Verixa — India Pilot Launch Playbook

Owner Seat: Vimal — Founder, Chairman & MD, Aeonn Ark Group · Date: 2026-04-25

Pilot market: India only Launching entity: NOT Verixa Inc (USA) Regulatory perimeters: US FDA + India — NO EU

Founder Advisor verdict on scope reduction: PASS. India-only pilot with no EU exposure is CEG-positive (capital exposure capped; no EU AI Act / Annex 22 / GDPR work-stream cost) and Revenue-Orientation-positive (closeable beats complete; Indian sponsor pipeline is the fastest demonstrable path to first paid revenue).

Rationale: Indian customer base, but product must support US FDA-compliant workflows — many Indian sponsors manufacture/clinical-test for US export, and Verixa as their vendor system is downstream-inspected by FDA via the customer. Companion docs Verixa_Commercial_Launch_Readiness_2026-04-25 and Verixa_Parallel_Workstreams_While_Engineering_2026-04-25 retain validity for future S2/S3 multi-jurisdiction expansion; this playbook is the active plan.

0. The One Founder Decision That Unblocks Everything (F0)

Before any contract, billing, tax, or IP-licensing line item can move, lock which Indian entity launches Verixa as a SaaS service:

Option	Launching Entity	Pros	Cons	Recommendation
A	Aeonn Health Pvt Ltd (existing)	Zero new incorporation; matches doctrine path "Verixa lives in Aeonn Health → Navira → Verixa"; uses existing GST / PAN / banking	Co-mingles Verixa P&L with broader Aeonn Health verticals; harder unit economics; future carve-out friction	Default if speed matters
B	Navira Healthcare Pvt Ltd (Unknown — confirmation required whether Navira is a separate Indian entity or only a brand)	Cleaner P&L; stronger brand alignment; pre-positions for spin-out	+30–45 days incorporation if not existing; new GST/PAN/banking	Recommended if Navira-India is already incorporated
C	New Verixa India Pvt Ltd (incorporate fresh)	Cleanest carve-out; investor-friendly; mirrors Verixa Inc structure	45–60 days incorporation + onboarding; new tax registrations + bank account; fresh inter-co agreements	Recommended if optionality for outside capital dominates

Companion lock — IP licensing chain (services-boundary mandate): if Verixa IP sits with Verixa Inc (US) or Aeonn Ark Pvt Ltd, the Indian launching entity needs an inbound IP license + services agreement priced at arm's length (transfer-pricing safe). CFO + CLO to draft within 30 days of F0 lock.

1. What Drops From the Plan (EU Exclusion)

Item Removed	Reason
GDPR Art. 28 DPA + RoPA EU lens + EU SCCs (Modules 2 & 3)	No EU customers
UK GDPR addendum + UK ICO + UK Representative	No UK customers
EU Representative (Art. 27 GDPR)	No EU establishment needed
EU GMP Annex 11 attestation (still mapped in product; no certification push)	India + US FDA cover same control surface
EU GMP Annex 22 (AI/ML) conformity	Not in scope
EU AI Act risk classification + conformity assessment	Not in scope
EMA / MHRA inspection readiness pack	Not in scope
EU residency hosting region	Not in scope
ISO 13485 (medical device QMS)	Optional anyway; defer
ISO/IEC 42001 (AI MS)	Defer to S2 (US enterprise & EU re-entry)
Trade-shows: ISPE Annual EU, PDA EU, CPHI Worldwide	Defer; replace with India equivalents
Trademark filings: EU + UK + Madrid	Defer; file India + US first

Estimated savings: ~30% of prior parallel-track effort and ~40% of the certification cost line.

