How we protect your records

• Clinics are kept apart. Each clinic’s records are kept apart from every other clinic by the database itself, not only by the app. A staff member of one clinic cannot read or change another clinic’s records, even by trying.
• Roles limit what each person sees. The owner chooses who can sign in and their role. For example, a compounder can see what to dispense but cannot read the doctor’s clinical notes.
• Signed-off records stay signed off. Once a consultation is completed, it cannot be silently rewritten. Changes are added as a new revision, so there is always a trail.
• We never see your password. Sign-in is handled by Google’s authentication service.
• We never see your card. Payments are taken by Razorpay on its own screen. We receive only a payment reference and the amount.
• Logs do not contain patient details. Our error and activity logs record that something happened, not who the patient was or what was wrong with them.
• Nothing goes to an AI service. Patient records are not sent to any AI service today.
• Locked after the plan ends. If a plan lapses, the workspace stops accepting changes until you choose a plan.

Only the founder has administrative access to the database. Interns and sales representatives never do. Sales representatives see which clinics they brought in, never patient records. Any time we have to look at a clinic’s data to help you, it is because you asked us to.

Records are stored in Google Cloud (Firebase), in a multi-region database located in the United States. Our server functions run in Mumbai, India. If keeping your data in India matters to you, tell us before you sign up.

These are real gaps. We list them so you can decide with the facts:

• A button to export all of your clinic’s records yourself. Today you ask us and we send you a copy.
• A button to delete your clinic yourself. Today you ask us and we delete it.
• Scheduled backups that we manage ourselves. Today your data relies on the protections Google’s database provides.
• Independent security certifications. Chikitsa is new and has none yet, and we will not claim any until we hold them.

• We do not claim any security certification, because we do not hold one yet.
• We do not promise the service will never be down.
• We do not claim no system can ever be breached. No software can honestly say that.

If you think you have found a security problem or you believe an account was used by someone else, write to dwejy80bhama@gmail.com or call +91 70072 24036. Please do not share patient information in the email. We will reply within 2 working days. For how we handle personal data, see the Privacy Policy.