So it is defended in five independent ways, and proven by tests that run on every single build rather than on request.
Any one of these could be bypassed by a mistake. All five is the point.
Which hospital a request belongs to comes from the web address and is confirmed against the signed-in session. A hospital identifier sent by the browser is ignored outright.
Every query, update, delete and aggregation has the hospital filter injected automatically. A query that somehow arrives without one throws an error rather than returning unfiltered data.
Data models are unreachable from ordinary application code, and the one function that can disable scoping is restricted to a short, reviewed list of files. Anything else fails the build.
A generated suite tries, for every record type, to read, change, delete, count, aggregate and smuggle data across hospitals. It runs on every build, and adding a new record type without registering it fails.
If a scope violation ever occurs at runtime, it raises a high-severity alert immediately rather than appearing in a log nobody reads.
Our own staff have no standing access to your records. Support access is a time-boxed grant with a written reason, visible in your security log, and every action during it records both who acted and as whom.
Hashed with Argon2id. Hospital accounts need at least 8 characters and may include the person’s name. Platform accounts need 12 characters and must not contain the person’s name, email or phone. No forced monthly rotation — it produces Password1 then Password2.
Mandatory for platform staff, hospital administrators, and any role that can approve a report, cancel an invoice, issue a refund or delete a user.
Sessions are stored server-side and revocable. When a laptop is lost, signing out every device takes effect in about a second, not whenever a token happens to expire.
Eight ordered checks run on every operation — session, surface, hospital status, module, usage limit, role, branch and record relationship. A build-time check refuses any endpoint that skips them.
Failed sign-ins back off exponentially and then lock, per account and per network. An unknown email and a wrong password are indistinguishable, in message and in timing.
Record access under a broad view permission is audited with the user, the patient and the reason category — so the question can actually be answered.
Documents, images and procedure video live in private storage. Access is a short-lived signed link issued only after re-checking that this user may see this patient’s record.
Encrypted in transit with modern TLS, and at rest in the database and object storage. Identifiers such as Aadhaar or ABHA numbers carry additional field-level encryption.
Passwords, session tokens, one-time codes, recovery codes, API keys, payment details, and free-text clinical notes. A redaction layer enforces this by field name and by pattern, and a test proves it.
File type is verified from the file’s own contents, not its name. Uploads are scanned before they become visible, and executables, archives and script-bearing formats are refused.
Continuous backup with point-in-time recovery, rehearsed quarterly into an isolated environment. A backup nobody has restored is a hypothesis.
Full machine-readable export, available to your administrators at any time, including after you cancel.
The platform is designed against Indian requirements — the Digital Personal Data Protection Act 2023, the Electronic Health Record standards and the Information Technology Rules — with consent capture, purpose limitation, correction through versioned amendments, and erasure bounded by the statutory minimum retention for medical records. Controls are kept compatible with HIPAA-style requirements so the platform can follow a customer abroad. We will not claim a certification we do not hold; ask us directly on the contact page and we will tell you exactly where we stand.