01
Stored in India
Patient records are stored in Mumbai. They are not stored outside India.
Data safety
Your patients’ records, kept the way they should be.
No badges here. This page says what HealthRich actually does with your clinic’s data today, where it is kept, who can see it, and what we have not done yet.
- Stored in India, Mumbai region
- Each clinic sealed off
- Every change recorded
- No patient data to outside AI
Data safety
Patient records belong to your clinic.We keep them that way.
Clear safeguards. Defined access.
A record of what changes.
02
Each clinic, separate
Your clinic can access only its own records.
03
Access by role
Choose what each member of staff can see.
- Doctor
- Reception
- Admin
04
Every change, recorded
A clear audit history, for the clinic’s admins only.
- 9 Oct · 10:24 amPrescription updated
- 9 Oct · 9:12 amVisit note added
- 8 Oct · 4:36 pmPayment marked as received
05
Consent on record
Patient consent and WhatsApp opt-in, recorded separately.
- Patient consent
- WhatsApp opt-in
06
Phones lock themselves
A PIN after 10 minutes away; shared phones sign out after 5.
In detail
What each safeguard means in practice.
- Stored in IndiaYour records live in a database in Mumbai (AWS ap-south-1, run by Supabase). They do not leave India to be stored.
- Each clinic sealed offEvery record carries the clinic it belongs to, and the database itself refuses to show one clinic’s rows to another (row-level security). Each branch is its own clinic.
- Roles decide who sees whatAdmin, senior doctor, doctor, assistant doctor and receptionist, plus roles you define, such as a pharmacist who works only the counter. Reports are for admins and senior doctors.
- Every change is recordedChanges to patients, visits, prescriptions, bills and payments go into an audit log with the before and after, readable only by the clinic’s admins.
- Consent on recordConsent is taken when a patient is added, WhatsApp opt-in is asked separately, and a patient who replies STOP is opted out. Each change is kept as a dated record, for your DPDP Act paperwork.
- Phones lock themselvesOn a doctor’s own phone the app asks for a PIN after 10 minutes away; a shared clinic phone signs out after 5 idle minutes. Patient records are never cached on the phone; a half-written Rx is held only until the app is closed.
- EncryptedEncrypted in transit (HTTPS) and at rest by our hosting provider. Your own WhatsApp and SMS keys are encrypted again by us and can’t be read back, even by your admins.
- Backed up every dayThe whole database is backed up every night and the last 7 nights are kept, in Mumbai like the records themselves.
Who handles your data
The services behind HealthRich.
The clinic is the owner of its patients’ data; HealthRich processes it for the clinic. These services do part of the work, each seeing only what it needs.
- Supabase (on AWS, Mumbai)The database, sign-in and file storage: every clinic record.
- VercelServes the app’s web pages. Patient records are not stored there.
- Meta (WhatsApp Business Platform)Delivers WhatsApp messages: the patient’s phone number and the message.
- MSG91Delivers SMS: the phone number and the message.
- ResendDelivers email: the email address and the message.
- RazorpayPayment links, where a clinic uses them: the amount and the payer’s contact.
- Cloudflare Turnstile (when enabled)Public forms such as the demo request and online booking are limited on our server per IP address and per phone number. Turnstile adds a bot check on top — always for online booking, and for the demo form once it is switched on.
AI and your patients
No patient data goes to an outside AI.
HealthRich’s AI tools run on your clinic’s data inside HealthRich. The optional patient brief is built in the browser. No patient record is sent to OpenAI, Google or any other AI service.
Your data, your copy
Export when you want it.
Every report exports to Excel or CSV with every row, any time. For a complete copy of your records, ask us and we send it.
Being straight with you
What we have not done yet.
- No security certificate yet. HealthRich does not hold ISO 27001, SOC 2 or HIPAA certification today. We will show a certificate here only once it is issued.
- No ABDM / ABHA link yet. It is on our roadmap.
- No offline mode. HealthRich needs an internet connection; if it drops you can still see what was already on screen.
- No one-click “export everything” yet. Reports export themselves; a full export is done by us on request.
Found a security problem?
Write to us with the details. Please don’t test against a live clinic’s data.