Clinics on Cloud’s Health Kiosk offers a unique opportunity for CSR-driven companies to contribute to preventive healthcare

Two companies can buy identical equipment, install it in similar villages, and produce completely different outcomes three years later. One site is running 25 sessions a day with a trained operator and a working referral pathway. The other has a covered kiosk in a locked room, out of consumables since month nine, with nobody assigned to it.

Nothing in the procurement decision separated those two outcomes. Five operating decisions did: who the local partner is, where the unit sits, who runs it, how beneficiary consent and data are handled, and who pays for it after the launch budget closes.

This page is about those five decisions. If you are still deciding whether preventive screening is the right CSR intervention at all, that case is made in why preventive screening suits a CSR healthcare project. If you are designing baselines and metrics, that is how to design a CSR health programme and measure its impact.

For a community-facing CSR programme, almost always yes. For a programme confined to your own premises and workforce, often no.

The partner supplies three things a corporate CSR team usually cannot: standing community trust, day-to-day operational presence at the site, and an existing relationship with local health infrastructure. A kiosk installed by a company nobody in the village knows produces low footfall for the first six months, and sometimes permanently.

Assess a prospective implementing partner against seven questions:

• Do they already work in this specific location, or would this be a new geography for them too?
• Do they have a working relationship with the health facility that will receive your referrals?
• Can they employ and supervise the site operator, or are they expecting you to?
• Do they have a data-handling policy, and have they run a programme collecting personal health information before?
• What is their reporting cadence and format, and does it match what your CSR committee needs?
• What is their financial and governance position — registration, audited accounts, compliance status for receiving CSR funds?
• What happens to their involvement if your funding stops?

The seventh question is the one that changes the design. A partner who would continue running the site with other funding is a different proposition from one whose involvement ends with your cheque.

Set out responsibilities in a written agreement, not an MoU of intent. It should name the operator’s employer, the referral facility, the reporting schedule, the data-handling terms, the ownership of the asset, and the notice period.

A screening kiosk earns its cost through session volume, and session volume is almost entirely a function of siting. This is the highest-leverage decision in the whole programme and it is frequently made for the wrong reasons, such as where a photograph would look best.

Rank candidate sites against five criteria:

• Existing footfall. People must already come here for another reason. A primary health centre, a school, a factory gate, a panchayat office, a ration shop, a market building, a bus stand.
• A responsible custodian. Someone on site who opens the room, keeps the key and cares whether the machine works.
• Physical suitability. Covered, secure, powered, ventilated. The kiosk has a rugged metal enclosure and 3–4 days of battery backup, which handles outages, but it still needs shelter and security.
• Referral proximity. How far is the facility that will receive flagged cases, and can beneficiaries realistically get there?
• Community fit. Is the location one that women, older people and lower-income groups will actually enter? A site inside a private office compound often fails this test even when everything else is perfect.

Some CSR programmes cannot satisfy the footfall criterion because the target population is dispersed. In that case a fixed kiosk is the wrong instrument. A Box Clinic suits camps and outreach where no infrastructure exists, and a Mobile Medical Unit suits a multi-village circuit. Where the programme runs on a corporate campus and presentation matters, a Health Lounge is the configuration usually chosen.

Run a two-week footfall observation before finalising a site. It is cheap, and it prevents the most expensive mistake in the programme.

A Clinics On Cloud Health ATM requires no skilled clinical operator. A session is driven by a multilingual touchscreen with audio-visual voice guidance, and a beneficiary can complete a 10-minute screening unaided.

That is a statement about clinical skill, not about staffing. Sites with an assigned attendant consistently produce steadier throughput than unattended ones, particularly in the first months, because someone has to invite people in, reassure a first-time user, explain the report, handle the consent process, restock consumables and flag a fault.

Budget the role explicitly. It is typically a full-time or part-time non-clinical position, employed by the implementing partner or the host institution rather than by the company. Recruiting locally, and recruiting women for sites serving women, materially affects participation.

Training covers five areas:

• Operating the session flow and helping a nervous or first-time user through it.
• Explaining a colour-coded report without interpreting it clinically, and knowing the exact boundary of what they may say. This boundary must be written down and rehearsed.
• The referral protocol: which flags trigger which action, who to call, how to record whether the referral was completed.
• Consent and data handling, including how to explain it in the beneficiary’s language.
• Basic upkeep: consumable stock, cleaning, when to raise a service call.

Plan for turnover. Document the role so a replacement can be trained in days, not weeks, and hold a second trained person at the partner as cover.

This is the section CSR programmes handle worst, and the one that carries the most risk. You are collecting personal health information from people in an unequal power relationship with the funder, often in a language other than the one your policies are written in.

Six decisions must be made in writing before the first session:

What is collected. The specific parameters and identifiers. Collect the minimum the programme needs. Resist the temptation to gather extra fields because the system can.

How consent is obtained. In the beneficiary’s language, explained verbally as well as displayed, with a recorded consent decision. For minors in a school programme, through the institution and guardians, with the school’s policy documented.

Who can see individual records. The strong default is that the funding company sees aggregate and anonymised data only, and never individual beneficiary records. Say this in the agreement. A company reading its beneficiaries’ individual health results is a governance problem regardless of intent, and it is especially serious where beneficiaries are also workers.

Who is the data controller. Usually the implementing partner or the host health facility, not the funder. Decide it explicitly with your legal advisors rather than by default.

Retention and deletion. How long records are held, what happens at programme end, and whether the beneficiary can request deletion.

