Security
How Clinic OS protects your clinic’s patient data
Each clinic’s patient records live in a private workspace that only its own authorised staff can open. Access is role-based and logged, data is encrypted in transit, and OrvexaTech’s own operations never work with patient content.
A private workspace for each clinic
Every clinic gets its own Clinic OS workspace. Patient records stay inside it and are never mixed with another clinic’s data.
Role-based access
Clinic staff see only what their role needs. Access is purpose-limited and sensitive actions are recorded in an audit log.
OrvexaTech sees counts, not content
Our own team only sees anonymous counts. We never see patient names, notes or diagnoses.
Encryption
Data is encrypted when it is sent and when it is stored.
Security controls in place
- Tenant isolation between clinics
- Role-based access for clinic staff
- Audit logging of sensitive actions
- Secure authentication
- Data encrypted when sent and when stored
- Rate limiting and abuse protection
- Private storage for files that clinics upload
- Security testing and monitoring
If something goes wrong
If there is a security incident, we stop it spreading, keep the evidence and check what was affected. Then we fix the cause, write it up and send any notice the law requires.
Standards we measure against
Clinic OS is built around India’s Digital Personal Data Protection (DPDP) Act. We use GDPR and the principles of ISO/IEC 27001 and 27701 as benchmarks for privacy and security practice. These benchmarks don’t replace Indian law or a clinic’s own legal obligations, and they are not certifications.
Patient rights requests
Patients ask the clinic that treated them to see, correct or delete their records, or to make a complaint. The clinic controls its own records, so it handles these requests. Read the full patient privacy policy.
Ready to run your clinic on Clinic OS?
Apply with your clinic details. We review every application, then set up your private workspace.