Patient data, protected by design.

Patient PII and all clinical notes, diagnoses, prescriptions and vitals are encrypted field-by-field with AES-256-GCM before they touch the database. A leaked database is ciphertext.

All traffic is served over TLS. HSTS, a strict Content-Security-Policy, X-Frame-Options and nosniff headers are set on every response.

Every clinical record carries a clinicId. Each query is scoped to the signed-in user's hospital: one clinic can never read or write another's data.

Six roles (super-admin, admin, reception, doctor, pharmacist, patient) with least-privilege server-side checks on every route, not just hidden UI.

Patients authenticate by OTP (hashed at rest, attempt-limited, 5-minute expiry). Staff use password login with bcrypt. JWT secrets are enforced to 32+ chars in production.

Per-IP and per-number rate limits on OTP, login, booking and payment endpoints; app-level throttles plus nginx edge limits documented for deployment.

Razorpay orders are verified with HMAC-SHA256 signature checks and webhook signature validation before any appointment is confirmed. No client-trusted payment state.

Clinical and platform state transitions (queue, MAR give/hold, lab critical-value read-back, dispense, tenant suspend) are recorded with actor and timestamp.

Public queue boards expose only token numbers and timings; patient WhatsApp numbers are masked in every staff-facing log and response.

Nightly encrypted database dumps with 14-day retention and off-box copy are documented; formal RPO/RTO targets and cross-region DR are on the roadmap.

Annual third-party penetration tests and a coordinated vulnerability-disclosure programme are planned as we scale.

Incident runbook and patient/authority notification path are defined in line with India's DPDP Act timelines.