Patient trust, built into every layer.
Health data is personal data under India's DPDP Act, 2023. Clinic-level isolation, role separation, encryption and audit trails are built into the product — not bolted on for a questionnaire.
Where the line sits.
Patient records belong to the clinic, hospital, pharmacy or laboratory that created them. In the language of the DPDP Act, that organisation is the Data Fiduciary.
They decide why and how the data is processed. Qlinio processes it on their instructions, under a written agreement.
This matters in practice: we cannot hand a patient their records — only their clinic can. We cannot read a clinic’s data for our own purposes. And when something goes wrong, the clinic has its own notification duty it cannot discharge unless we move quickly.
What is built today.
Tenant isolation on every query
Clinic data is scoped at the data-access layer, not at the UI. Around 370 server modules route through the tenant guard, so a query cannot accidentally cross clinics.
Eight roles, separately permissioned
Admin, Doctor, Nurse, Pharmacist, Lab Technician, Staff, Patient and Super Admin each see a different surface. Nobody shares an 'admin' login.
Multi-factor authentication
Available on privileged accounts. MFA secrets are encrypted at rest with AES-256-GCM rather than stored in plain text.
PHI stays out of the plumbing
Patient identifiers are kept out of application logs, error reports and notification payloads — the places data usually leaks from without anyone noticing.
Audit trail on administrative action
Administrative actions are recorded against the acting user, so 'who did this' has an answer that does not depend on memory.
Rate limiting and abuse controls
Authentication and public booking endpoints are rate limited, so credential stuffing and booking spam are bounded rather than open-ended.
Encrypted in transit
Every connection to Qlinio services is served over TLS. No patient data moves over an unencrypted channel.
Consent-based sharing, not open access
Records shared under ABDM move on the patient's consent for that specific request. Holding a patient's ABHA number does not entitle anyone to read their history.
Measured against the law.
- In place
Encryption of personal data in transit
TLS on every connection.
- In progress
Encryption, masking or tokenisation at rest
Credentials and MFA secrets use AES-256-GCM today. Field-level encryption of clinical records is the next block of work.
- In place
Access control over computer resources
Per-user accounts, eight separately permissioned roles, tenant scoping at the data layer.
- In progress
Logs of access and processing activity
Administrative actions are logged against the acting user. We are extending the same trail to read access on clinical records.
- In progress
Retention of logs for one year
Rule 6 sets one year and the CERT-In Directions separately require 180 days held in India. We are standardising on the stricter of the two.
- In place
Documented incident response
Notification duties and timelines are defined and published below. The detailed internal playbook is being expanded alongside them.
- In progress
Equivalent safeguards imposed on processors
Contractual terms are agreed with core infrastructure vendors. The full subprocessor register goes out with our compliance pack.
If something goes wrong.
- Within 6 hours
Report qualifying cyber incidents to CERT-In
Required by the CERT-In Directions of 28 April 2022, issued under section 70B(6) of the IT Act, 2000.
- Without delay
Notify the Data Protection Board and the affected people
Required by Rule 7 of the DPDP Rules, 2025, in plain language describing what happened and what to do about it.
- Within 72 hours
File the detailed breach report with the Board
Broad facts, causes, mitigation and the remedial measures taken.
- Alongside all of it
Tell the affected clinic directly
For patient records the clinic is the Data Fiduciary and carries its own notification duty. It cannot meet that duty if we are slow.
Where they sit.
- On the roadmap
SOC 2
Not yet certified. We know where it sits on our plan and will tell your procurement team exactly where we are, in writing.
- Working toward
ISO 27001
ISO 27001 is the standard India's IT Act rules name for reasonable security practices, and it is what our controls are being built against.
- Scheduled
External penetration testing
A third-party test is planned. Until it is done we will share our internal security review rather than imply an assessment we have not had.
- Design-compatible
HIPAA
No company is HIPAA certified — the certification does not exist. Our architecture is built to be compatible for a future US deployment; today our binding obligations are Indian law, and we meet those.
- Primary obligation
DPDP Act, 2023
This is the law that actually governs patient data in India, and it is the one we build to. The safeguards above map directly to Rule 6.
What your compliance team can have today
Ask and we will send it — usually within two working days.
- A completed security questionnaire, answered as the product stands
- Our subprocessor register and vendor contractual terms
- The data processing agreement for clinics
- A walkthrough of tenant isolation, role separation and audit trails with the engineers who built them
- Our incident response and breach notification commitments in writing
Reporting a vulnerability.
Found a security issue? Tell us at support@qlinio.com before disclosing it publicly, with enough detail to reproduce it.
- We will acknowledge your report within three working days.
- We will not pursue legal action against anyone who reports in good faith, stays within the bounds of testing their own account, and does not access, alter or retain another person's data.
- Please do not run automated scans against production, and never test using real patient records.
- We do not run a paid bounty programme. We will credit you if you would like us to.
How we handle personal data on this website is set out in our Privacy Policy.
What reviewers ask us.
Who owns the patient data in Qlinikit?
The clinic, hospital, pharmacy or laboratory that created it. Under India's DPDP Act, 2023 that organisation is the Data Fiduciary and decides why and how the data is processed. Qlinio processes it on their instructions under a written agreement, and cannot release a patient's records directly to them.
Is Qlinio SOC 2 or ISO 27001 certified?
Not yet. Neither certification is held today. ISO 27001 is the standard our controls are being built against, and we will tell your procurement team in writing exactly where we are rather than imply an audit we have not had.
Is any company HIPAA certified?
No. HIPAA certification does not exist — there is no such credential for any vendor. Qlinio's architecture is designed to be HIPAA-compatible for a future US deployment, but its binding obligations today are Indian law, principally the DPDP Act, 2023.
How is one clinic's data kept separate from another's?
Tenant isolation is enforced at the data-access layer rather than in the interface, so a query cannot cross clinics even if the interface is wrong. Around 370 server modules route through that guard.
How quickly does Qlinio report a data breach?
Qualifying cyber incidents are reported to CERT-In within 6 hours as required by its 2022 Directions, the Data Protection Board and affected people are notified without delay under Rule 7 of the DPDP Rules, 2025, and a detailed report follows to the Board within 72 hours.
Can I see a security questionnaire before buying?
Yes. We complete security questionnaires as the product stands, and can share the subprocessor register, the data processing agreement, and a walkthrough of tenant isolation and audit trails with the engineers who built them.
Questions from your compliance team?
Send us your questionnaire and we'll complete it — with the engineers who built the isolation model on the call.