Patient records deserve a straight answer.
What follows is what is actually in place today. Where something is planned rather than built, it says so.
Where the data lives
Patient data is stored in a managed PostgreSQL database in Mumbai, India. Every connection to the site and the app is encrypted with TLS, and the database provider encrypts data at rest. Automated database backups are being put in place before general launch; until then, treat your own CSV exports as your copy.
Who can read it
Access is role-based — front desk, doctor, owner and the other roles a clinic sets up — and scoped per branch for clinics running more than one. A user sees the records their role needs and no others. Every change is permission-checked on the server, not just hidden in the screen, and access ends the moment an account is disabled. Per-screen view permissions are still being extended to every page.
What is logged
Every change — a patient registered or edited, an appointment booked or cancelled, a prescription issued or amended, a payment taken — is written to an audit log with the user and the time, in the same transaction as the change itself, so one cannot happen without the other. Reads are not logged yet, and the log is not yet browsable from inside the app; ask support for an extract.
Who owns the data
Patient records are the clinic's data. Under the Digital Personal Data Protection Act, 2023 the clinic is the data fiduciary for its patients, and Clinicket acts as its data processor: we process patient records only to provide the service and only on the clinic's instructions.
What we do not do
We do not sell clinic or patient data, share it with advertisers, or use it to train models. Our staff look at a clinic's records only to resolve a support request the clinic has raised.
Getting it back
Patient, appointment, prescription, doctor and staff lists export to CSV from their own pages at any time, at no charge. For anything not covered there, write to support and we will send it. We would rather a clinic leave with its data than stay because it cannot.
Certifications
Not yet certified. Clinicket has no ISO 27001 or SOC 2 report at this time, and we would rather say so than imply otherwise. The controls above are in place; the external audit is not. If a formal report is a requirement for your clinic, tell us and we will give you a date rather than a maybe.
Questions we have not answered
Ask us something specific.
Security questionnaires, data residency requirements and DPA reviews go straight to the people who built the system, not to a form.