Security

We do not claim HIPAA compliance, SOC 2, ISO 27001, or CDSCO medical-device registration. If your hospital needs a signed processing addendum or a specific control set, ask us before a production rollout — do not assume this page is that contract.

• Transport: HTTPS/TLS between browsers, the API, and our cloud load balancer.
• Hosting: Amazon Web Services, Asia Pacific (Mumbai) region; the database and internal services run in a private network.
• Database: clinical records in PostgreSQL on AWS RDS with encryption at rest enabled; the database is not publicly reachable.
• Isolation: clinical records are scoped to the practitioner or organisation tenant; other tenants cannot read that chart.
• Sign-in: Google OAuth for clinicians; a first-party session cookie on the Services.
• Role-based access: each organisation assigns roles (for example doctor, nurse, front desk, billing, administrator), and the API checks that role’s permissions on each request.
• Audit history: changes to clinical and operational records are recorded with who made them and when, with version history. Deletions are soft, so records can be audited and recovered. Vaidra EMR shows hospital administrators an activity log of operational actions.
• Object storage: consult recordings and encounter attachments (images, PDFs, sketches) stored in Cloudflare R2 (provider-side encryption at rest).
• Integration secrets: EHR access tokens and practice-system credentials are encrypted in the application (AES-256-GCM) before storage.
• Vaidra personnel: access to production systems is limited to authorised staff for operations and support.
• Human review: the product is built so clinicians accept, edit, or reject drafts before they commit to the chart.

Application-level encryption of every AI payload is not claimed. Speech and language vendors receive audio or text in order to transcribe and draft. LLM traces may be encrypted at rest when the trace key is configured. Operational logs and optional browser error reports go to our observability provider.

• Tell patients when a consult is recorded.
• Use workstations and Google accounts you control; invite only authorised staff.
• Assign least-privilege roles and review members regularly; remove leavers.
• Review every note, prescription, and summary before it leaves the room.
• Keep downtime procedures for Vaidra EMR workflows.
• Use managed devices; browser storage holds workspace context.
• Agree retention and hospital security requirements with us in writing when they go beyond this page. We do not currently offer self-serve workspace export.

If you believe there is a security issue in Vaidra, email hello@vaidra.care with enough detail to reproduce it. Do not include unnecessary patient identifiers in the first message.

If we confirm a personal data breach affecting a Customer’s workspace, we will notify that Customer without undue delay and share what we know so they can meet their own duties to the Data Protection Board and affected people.

Privacy details: Privacy Policy. Vendors: Subprocessors.

Email hello@vaidra.care with steps to reproduce.

• Give us reasonable time to fix before public disclosure.
• Do not access, change, or keep patient or other personal data beyond the minimum needed to show the issue.
• No denial-of-service, spam, physical, or social-engineering testing.

We will not pursue action against good-faith research that follows these rules.