Nevika Cura Healthcare / Indian review

Indian DPDP & healthcare checklist

Initial source review · 30 October 2026. Each item records what exists, what remains unproven and who needs to close it.

0
Verified covered: 10
Partially covered: 6
Missing / unverified

Verified checklist coverage0% · 0/16

Partial controls receive no completion credit. Covered requires supporting evidence and reviewer sign-off; missing includes controls with no verified evidence. All 16 items have been source-reviewed, but none is closed. This percentage is checklist coverage—not legal compliance, clinical validation or certification.

DPDP & privacy

0 covered · 6 partial · 4 missing / unverified

Healthcare

0 covered · 4 partial · 2 missing / unverified

First priorities

Enforce consent at chat, clinical processing and direct file-upload boundaries; verify refusal and withdrawal.
Reconcile retention promises and verify complete export and deletion, including failures and processor copies.
Resolve children’s-data authority, clinical intended use, RMP verification and prescribing boundaries.
Obtain supplier, incident-response, independent security and clinical-evaluation evidence before stronger claims.

Item-by-item review

1 of 16

Privacy · Evidence needed

Applicable laws and commencement dates

Review requirement

Identify which Indian privacy duties apply now, which are phased in, and which existing IT/SPDI requirements remain relevant.

What the review found

DPDP commencement is phased: institutional provisions began on 13 November 2025; the consent-manager phase is scheduled for 13 November 2026; most substantive duties and operational rules are scheduled for 13 May 2027. As of this review date, it would be inaccurate to describe all duties as already in force. Existing IT/SPDI obligations still need an entity-specific assessment.

Evidence inspected

G.S.R. 843(E): Act commencement notification
G.S.R. 846(E): final Rules and phased commencement
No signed Nevika-specific applicability opinion reviewed.

Next action to close

Indian privacy counsel should map the Act, final Rules, commencement notifications and transitional obligations to Nevika's actual services.

Responsible reviewer: Indian privacy counsel + product owner

Closure evidence and reviewer sign-off: not recorded.

Full checklist

Showing 16 of 16 items

Applicable laws and commencement datesPrivacy · Evidence needed · Source review complete

Review requirement

Identify which Indian privacy duties apply now, which are phased in, and which existing IT/SPDI requirements remain relevant.

What the review found

Evidence inspected

G.S.R. 843(E): Act commencement notification
G.S.R. 846(E): final Rules and phased commencement
No signed Nevika-specific applicability opinion reviewed.

Next action to close

Indian privacy counsel should map the Act, final Rules, commencement notifications and transitional obligations to Nevika's actual services.

Responsible reviewer: Indian privacy counsel + product owner

Closure evidence and reviewer sign-off: not recorded.

Clear notices and defensible public claimsPrivacy · Partial control · Source review complete

Review requirement

State collected data, purposes, rights, recipients and contact details clearly; publish only safeguards supported by evidence.

What the review found

Privacy, retention and safety pages exist. They previously asserted compliance, provider contracts, encryption layers and certifications without reviewed supporting evidence. The retention pages also give inconsistent deletion periods.

Evidence inspected

/legal/privacy
/legal/data-retention
/security — replaced with evidence-limited Privacy & Safety wording in this review.

Next action to close

Reconcile all policy promises against verified operations; approve readable notices in supported languages. Remaining legal-policy claims need counsel and operational review.

Responsible reviewer: Privacy counsel + content owner

Closure evidence and reviewer sign-off: not recorded.

Consent, refusal and withdrawalPrivacy · Partial control · Source review complete

Review requirement

Record informed, purpose-specific choices and make withdrawal accessible, with the consequences explained.

What the review found

Purpose choices and consent history exist. The server refuses withdrawal of essential and AI-processing consent and directs people to account closure. Audit writes do not check returned errors. Withdrawal and refusal need a complete journey test.

Evidence inspected

consent.functions.ts: setMyConsents and withdrawConsent
consent-guard.server.ts: requireConsent

Next action to close

Review whether stopping the relevant service can honour withdrawal without forcing account deletion; test refusal, withdrawal and recorded history across every processing path.

Responsible reviewer: Privacy counsel + engineering

Closure evidence and reviewer sign-off: not recorded.

Data inventory and purpose enforcementPrivacy · Partial control · Source review complete

Review requirement

Map every collection, storage, disclosure and optional use to a documented purpose and responsible owner.

What the review found

The consent guard exists, but the inspected chat endpoint and clinical-task handler reach AI processing without calling it. Document registration checks consent, while the inspected direct-upload storage policy checks ownership only. These are source-level gaps, not live exploit tests.

Evidence inspected

api/chat.ts: anonymous chat and model execution
clinical.functions.ts: authenticated model call without purpose guard
documents.functions.ts: registration consent check; July 2026 storage migration: owner-folder upload policy

Next action to close

Trace each journey and processor, including anonymous use; test that declining an optional purpose actually prevents that use.

