Security
How Panch Care protects clinic and patient data
A plain account of the safeguards in place today — and of what we don't claim yet.
Encryption in transit
Connections to Panch Care use HTTPS. In production the app tells browsers to use HTTPS only (HSTS), and session cookies are secure, HTTP-only and encrypted.
Sensitive fields encrypted at rest
The most sensitive fields — patient contact details, date of birth, address and medical history, ABHA numbers, two-factor secrets and enquiry details — are encrypted in the database.
Clinic-by-clinic isolation
Every clinic's data is separated in the database itself using row-level security, so one clinic's account cannot read another's records even if application code makes a mistake.
Role-based access and two-factor sign-in
Each login sees only what its role needs. Two-factor authentication is required for clinical roles and available to everyone else.
Tamper-resistant audit trail
Changes to records, and access to patient records, are written to append-only audit logs that the application cannot edit or delete.
Sign-in protection
Repeated failed sign-ins are slowed down and recorded, and idle sessions sign out automatically.
Support access is controlled
When our team needs to work inside a clinic's account to provide support, they sign in as one of its users, for a stated reason and a limited time. Every such session is recorded in both the clinic's audit trail and ours.
If something goes wrong
We have a documented process for handling a personal data breach: contain it, find out which clinics and people are affected, and notify the affected clinics and the Data Protection Board of India as the DPDP Rules require.
Report a vulnerability
If you believe you've found a security issue in Panch Care, email support@panchcare.com with the details and steps to reproduce it. Please don't access other people's data or disrupt the service while testing; we'll acknowledge your report and keep you updated.
What we don't claim yet
Panch Care has not yet completed a third-party security certification such as ISO 27001 or SOC 2, and ABHA/ABDM integration is not live yet. We'll update this page when either changes. If a specific requirement is a blocker for your clinic or hospital, tell us.