Privacy by Design

Clinical records are created and stored at the facility where care was given, not in a central repository we control. When another facility needs a patient's record, it is retrieved through India's Health Information Exchange & Consent Manager (HIE-CM) under the patient's explicit, time-bound consent — not copied into a shared database.

Every data share carries a specific purpose, a defined health-information type, and an expiry (either a stated date or an automatic erasure instruction). Access outside the scope, window, or purpose a patient consented to is not possible through the consent artefact the exchange issues.

When a patient revokes consent, or a consent expires, the underlying consent record and any data shared under it are permanently deleted from our systems — not marked inactive while remaining accessible. This is enforced in code and covered by automated tests that fail if the behaviour regresses to a soft delete.

Beyond a patient's ABHA number/address, Healthcare Professional ID, and Health Facility ID — all issued by the National Health Authority, not by us — we do not build or maintain a separate central profile of a patient across facilities. Each facility's records remain that facility's records.

Health information exchanged with the ABDM gateway is encrypted end-to-end using the key-exchange scheme the exchange specifies before it ever leaves a facility's system. Data at rest is encrypted using industry-standard cryptographic modules.

Sharing an ABHA number or address is voluntary. A patient who does not wish to participate in the National Digital Health Ecosystem is still registered and treated normally — no service is conditioned on creating or disclosing an ABHA ID.