2. What Survives & Gets India-First Flavor

Track	Why Still Required	India-First Adjustment
US FDA 21 CFR Part 11	Indian sponsors with US-bound batches/clinical data are FDA-inspected; Verixa must support	KEEP full Part 11 controls; produce Part 11 Compliance Statement
US FDA Computer Software Assurance (CSA)	Same logic	KEEP alignment statement
GAMP 5 Category 5	Universal validation framework; Indian sponsors expect it	KEEP
ICH Q9 / Q10	Universal	KEEP
CDSCO + Schedule M v2024	Primary regulatory perimeter for India pharma	PRIMARY TRACK — VX-CDSCO-001 becomes the marquee artifact
DPDPA 2023	Primary privacy framework for India	PRIMARY TRACK — replaces GDPR-first lens
HIPAA BAA-readiness	No US customers in pilot	DEFER to S2
SOC 2 Type II	US enterprise demand driver	DEFER to S2; consider SOC 2 Type I as cheaper interim if an Indian buyer asks
ISO 27001	Indian enterprise procurement gate	KEEP — Indian-affiliated TIC body (BSI India / TÜV India / DNV / Bureau Veritas India / Intertek India)
ISO 9001:2015	Indian enterprise procurement gate	KEEP
CERT-In	India sectoral cyber-incident reporting (6-hour rule)	NEW TRACK — must add
MeitY / Cloud / Data localization	India regulatory expectation (likely sectoral)	NEW TRACK — must add

3. Indian Regulatory & Compliance Stack — Full List

#	Item	Lead Time	Owner	Notes
IN-1	VX-CDSCO-001 — India pharma compliance bundle	10 days	CHO + CLO	Marquee artifact; flagged 10-day blocker for Indian sponsor onboarding
IN-2	Schedule M v2024 alignment evidence	14 days	CHO + CQCO	Map URS-001…035 controls to Schedule M Annexure I
IN-3	CDSCO eSubmission readiness (e-Office, SUGAM, CDSCO Online)	30 days	CHO + CTO	Where Verixa exports records to CDSCO portals
IN-4	DPDPA 2023 §11 controls (consent, notice, processing principles)	30 days	CLO + CISO	EXEC_SUMMARY flagged 10% framework coverage; close to 100%
IN-5	DPDPA 2023 §16 controls (data principal rights workflow)	30 days	CLO + CCO	Was PARTIAL per EXEC_SUMMARY
IN-6	DPDPA Significant Data Fiduciary (SDF) self-classification	14 days	CLO + CISO	If SDF: heavier obligations incl. DPO + DPIA + audit
IN-7	DPO appointment (India)	30 days	CPO + CLO	Likely required even pre-SDF
IN-8	CERT-In incident reporting integration	21 days	CISO + CTO	6-hour reporting rule; build into IRP
IN-9	MeitY data-localization assessment + sectoral hosting in India	21 days	CISO + CTO	Pick India CSP region (AWS Mumbai/Hyderabad, Azure India, GCP Mumbai/Delhi, or Indian sovereign cloud)
IN-10	GST registration (state-wise + IGST for inter-state SaaS billing)	14 days	CFO	Depends on F0 entity lock
IN-11	Equalization Levy / Section 194-O assessment	14 days	CFO + CLO	If billing flows from Indian entity to international IP holder
IN-12	Indian withholding-tax + transfer-pricing position on intercompany IP/services flows	21 days	CFO + CLO	Critical given F0 entity choice
IN-13	Trademark — Verixa™ India (all relevant classes)	30–60 days to file; 12–18 months to register	CLO	Class 9 + Class 42 minimum
IN-14	Domain portfolio — .in, .co.in, .health.in	7 days	CMO	Add to existing portfolio
IN-15	FEMA position on receipts in INR vs USD billing	14 days	CFO + CLO	Indian entity → Indian customers: INR-only is cleanest
IN-16	MSA (India law-governed) + DPA (DPDPA-aligned) + SLA (INR credit)	30 days	CLO	India-only versions
IN-17	Indian counsel of record (corporate, IP, pharma-regulatory, privacy)	14 days	CLO + Founder	Approve panel
IN-18	Cyber insurance — India market	30–60 days	CFO + CISO	Indian broker; INR tower; CFO sets size
IN-19	Indian Pharmacopoeia (IP) + WHO-GMP cross-references	21 days	CHO	Buyer-facing one-pager
IN-20	Drugs and Cosmetics Act + Rules alignment statement	14 days	CLO + CHO	—