Responsible reviewer: Privacy lead + engineering

Closure evidence and reviewer sign-off: not recorded.

Children and family-member authorityPrivacy · Gap identified · Source review complete

Review requirement

Review age assurance, verifiable parental consent where applicable, and authority to manage another person's health information.

What the review found

The policy says 18+ while allowing parents to manage minor family profiles. A disclaimer making parents responsible is not evidence of age or parental-authority verification.

Evidence inspected

/legal/privacy, section 9
Family profiles are an available service.

Next action to close

Decide and enforce a supported age/guardian model; document verification and adult-family consent, considering any applicable notified exemptions.

Responsible reviewer: Privacy counsel + family product owner

Closure evidence and reviewer sign-off: not recorded.

Access, correction, erasure and nominationPrivacy · Partial control · Source review complete

Review requirement

Provide identity-checked rights requests, including correction, erasure, grievance and nomination where applicable.

What the review found

Account export and deletion controls exist. Export covers nine listed tables and document metadata, not uploaded files or every newer record category. A complete correction and nomination workflow was not evidenced.

Evidence inspected

account.functions.ts: exportMyData
/account/privacy
/legal/privacy, section 6

Next action to close

Map all owned records; test a synthetic account export and correction; establish a nomination request and identity-check procedure. Do not describe the current export as every stored record.

Responsible reviewer: Privacy operations + engineering

Closure evidence and reviewer sign-off: not recorded.

Retention, deletion and backup recoveryPrivacy · Partial control · Source review complete

Review requirement

Apply justified retention periods consistently and verify erasure across records, files, processors and backups, with documented exceptions.

What the review found

Deletion attempts record and file removal, but ignores some failures and lists only up to 1,000 files. The public policies disagree on 30/90-day document deletion and promise a 35-day backup expiry without reviewed proof.

Evidence inspected

account.functions.ts: deleteMyAccount uses best-effort cleanup
/legal/privacy and /legal/data-retention

Next action to close

Create a full retention map and reliable deletion report; use a disposable test account to verify every record and file is gone. Obtain actual backup expiry and legal-hold evidence.

Responsible reviewer: Engineering + privacy operations + finance

Closure evidence and reviewer sign-off: not recorded.

Suppliers, AI data use and transfersPrivacy · Evidence needed · Source review complete

Review requirement

Review supplier contracts, downstream model providers, training/retention settings, processing locations and applicable transfer restrictions.

What the review found

The policy names hosting, OpenRouter, Sarvam, Cashfree, Resend, MSG91 and Sentry. Signed processing terms, model-provider data settings and locations were not reviewed; Puvio and Firebase also need inclusion in the data-flow review.

Evidence inspected

/legal/privacy, sections 4–5
Existing Puvio sign-in/connector and Firebase notification integrations.

Next action to close

Build a current supplier register with actual recipients, data fields, locations, deletion terms and contracts. Do not claim no model training or India-only storage without evidence.

Responsible reviewer: Privacy counsel + supplier owner

Closure evidence and reviewer sign-off: not recorded.

Access controls and security assurancePrivacy · Partial control · Source review complete

Review requirement

Demonstrate least privilege, private health records, protected credentials, staff access controls and appropriate security testing.

What the review found

Authenticated account functions and a consent guard are visible. Public error ingestion accepts message, stack, URL and metadata without content redaction; monitoring forwards error details. Hosted access policies, staff MFA and independent assessment were not tested. HTTPS does not establish end-to-end encryption.

Evidence inspected

account.functions.ts: authenticated middleware
api/public/client-error.ts: clipped but unredacted inputs
sentry.server.ts: forwarded error details; clinical.functions.ts: upstream error logging

Next action to close

Test cross-account reads/writes and file access; review staff access and hosted security settings; obtain an independent assessment and recovery test results.

Responsible reviewer: Security lead + independent assessor

Closure evidence and reviewer sign-off: not recorded.

Incidents, breach notifications and grievancesPrivacy · Evidence needed · Source review complete

Review requirement

Assign incident and grievance owners and document applicable reporting windows, evidence preservation and user communications.

What the review found

info@nevika.ai is published. A named responsible officer, staffed grievance process, incident exercise and retained security-log evidence were not reviewed. Policy response promises are not operational proof.

Evidence inspected

/legal/privacy, section 10
/security contact information

Next action to close

Assign accountable owners and test the mailbox and escalation process. Counsel should assess CERT-In's six-hour reporting and 180-day log duties where applicable, alongside phased DPDP breach requirements.

Responsible reviewer: Security operations + privacy counsel

Closure evidence and reviewer sign-off: not recorded.

Clinical intended use and device classificationHealthcare · Evidence needed · Source review complete

Review requirement

Assess the actual intended use of symptom support, lab interpretation, medication checks and clinician outputs under applicable Indian device rules.

