Patient trust, built into every layer.
Health data is personal data under India's DPDP Act, 2023. Clinic-level isolation, role separation, encryption and audit trails are built into the product — not bolted on for a questionnaire.
- Isolated per clinic
- Audit trail
- Mapped to DPDP Rule 6
Responsibility
Where the line sits.
Patient records belong to the clinic, hospital, pharmacy or laboratory that created them. In the language of the DPDP Act, that organisation is the Data Fiduciary.
They decide why and how the data is processed. Qlinio processes it on their instructions, under a written agreement.
This matters in practice: we cannot hand a patient their records — only their clinic can. We cannot read a clinic’s data for our own purposes. And when something goes wrong, the clinic has its own notification duty it cannot discharge unless we move quickly.
The product
What is built today.
Every item here is a property of the shipping product, not a plan.
Tenant isolation on every query
Clinic data is scoped at the data-access layer, not at the UI. Around 370 server modules route through the tenant guard, so a query cannot accidentally cross clinics.
Eight roles, separately permissioned
Admin, Doctor, Nurse, Pharmacist, Lab Technician, Staff, Patient and Super Admin each see a different surface. Nobody shares an 'admin' login.
Multi-factor authentication
Available on privileged accounts. MFA secrets are encrypted at rest with AES-256-GCM rather than stored in plain text.
PHI stays out of the plumbing
Patient identifiers are kept out of application logs, error reports and notification payloads — the places data usually leaks from without anyone noticing.
Audit trail on administrative action
Administrative actions are recorded against the acting user, so 'who did this' has an answer that does not depend on memory.
Rate limiting and abuse controls
Authentication and public booking endpoints are rate limited, so credential stuffing and booking spam are bounded rather than open-ended.
Encrypted in transit
Every connection to Qlinio services is served over TLS. No patient data moves over an unencrypted channel.
Consent-based sharing, not open access
Records shared between clinics move only on the patient's consent for that specific request. Knowing a patient's phone number does not entitle another clinic to read their history.
DPDP Rule 6
Measured against the law.
Rule 6 of the Digital Personal Data Protection Rules, 2025 sets out the safeguards every Data Fiduciary must implement. Your clinic answers for these too — so here is exactly where the product stands on each.
- In place
Encryption of personal data in transit
TLS on every connection.
- In progress
Encryption, masking or tokenisation at rest
Credentials and MFA secrets use AES-256-GCM today. Field-level encryption of clinical records is the next block of work.
- In place
Access control over computer resources
Per-user accounts, eight separately permissioned roles, tenant scoping at the data layer.
- In progress
Logs of access and processing activity
Administrative actions are logged against the acting user. We are extending the same trail to read access on clinical records.
- In progress
Retention of logs for one year
Rule 6 sets one year and the CERT-In Directions separately require 180 days held in India. We are standardising on the stricter of the two.
- In place
Documented incident response
Notification duties and timelines are defined and published below. The detailed internal playbook is being expanded alongside them.
- In progress
Equivalent safeguards imposed on processors
Contractual terms are agreed with core infrastructure vendors. The full subprocessor register goes out with our compliance pack.
Incident response
If something goes wrong.
India runs two separate clocks on a security incident, and they start before anyone has finished understanding what happened. Ours are set to the stricter reading.
- 01Within 6 hours
Report qualifying cyber incidents to CERT-In
Required by the CERT-In Directions of 28 April 2022, issued under section 70B(6) of the IT Act, 2000.
- 02Without delay
Notify the Data Protection Board and the affected people
Required by Rule 7 of the DPDP Rules, 2025, in plain language describing what happened and what to do about it.
- 03Within 72 hours
File the detailed breach report with the Board
Broad facts, causes, mitigation and the remedial measures taken.
- 04Alongside all of it
Tell the affected clinic directly
For patient records the clinic is the Data Fiduciary and carries its own notification duty. It cannot meet that duty if we are slow.
Certifications
Where they sit.
We would rather you knew precisely which badges we hold, which we are working toward, and which do not exist at all — so nothing in your security review comes as a surprise.
- On the roadmap
SOC 2
Not yet certified. We know where it sits on our plan and will tell your procurement team exactly where we are, in writing.
- Working toward
ISO 27001
ISO 27001 is the standard India's IT Act rules name for reasonable security practices, and it is what our controls are being built against.
- Scheduled
External penetration testing
A third-party test is planned. Until it is done we will share our internal security review rather than imply an assessment we have not had.
- Design-compatible
HIPAA
No company is HIPAA certified — the certification does not exist. Our architecture is built to be compatible for a future US deployment; today our binding obligations are Indian law, and we meet those.
- Primary obligation
DPDP Act, 2023
This is the law that actually governs patient data in India, and it is the one we build to. The safeguards above map directly to Rule 6.
What your compliance team can have today
Ask and we will send it — usually within two working days.
- A completed security questionnaire, answered as the product stands
- Our subprocessor register and vendor contractual terms
- The data processing agreement for clinics
- A walkthrough of tenant isolation, role separation and audit trails with the engineers who built them
- Our incident response and breach notification commitments in writing
Disclosure
Reporting a vulnerability.
Found a security issue? Tell us at support@qlinio.com before disclosing it publicly, with enough detail to reproduce it.
- We will acknowledge your report within three working days.
- We will not pursue legal action against anyone who reports in good faith, stays within the bounds of testing their own account, and does not access, alter or retain another person's data.
- Please do not run automated scans against production, and never test using real patient records.
- We do not run a paid bounty programme. We will credit you if you would like us to.
How we handle personal data on this website is set out in our Privacy Policy.
Questions
What reviewers ask us.
Ask us like you would on WhatsApp — pick a question and we'll answer.
Hi! Pick a question below — or ask your own at the bottom.
Prefer email? support@qlinio.com
Questions from your compliance team?
Send us your questionnaire.
We'll complete it — with the engineers who built the isolation model on the call.