4. US-FDA Boundary Items (kept for Indian-customer use)

#	Item	Lead Time	Owner	Notes
FDA-1	21 CFR Part 11 Compliance Statement + e-sig validation evidence	21 days	CQCO	Bundle into Customer Audit Pack
FDA-2	CSA (Sept-2022 draft guidance) alignment statement	14 days	CQCO + CTO	Sponsor-facing one-pager
FDA-3	GAMP 5 Cat 5 declaration	14 days	CQCO	Already implied in VX-SDLC-002
FDA-4	ICH Q9 risk-management evidence + Q10 PQS alignment	21 days	CQCO	—
FDA-5	FDA inspection-readiness playbook for Indian sponsors	21 days	CHO + CQCO	Indian sponsor's FDA inspector may inspect Verixa as the QMS vendor
FDA-6	MIRA AI v1 in advisory mode + GMLP / SaMD applicability scan	21 days	AI Gov Lead + CQCO	Avoids 483 risk
FDA-7	Audit trail FDA-export format (XML/CSV per Part 11 expectation)	14 days	CTO + CQCO	Customer-facing feature
FDA-8	HIPAA BAA template	DEFER to S2	CLO	Not needed for India pilot
FDA-9	SOC 2 Type II	DEFER to S2	CISO	Type I optional interim

5. Re-Scoped Talent Plan (India Launch)

#	Role	Why Critical	Lead Time	Founder Ask
TA-1	Head of QA (India)	Sponsor audit will request CV; QMS owner	60–120 days	Approve req
TA-2	AI Governance Lead	Annex 22 + FDA GMLP awareness even for India sponsors	60–90 days	Approve req
TA-3	DPO (India)	DPDPA likely mandatory post-SDF assessment	30–60 days	Approve req
TA-4	Validation Lead	IQ/OQ/PQ + VMP ownership	60–90 days	Approve req
TA-5	InfoSec Officer (India)	ISO 27001 + CERT-In ownership	60–90 days	Approve req
TA-6	Customer Success / Implementation Lead (India)	Onboarding + validation services	60–90 days	Approve req
TA-7	Sales Engineer — pharma regulated (India)	Pre-sales + demo + validation conversations	60–90 days	Approve req
TA-8	External advisors (India) — CDSCO consultant, FDA-regulated counsel (India practice), DPDPA counsel, intercompany tax counsel	Advisory panel	30 days	Approve panel
~~DPO EU — not needed~~ · ~~UK Representative — not needed~~ · ~~EU Representative — not needed~~

6. Re-Scoped GTM Plan (India)

#	Item	Lead Time	Owner	Notes
GTM-1	Pricing in INR — tiered (per user / site / study / workflow) + implementation services	21 days	CSO + CFO	Optional USD billing for Indian customers exporting to US
GTM-2	Capabilities deck — India sponsor variant	30 days	CMO + CHO + CSO	Lead with CDSCO + Schedule M; secondary US FDA Part 11
GTM-3	Battlecards — India market	21 days	CMO + CSO	AmpleLogic, Trackwise (Sparta India), MasterControl India, Veeva Vault India, Caliber, Qualityze, ComplianceQuest, ZenQMS, Indian-built systems
GTM-4	Trade body memberships	14 days	CMO	OPPI, IPA, IDMA, BDMA, ISPE-India, PDA-India, DIA-India, NASSCOM Pharma SIG
GTM-5	Trade-shows — India calendar	30 days	CMO + CSO	Pharma Pro&Pack, India Pharma Expo, CPHI India, P-MEC India, ISPE-India Annual, PDA-India Annual, BioAsia
GTM-6	Analyst briefings — India-aware	30–60 days	CMO	Gartner India, IDC India, ISG India; Indian pharma analyst desks
GTM-7	Partner / SI ecosystem (India)	60 days	CSO + CCO	TCS Pharma, Infosys Life Sciences, Tata Elxsi, Wipro Pharma, Cognizant LSx, HCL Tech, Mu Sigma; Big4 India life-sciences; specialist boutiques
GTM-8	Website (verixa.in / verixa.co.in / verixa.health) v1.0 — India-first IA	45 days	CMO + CTO	Approve domain choice
GTM-9	Demo environment storyline — Indian sponsor with US-export workflow	30 days	CMO + CCO	Approve script
GTM-10	Reference customer programme — Indian design partners	60–90 days	CSO + CCO + Founder	Lock 3 names
GTM-11	Indian press launch + thought leadership (BioSpectrum India / Express Pharma / Pharmabiz)	30 days	CMO	Approve
GTM-12	Webinar series — India	Continuous	CMO + CHO	Approve themes

7. Indian Design Partner Anchor Profile

Highest-leverage Indian design partners for the pilot (Founder to lock 3 names — flagged by Founder Advisor as the single highest-leverage decision for the launch window):

Mid-tier Indian formulator with US-export footprint (≥1 USFDA-inspected site) — already pays validation overhead; Part 11 + Schedule M dual-frame solves real pain.
Indian biotech / clinical-stage company with active US IND/NDA path — GCP + Part 11 use case.
Indian CRO with multi-sponsor footprint — multi-tenant + Context Gate + RBAC sells naturally.
Indian generic manufacturer with Schedule M v2024 obligation pressure — CDSCO + Schedule M control mapping is the wedge.

