Security & compliance

Your patients’ records, handled like they matter.

Praclyn holds clinical data for Indian clinics, which makes the DPDP Act and the clinical establishment rules our design constraints rather than a checklist we fill in afterwards. Here is what that actually means.

One clinic cannot see another

Tenant isolation is enforced where the queries are made, not by a filter each developer has to remember.

Every tenant-owned table is reached through a scoped client that physically cannot return another clinic’s rows.
The two places that client cannot reach — raw SQL and the bare client — are checked by a test that reads the source and fails the build.
Praclyn’s own console runs on a separate identity with its own token audience, not an elevated role on a clinic user.

An audit trail you can read

Who did what, when, and from where — recorded for every mutation, and never sold as a premium feature.

Successful changes are logged in front of the router, so a module that forgets to write its own entry is still covered.
Invoice voids, discounts and versions are recorded rather than overwritten — an approval trail, not an eraser.
The log is available on every plan, including a lapsed one, because it is a legal obligation rather than a feature.

Sessions and credentials

Short-lived access tokens, rotating refresh tokens, and secrets that are encrypted at rest.

Access tokens last fifteen minutes and are held in memory; refresh tokens are httpOnly cookies and rotate on use.
Passwords are bcrypt-hashed; sign-in attempts are rate-limited and accounts lock after repeated failures.
Server credentials edited in the console are stored AES-256-GCM encrypted and never travel back to a browser in full.
Two-factor authentication is available on every plan.

Least privilege by role

A receptionist sees the front desk. A pharmacist sees the counter. Neither sees the clinic’s books.

Owner, admin, doctor, nurse, receptionist, pharmacist and lab roles, each with their own reach.
Modules are switched on and off per role and enforced on the server — typing a URL does not get you in.
Operator access to a clinic for support is time-boxed, recorded, and visible in that clinic’s own audit log.

Consent and patient rights

The DPDP Act gives patients rights over their data. The product has somewhere to put them.

Consent is captured on the patient record, with the timestamp it was given.
Patient records are exportable in full, on request, on every plan.
Logs are configured to drop phone numbers and email addresses rather than record them.

Operational safety

The boring things that decide whether a bad morning becomes a bad week.

Liveness and readiness probes that fail a single instance out of rotation rather than restarting healthy ones.
Rate limits on every endpoint, not just the front door.
Payment webhooks are signature-verified, and a payment cannot be credited twice by a webhook and a redirect both reporting it.
Regular backups, restorable and never gated.

Leaving

You can take your data and go.

Export, printing and backups are never gated by a plan and never withheld for non-payment. A subscription that lapses stops you writing new records — it never locks you out of the ones you already have, and it never stops you printing a prescription for the patient in front of you.

We think a vendor that can switch off your exports is holding your clinic’s records hostage, so we made it impossible for ourselves to do it.

Need this in writing for your compliance file?

Tell us what your auditor needs and we will put it together — data processing terms, retention policy, or a walkthrough of the audit trail.

Ask us