Security
Nothing here is a badge we don't back up. If we haven't built it or been audited for it, it isn't listed.
Role-Based Access Control
Granular, per-role permissions across every module — front desk, doctor, pharmacy, and admin each see only what they need.
Full Audit Trail
Every sensitive action is logged, so any change to a patient record or setting can be traced back.
Multi-Tenant Data Isolation
Each medical center's data is scoped to its own tenant from the ground up — patients, staff, and records never cross tenant boundaries.
Additional practices
Encryption in transit
All traffic between the browser, the app, and the API runs over HTTPS/TLS.
PHI encrypted at rest
Sensitive patient fields (name, email, phone, and similar identifiers) are stored encrypted (AES-256-GCM) in the database, not as plain text.
Automated encrypted backups
Database backups run automatically to a versioned, encrypted storage bucket.
Designed with DPDP/HIPAA principles in mind
The platform's access-control, audit-logging, and tenant-isolation model was built around the principles those frameworks require — this is a design commitment, not a claim of certification.