8. Re-Scoped 90-Day Plan (India Pilot)

Days 0–14 — Founder Lock Week

F0: Lock launching Indian entity (A / B / C). Everything downstream depends on this.
Lock 3 design partners (named).
Lock pilot pricing (INR).
Lock MIRA v1 = advisory only.
Lock canonical doc set (35 URS v2.0 vs 36 SDLC v4.0 vs 54 quality PDF).
Resolve VX-VP-004 tech-stack contradiction (pure doc fix).
Authorize VX-CDSCO-001 creation (10-day artifact).
Engage Indian counsel panel (corporate, IP, pharma-regulatory, privacy).
Open 7 senior India hires (TA-1 through TA-7).
Bind cyber insurance market sounding (India broker).
Engage ISO 27001 + ISO 9001 cert bodies (India-affiliated).

Days 14–45 — India Drafting Sprint

VX-CDSCO-001 delivered (Day 24).
Quality Manual + 7 policies signed.
15 SOPs drafted; 8 signed by Day 45.
DPDPA §11 + §16 controls documented; SDF assessment complete; DPO India appointed.
VMP + VP + IQ/OQ/PQ templates drafted.
MSA + DPA + SLA + AUP drafted (India law).
RoPA + Data Map (India lens).
Capabilities deck v1.0 (Indian sponsor variant) + Battlecards (India set).
Pricing locked in INR.
F0 entity → GST/PAN/banking onboarding initiated (or confirmed if Aeonn Health Pvt Ltd).
Inter-co IP-license + services agreement drafted.
Trademark Verixa™ India filed; domain portfolio India-first secured.
ISO 27001 gap assessment underway.

Days 45–75 — India Evidence Sprint

Cyber insurance bound (INR tower).
ISO 27001 remediation in flight.
Schedule M v2024 alignment evidence complete.
CDSCO eSubmission integration plan.
CERT-In integration into IRP complete.
MeitY data-localization decision; CSP region locked.
Customer Audit Pack skeleton (India lens) complete; Validation Bridge Document template.
Vendor questionnaire response library — Indian-sponsor templates.
AI governance pack: Annex 22 SOP kept as internal control (future-proof, global best practice).
Per-regulator one-pagers — FDA + CDSCO only.
Trade body memberships activated; analyst briefings booked (India desks).
Indian SI partner LOIs (1–2).
4 of 7 senior hires offered; 2 closed.
Demo environment storyline locked.

Days 75–90 — Mock Audit + Pilot Readiness

Mock sponsor audit (CDSCO + FDA-style) — internal first, then mock-external.
Pen test executed; executive summary in Audit Pack.
21 CFR Part 11 Compliance Statement signed; Schedule M alignment statement signed; DPDPA compliance statement signed.
Customer Audit Pack release-candidate.
Stage-1 demo environment live (anonymized data).
First two design-partner conversations active (LOI / paid POC structure).
Founder Advisor pre-launch gate review.
Stage-1 pilot launch authorization.

Day-90 Founder Gate: F0 closed · ≥2 design partners in active engagement · mock audit pass · Head of QA + DPO India onboarded · SDF status decided · ISO 27001 stage-2 audit scheduled · cyber insurance bound · canonical doc set declared and stable.

9. Top 12 to Start Monday (India-Pilot Edition)

F0 — Founder lock launching Indian entity (Aeonn Health vs Navira-India vs new Verixa India Pvt Ltd).
VX-CDSCO-001 authorization — 10-day artifact, marquee India regulatory bundle.
3 design partners locked (named, written commitment in flight).
DPDPA SDF self-classification — drives DPO + DPIA + audit obligations.
ISO 27001 + ISO 9001 cert body engagement (India-affiliated TIC).
Cyber insurance — India market sounding (broker engaged).
Indian counsel panel locked (corporate, IP, pharma-regulatory, privacy, tax).
Open 7 senior India reqs (Head of QA, AI Gov Lead, DPO, Validation Lead, InfoSec Officer, CS Lead, Sales Engineer).
Lock pricing in INR + tiered model + implementation services.
Trademark Verixa™ India filed + domain portfolio locked (.in / .co.in / .health.in).
Resolve VX-VP-004 tech-stack contradiction + declare canonical doc set.
Quality Manual + 15 SOPs drafting kickoff — assign owners; first 3 signed in Days 0–14.

