Data processing agreement

1. Scope

Whose data

• Candidates the organization invites, and the organization’s own staff using the console.

What data

• Account details: name and email address.
• Test data: answers, scores, timing and submission receipts, the IP address an attempt was opened or resumed from and the device setup recorded with it, and messages between candidates and proctors and staff notes.
• Proctoring data, as the organization’s policy for each test sets it: events, and where enabled, identity photos and the details read from an ID card, and screenshots, camera photos and short audio clips taken at a warning.
• Security records: IP addresses, browser details and an audit record of actions.

Why

Only to deliver, proctor and mark the organization’s assessments and report results to it, and to keep the service secure. Medhank does not use this data for its own purposes, sell it, use it for advertising, or use it to train any model.

2. Instructions

1. Medhank processes the data only on the organization’s documented instructions, which are these terms and the settings it chooses in the console — including each test’s proctoring policy.
2. If Medhank believes an instruction breaks the law, it will say so and need not follow it.
3. Medhank will process the data otherwise only where the law requires, and will tell the organization first unless the law forbids that.

3. Confidentiality and access

1. Medhank staff may access the data only to provide support the organization asked for, or to keep the service secure. That access is time-limited, needs a stated reason, and is recorded.
2. Everyone at Medhank with access is bound by confidentiality.

4. Security

Medhank keeps reasonable security safeguards, including:

• a separate database schema for each organization, so one can never read another’s data;
• encryption in transit for all traffic, hashed passwords and encrypted two-factor secrets;
• private object storage for files, opened only through short-lived links;
• on-device processing of camera and microphone, so most media never leaves the candidate’s device;
• role-based access for the organization’s staff, and an audit record of consequential actions;
• security logs kept for at least 7 years, for detecting and investigating misuse.

5. Personal data breaches

If Medhank becomes aware of a breach affecting the organization’s data, it will tell the organization without undue delay, and within 24 hours of becoming aware of it, with what is known about its nature, the data affected, the likely consequences and what is being done. It will then help the organization notify the Data Protection Board and the people affected within the times the DPDP Rules require.

6. Sub-processors

1. The organization authorises Medhank to use the sub-processors listed on the sub-processors page.
2. Medhank will announce a new sub-processor there at least 30 days before it is used for the organization’s data. An organization that objects on reasonable data-protection grounds may end its use of Medhank before the change.
3. Medhank binds each sub-processor to protections no weaker than these, and remains responsible for them. The terms each is bound by are named on the sub-processors page; for Cloudflare, the Cloudflare Data Processing Addendum.

Connected AI assistants

1. If the organization asks Medhank to switch on the connector for its teachers’ AI assistants, the assistants its teachers connect act on the organization’s behalf, under the organization’s and its teachers’ own arrangements with their providers. They are not Medhank’s sub-processors.
2. Medhank offers a connected assistant only the actions its user’s role permits in the service, and never lets it publish an assessment or its results, end a sitting, or decide a re-test. For marking, it gives answers without candidates’ names, roll numbers, email addresses or other identity fields, with the candidate’s own name, email addresses, phone numbers and links written into answers removed on a best-effort basis, and accepts only draft suggestions, which a teacher must confirm. For proctoring, it lets the assistant clear a flag only with its user’s written reason, or mark a sitting reviewed. Results, including scores, places and marked answers, are read only. Aggregate figures about fewer than 5 candidates are withheld. Markers are named only to an administrator’s connection declared as a business or education account. Every call is recorded, and the organization can disconnect any assistant at once.
3. Medhank gives a connected assistant proctoring information as text only, never images, audio or identity documents. It gives candidates’ names only to connections declared as business or education accounts, and otherwise a label that means nothing outside that connection. Roll numbers, email addresses and attempt identifiers are never given.
4. The organization decides which kinds of account may connect. Where it allows personal accounts, it accepts that their providers may use the data under their consumer terms. Medhank cannot detect which plan an assistant is on, so each teacher declares it when connecting. Medhank does not let a connection declared as a personal account read any assessment that may include candidates under 18: one the organization has marked so, or, where the assessment does not say, any assessment of an organization that has not confirmed its candidates are all adults. A change to these settings applies at once.

7. Helping with candidates’ rights

Candidates exercise their rights — to a summary of their data, correction, erasure and grievance redressal — through the organization, which is responsible for answering within the DPDP Rules’ time limit of 90 days. Medhank will help it do so, and will pass on any request it receives directly rather than answering it itself.

8. Retention, return and deletion

1. Identity photos, the details read from ID cards, and captures taken at a warning are deleted automatically 21 days after they are taken.
2. Other data is kept for as long as the organization keeps it in Medhank.
3. When the organization closes its account, it can export its results first. Medhank then deletes its data, including backups, within 90 days, except where the law requires something to be kept, which it will tell the organization about.

9. Where data is processed

Medhank’s servers are hosted by Contabo GmbH in Europe (European Union), so the organization’s data is processed outside India. Where a sub-processor processes data outside India, the sub-processors page says where. Medhank will not transfer data to a country the Government of India has restricted.

10. Audit

On reasonable notice, Medhank will give the organization the information it needs to show that this agreement is being kept, and answer its reasonable security questionnaires.

11. Contact

Questions about this agreement, or to request a countersigned copy: [email protected].