted in transit and at rest. Access is role-based, and every change is written to an insert-only audit trail, nothing is silently overwritten.
Consent
We record purpose-specific consent for data use, and erasure is built into the data model. Lemma is designed for compliance with India’s DPDPA.
The patient’s copy
Records are FHIR-native and ABHA-linked. The patient keeps their own copy that follows them between providers. We do not sell patient data.
How AI is used
AI assists clinicians with drafting and suggestions; a clinician always confirms before anything is recorded or acted on. Lemma does not make autonomous clinical decisions.
Questions about data handling? Get in touch.