10. Risks Specific to India-Pilot Scope

F0 entity ambiguity — every contract, billing, GST, intercompany flow stalls until locked.
DPDPA SDF classification — if SDF, obligations cascade (DPO + DPIA + algorithmic-audit), shifting timelines.
CSP / data-localization rules — sectoral guidance for pharma-regulated SaaS in India still emerging; CSP region choice must be defensible against likely 12–18-month tightening.
Indian trademark squat risk — file Verixa™ India fast.
Schedule M v2024 transitional deadlines — Indian sponsors are under pressure; pricing too high prices Verixa out; too low signals immaturity.
CERT-In 6-hour reporting rule — most SaaS vendors miss this; build IRP to comply day-one.
Inter-co IP / services flow with Verixa Inc + Aeonn Ark — transfer-pricing risk if not arm's length.
No EU now ≠ no EU forever — keep architecture EU-capable so S2/S3 doesn't require rebuild; just don't certify or contract there yet.
MIRA v1 scope creep — if any India sponsor demands it bind GxP records, hold the line: advisory-only.
Sponsor-audit credentials — Head of QA's CV will be requested; do not pilot with the seat empty.

11. Founder Decisions (India-Pilot)

#	Decision	Default if No Decision
F0	Launching Indian entity (Aeonn Health Pvt Ltd / Navira-India / new Verixa India Pvt Ltd)	Recommend Aeonn Health Pvt Ltd if speed dominates; new Verixa India Pvt Ltd if optionality dominates
F1	Confirm "no EU" lock	Locked per this brief
F2	Confirm "USFDA boundary preserved for Indian-customer use" interpretation	Locked per this brief
F3	Approve VX-CDSCO-001 creation	Recommend approve
F4	Lock MIRA v1 = advisory-only	Recommend approve
F5	Lock 3 design partners (named)	Unknown — Founder + CSO
F6	Approve cyber insurance INR tower	Unknown — Founder + CFO
F7	Approve ISO 27001 + ISO 9001 cert body	Unknown — Founder + CISO + CQCO
F8	Lock pricing tiers + INR pricing axes	Unknown — Founder + CFO + CSO
F9	Approve 7 India senior hires (req open)	Recommend approve
F10	Lock Indian counsel panel	Unknown — Founder + CLO
F11	Lock CSP region (AWS Mumbai/Hyderabad / Azure India / GCP / Indian sovereign)	Unknown — Founder + CTO + CISO
F12	Confirm Verixa Inc TN relocation closure timing (non-blocking for India pilot; needed for S2 US launch)	In progress — confirmation required
F13	Approve Aeonn Ark ↔ Indian launching entity ↔ Verixa Inc IP-licensing + services-boundary mapping	Unknown — Founder + CLO + CFO

12. Doctrine Compliance

Phase 0 LOCK: India-only pilot, US FDA + India regulatory perimeters, no EU, NOT Verixa Inc — confirmed.
Phase 1–4: Multi-domain panel (CHO + CQCO + CISO + CTO + CLO + CFO + CMO + CSO + CCO + CPO + CEO Navira/Verixa). No domain >40%. CDSCO/Schedule M weighting raised; EU weighting zeroed.
Phase 5A (Chiefs): CHO primary; CQCO + CISO + CLO + CFO + CSO + CMO + CCO secondary.
Phase 5B: CEO Navira/Verixa staged approval pending F0 lock.
Founder Advisor filter: CEG POSITIVE · Revenue Orientation POSITIVE · Red-Team captured (top 10 risks) · ICRT thresholds preserved via 90-day stop-loss + Day-90 Founder gate · Services-Boundary flagged at F13.
ALCOA+ pre-delivery: every claim sourced or marked with a fail-safe phrase.
Document Stability: companion docs retained for S2/S3 future use; this playbook supersedes them for active pilot work.