Beneficiary access. Reports reach the beneficiary directly by print, SMS, email or WhatsApp, which means the person owns a copy of their own result. Where beneficiaries have or can obtain an ABHA account under the Ayushman Bharat Digital Mission, records can flow into their own longitudinal health record.

On the platform side, Clinics On Cloud is ISO 27001 certified, HIPAA compliant, GDPR compliant and VAPT tested. Those certifications describe how the system protects data. They do not decide your programme’s consent model, your controller designation or your retention policy, and they do not substitute for legal advice. India’s data protection framework, including the Digital Personal Data Protection Act, applies to processing of personal data, and how it applies to your specific programme is a question for your own counsel.

Four models are common. They differ mainly in who owns the asset and who is exposed when the funding cycle turns.

Two notes apply to every row. First, ownership of assets created through CSR spending has specific treatment under the CSR rules made under the Companies Act 2013, so the choice is a compliance decision as much as an operational one. Confirm it with your own legal counsel and CSR advisors. Second, whichever model you choose, write down who funds consumables, the operator and service in each year, because a model that names an owner but not a payer is not a funded model.

Here is the question that decides whether year three looks like year one: who pays for consumables, service and calibration when the launch budget is closed?

Three recurring cost lines exist and all three are predictable:

• Consumables. The rapid infectious disease and urine analysis modules consume test stock in direct proportion to session volume. This is not a fixed annual allowance; it scales with success. A programme that screens more people spends more on consumables, which is the correct behaviour and should be budgeted as a per-session cost.
• Service, calibration and spares. Device accuracy of 90–95% depends on correct usage, calibration and patient preparation. Calibration is not optional maintenance; it is what keeps the readings worth acting on. An annual maintenance contract typically covers preventive visits, calibration, breakdown response and defined spares, and the scope should be read carefully rather than assumed.
• The operator’s salary. Covered above, and the most common single omission.

Ask three questions of your own programme before signing:

• If the CSR budget is reallocated next year, who keeps this site running, and from what money?
• Is the AMC funded from the same annual cycle as the capital purchase, or committed multi-year?
• Who holds the service relationship — you, the partner, or the host institution — and does that entity have the authority to raise a service call?

Programmes that answer these three continue. Programmes that fund the machine and assume the rest is where abandoned kiosks come from. Indicative Health ATM pricing starts from ₹6,00,000, and the recurring lines above will, over five years, be a material share of total programme cost. Model them from the start.

• Weeks 1–2. Define the beneficiary population and the change you intend. Shortlist implementing partners.
• Weeks 2–4. Partner due diligence against the seven questions. Draft the responsibility agreement.
• Weeks 3–5. Site shortlist and two-week footfall observation. Confirm power, security and shelter.
• Week 4. Approach the referral facility and obtain written agreement to receive referrals.
• Weeks 4–6. Configure the specialty panel against the population’s needs and confirm language sets. See clinical parameters and tests offered by a health kiosk.
• Weeks 5–7. Draft the consent model, data-handling terms and controller designation with legal counsel. Translate the consent script.
• Weeks 6–8. Recruit the operator and the cover person. Agree who employs them.
• Weeks 7–9. Record the baseline in the target population before the kiosk goes live.
• Weeks 8–10. Installation, operator training, referral protocol rehearsal, consumable stock delivery.
• Weeks 10–12. Soft launch with community mobilisation through the partner. Review session volumes weekly and correct siting problems early.
• Week 12. First reporting pack to the CSR committee, including asset utilisation and referral completion, not only session counts.

Beyond price and delivery, insist on clarity on these points:

• Specialty configuration and language sets, listed explicitly.
• What is included in installation and commissioning, and what is billed separately.
• Operator training: how many people, how long, whether refresher training is included, and whether training materials are provided in the local language.
• AMC scope: preventive visit frequency, calibration, response time commitment, which spares are covered, and what is excluded.
• Consumables: unit costs, lead times, minimum order quantities and shelf life.
• Data: export formats, audit trail, the dashboard views your reporting needs, and confirmation that the funder receives aggregate data rather than individual beneficiary records.
• Uptime and escalation: who to call, in what hours, and what happens if a unit is down for an extended period.
• End of programme: what happens to the data and to the asset.

Clinics On Cloud is India’s first CDSCO-licensed Health ATM and Health Kiosk manufacturer, manufacturing at Chakan MIDC, Pune, with 12M+ patients screened across its network, 2 lakh+ (200,000+) abnormalities detected for early intervention, and deployment in 8+ countries. Named deployments include the Indian Army, NHM Uttar Pradesh, AIIMS Rishikesh, Tata Power, Godrej and Reliance. Manufacturer background is in Clinics On Cloud as a Health ATM manufacturer.

To scope a programme, write to sales@clinicsoncloud.com or call +91 8999 073 447 (Mon–Sat, 9:00–18:00 IST). Bring your beneficiary population, your candidate sites and their footfall, the referral facility you intend to use, and your five-year budget envelope. Specifications are on the Health Kiosk page.

Note on legal position: CSR obligations for qualifying Indian companies arise under the Companies Act 2013, with permitted activity categories set out in Schedule VII, and assets created through CSR spending have specific treatment under the associated rules. This page describes the framework in general terms only and does not give legal advice. Confirm eligibility, asset ownership treatment, data-controller designation and reporting obligations with your own legal counsel and CSR advisors.

Clinics On Cloud provides preventive health screening and is not a diagnostic laboratory. Screening results are indicative and are not a diagnosis. Always consult a qualified physician before acting on any health information.