How your patients' data is actually handled

Many unrelated doctors use Medoc independently, the way many unrelated businesses use the same accounting software. Nothing about one doctor's patients is ever visible to another, even though both run on shared infrastructure.

Every clinical record lives under your practice. Every write re-derives which practice you are from your verified session — never from the request — so a crafted request cannot reach another practice's data. Firestore Security Rules enforce the same boundary at the database layer as a second, independent line of defence, so a bug in application code still cannot leak data across practices.

There is no global "patients" collection to leak by accident. The only cross-practice pointer that exists anywhere in the system is a link a patient created themselves by redeeming a code you gave them.

A patient's dashboard is not their data living in one place. It is a live, read-scoped view across each doctor's independent record, assembled only from links the patient granted.

You give a patient a 6-character code that expires in 72 hours. You can never look a patient up by email or phone — patient identities are deliberately not searchable by doctors, which is what keeps patient contact details from being enumerable across the platform.

A patient can revoke any doctor at any time, from their own privacy settings. Revocation is one-sided by design: they stop seeing your chart, and you keep clinical ownership of every note you wrote.

Lab reports, scans, discharge summaries and generated prescriptions live in a private object store with no public access. Every single view or download mints a fresh, signed link that expires in five minutes, issued only after re-checking that the person asking still has permission for that exact document.

Uploads go straight from the browser to storage using a short-lived signed link, so a 40 MB scan never streams through our servers. The storage key is generated on the server — never accepted from the browser — and the server verifies the file actually landed, at its real size, before writing any record of it.

Clinic logos and profile photos live in a separate public bucket. Nothing patient-identifiable is ever written there.

India's Digital Personal Data Protection Act applies to every SaaS company and every healthcare provider processing personal data of Indian residents. There is no small-business carve-out, and penalties are assessed per violation.

• Explicit, purpose-specific consent is captured at both doctor sign-up and patient sign-up, and logged immutably with a timestamp.
• An append-only audit trail records who accessed or changed what — the evidence required in a breach inquiry. Reads are logged, not just writes.
• Patients have a rights centre that implements Data Principal rights end to end: see everything held, export it, request correction, request erasure, and see exactly which doctors currently hold a link.
• Ecogenius Technology Pvt. Ltd. is the data fiduciary as platform operator. Each doctor is a co-controller of their own patients' data — a relationship spelled out in the doctor Terms of Service at sign-up.

Before any patient data can leave the platform — before a doctor can invite a patient to the portal or issue an e-prescription — we confirm their medical council registration number. A real person reviews it, and the decision is written into that practice's own audit trail.

• TLS everywhere, enforced at the edge.
• Database records encrypted at rest with Google-managed keys; stored objects encrypted at rest with Cloudflare-managed keys.
• Passwords are a minimum of 10 characters with leaked-password protection enabled, hashed by Firebase Authentication — we never see or store one.
• Session cookies are httpOnly and Secure, checked for revocation on every request, so disabling an account or forcing a sign-out takes effect immediately rather than at cookie expiry.
• Rate limiting on the invite-code claim endpoint, so a 6-character code cannot be brute-forced.
• Role and practice are checked at three independent layers: the edge, the server action, and the database rules.

A doctor never loses access to their own clinical records. There is no subscription to lapse and no billing state that can lock a chart: export is always available, and nothing is ever deleted out from under you.

Patients can export everything held about them, across every linked doctor, as a single file, at any time.

The Ayushman Bharat Digital Mission is a federated, consent-based exchange layer — it does not centralise records. That is architecturally the same shape as Medoc's own tenant model, which was a deliberate choice: ABDM support arrives as a thin adapter (ABHA capture, HFR/HPR registration, FHIR R4 export) rather than a rebuild. Clinic Pro subscribers get early access.