What the review found

The medical disclaimer calls outputs informational and says Nevika is not registered as a medical device. That wording does not determine whether particular functions require CDSCO assessment or authorisation.

Evidence inspected

/legal/medical-disclaimer, sections 1 and 5
/clinician and /interpretation offer clinical-support outputs.

Next action to close

Create a feature-by-feature intended-use statement; have Indian regulatory counsel assess software classification and permitted claims before diagnostic or treatment positioning.

Responsible reviewer: Regulatory counsel + clinical lead

Closure evidence and reviewer sign-off: not recorded.

Clinical review and AI safety evaluationHealthcare · Partial control · Source review complete

Review requirement

Require qualified review of clinical outputs and evaluate errors, citations, high-risk populations, language performance and escalation.

What the review found

Safety notices and chat screening exist. The inspected classifier uses English patterns over the first 4,000 characters; clinical tasks return model output to any authenticated user without a credential check or mandatory sign-off. No clinician-signed safety evaluation was reviewed.

Evidence inspected

ai-safety.ts: English-pattern screening and length limit
api/chat.ts: last-user-message screening
clinical.functions.ts: authentication, not professional verification

Next action to close

Run a clinician-approved test set using synthetic cases, record failure modes and acceptance criteria, and require human approval before notes or codes enter patient care.

Responsible reviewer: Registered clinical lead + safety reviewer

Closure evidence and reviewer sign-off: not recorded.

Doctor identity and teleconsultation consentHealthcare · Partial control · Source review complete

Review requirement

Where teleconsultation is provided, verify RMP registration, patient identity, consultation consent, records and permitted consultation modes.

What the review found

Doctor listings and booking requests exist. Booking is not proof of a compliant consultation service or verified practitioner credentials. A completed RMP onboarding and consultation review was not evidenced.

Evidence inspected

/doctors and /my-bookings
doctors.server.ts implements booking actions.

Next action to close

Define whether Nevika coordinates bookings or provides consultations; verify RMP credentials and publish their registration details where required; review consent and recordkeeping for the actual consultation journey.

Responsible reviewer: Clinical operations + healthcare counsel

Closure evidence and reviewer sign-off: not recorded.

Prescribing and medicine fulfilment boundariesHealthcare · Evidence needed · Source review complete

Review requirement

Keep AI separate from prescribing; assess prescription validity, medicine restrictions and pharmacy/licensed fulfilment duties for the actual service.

What the review found

The disclaimer says Nevika does not prescribe and prescription medicines require an RMP prescription. That statement alone does not establish fulfilment licensing or prescription checks across the medicine-order journey.

Evidence inspected

/legal/medical-disclaimer, section 6
Medicine information and ordering require separate fulfilment review.

Next action to close

Audit the actual order and prescription-verification process with the licensed fulfilment partner. Apply telemedicine medicine-list restrictions where consultations occur; AI must not independently counsel or prescribe in place of an RMP.

Responsible reviewer: Licensed pharmacy partner + healthcare counsel

Closure evidence and reviewer sign-off: not recorded.

Emergency escalation and vulnerable usersHealthcare · Partial control · Source review complete

Review requirement

Make emergency help accessible and avoid representing AI or booking as an emergency response service.

What the review found

The disclaimer directs Indian users to 112 and the app has an SOS flow. Call handling, accessibility, language behaviour and high-risk clinical escalation were not validated in this review.

Evidence inspected

/legal/medical-disclaimer, sections 3 and 7
Existing SOS call and messaging flow.

Next action to close

Test emergency links without placing live emergency calls, including mobile accessibility; have a clinician review red-flag routing, pregnancy, paediatric and chronic-condition cases.

Responsible reviewer: Clinical safety lead + accessibility tester

Closure evidence and reviewer sign-off: not recorded.

Clinical records, sharing and coding traceabilityHealthcare · Partial control · Source review complete

Review requirement

Maintain accurate, attributable clinical records and validate coding and any hospital/ABDM connection before claiming interoperability.

What the review found

A private-records feature and WHO coding interface exist. Hospital exchange, ABDM approval, clinician-signed note provenance and successful live WHO lookup were not established by this review.

Evidence inspected

/vault
/clinician and icd11.functions.ts
Rhazes feature comparison identifies record-integration gaps.

Next action to close

Verify access and sharing consent, provenance and corrections; validate WHO lookup with configured credentials. Treat ABDM participation and hospital integration as separate evidence-backed approvals, not implied certification.

Responsible reviewer: Clinical informatics lead + engineering

Closure evidence and reviewer sign-off: not recorded.

Official references

As of 30 October 2026, most substantive DPDP duties are scheduled for 13 May 2027. Counsel must confirm current applicability, transitional IT/SPDI duties, exemptions and later amendments. Telemedicine and CERT-In requirements must be assessed separately; a disclaimer does not determine device classification.

Public review snapshot; no patient data. Updates require fresh evidence. Privacy questions: info@nevika.ai.