Security and privacy at Nabhaya.

1Where is patient data stored?

In India. Everything the Nabhaya application stores (the database, uploaded files, exports, backups and logs) is in Amazon Web Services, Asia Pacific (Mumbai).

• The application, its PostgreSQL database and its job queue run on an AWS server in Mumbai with an encrypted disk.
• Patient documents, exports, per-clinic backups and audit fingerprints are kept in private Amazon S3 storage in Mumbai, with public access blocked.
• Cloudflare provides DNS, a security proxy and a bot check for nabhaya.com and clinic.nabhaya.com. Traffic may pass through its global network, but Cloudflare stores no application data.

Stored application data stays in India. Data leaves India only in transit through Cloudflare's network and where Meta (WhatsApp), our email provider or Google Firebase deliver messages. The full list is in Which providers process data.

2How is data encrypted?

Data is encrypted in transit and at rest, and the most sensitive data is encrypted a second time by the application.

• In transit: HTTPS only, with strict transport security, from the browser to Cloudflare and again from Cloudflare to our server.
• At rest: the database sits on an encrypted disk, and backups are encrypted before they leave the server.
• Patient files: every patient document, signature and stamp, and every export and per-clinic backup, is encrypted with AES-256-GCM using its own key before it is stored.
• Secrets: government ID numbers (Aadhaar is kept as the last 4 digits only), authenticator secrets and the clinic's WhatsApp, email, payment-gateway and card-machine credentials are stored encrypted.
• In the browser: anything the app keeps on the device is encrypted with a key that cannot be copied out, and is wiped at sign-out.
• Payments: card and UPI details are entered on the payment provider's page or the card machine. Nabhaya never sees or stores them.

3How does sign-in protect accounts?

A stolen password is not enough. A new device always needs a second step, and administrators must use two-step verification.

• Second step on new devices: an authenticator code, a passkey or a one-time code. A verified device is remembered for 15 days, on that device only.
• Administrators: must use an authenticator app or a passkey (fingerprint, face or device PIN), with recovery codes. Email or WhatsApp codes are never accepted for them.
• Passwords: at least 10 characters, checked against common and breached passwords, and stored only as a one-way hash.
• Sessions: one active session per account; signing in elsewhere ends the old one, and every sign-in ends after 7 days at most.
• Screen lock: after the idle time each user chooses, only the password unlocks the screen, and 5 wrong tries sign the user out. The lock is enforced on the server.
• Brute-force protection: repeated wrong passwords and codes are slowed down and locked out, and the user and the clinic's administrators are alerted.
• Bot check: Cloudflare Turnstile protects sign-in, password reset, booking codes, privacy-request codes and secure-link unlocks.

4Who can see patient records?

Each person sees only what their job needs, and every screen and action checks permissions on the server, not just in the menu.

• Roles: five ready-made roles (Clinic Admin, Doctor, Receptionist, Pharmacist and Lab Technician) built from 102 permissions in 16 modules, such as view, create, edit, cancel, collect payment, give discounts and issue refunds. Custom roles come with the Practice plan and up.
• Changes apply at once: removing a permission or deactivating a user takes effect within seconds.
• Doctors only: consultations and prescriptions are open only to users with the Doctor role and a doctor profile.
• Controls on money: bill cancellations need an approval, and refunds are a separate, recorded step.
• Clinics kept apart: every record belongs to one clinic and is checked against the user's clinic on every request. The database adds its own row-level security on clinic tables such as patients, visits and bills, which the application cannot switch off. Requests for another clinic's data are refused, and attempts on another clinic's files are reported.
• WhatsApp inbox: each clinic sees only its own chats.

5Is there an audit trail?

Yes. Important actions are written to an audit trail that is chained like a ledger, so any edit or deletion shows up.

• Sign-ins, role changes, bills, payments, cancellations, refunds, consent, data exports and support sessions are logged.
• Opening a patient's record, consultation or document is recorded with who and when. Views of a clinic's patient lists by Nabhaya staff are logged too.
• Each clinic's entries form their own chain. The chains are checked every day, and a daily fingerprint is kept outside the database.
• Audit records are kept for at least one year. Your clinic can ask for its own audit trail through a support ticket.

6Can Nabhaya staff see our data?

Only in a support session that your clinic's administrators are told about. Nabhaya staff belong to no clinic.

• To work inside a clinic's account, a staff member gives a written reason and passes a fresh authenticator or passkey check.
• A session lasts 15, 30 or 60 minutes, and 2 hours at most. It is read-only unless set-up help is needed.
• It never handles payments, refunds, exports, prescriptions or credentials, and sends no messages to patients.
• Your administrators are told when it starts, can see it and can end it. Every action in it is audited, with the staff member recorded.

We limit our staff's access to patient data to what is needed to support or secure the Service.

7How are documents shared with patients?

By secure link, never as an open attachment.

• Secure links: a bill, prescription or lab report sent to a patient opens only after they enter the last 4 digits of their mobile number. Links expire, can be withdrawn, and lock after too many wrong tries.
• Verification QR: printed lab reports, and bills if the clinic chooses, carry a QR code that shows whether the document is genuine, with only the patient's initials. The full document still needs the mobile digits. A prescription opened from WhatsApp has a "Verify this document" link.
• Safe uploads: files are checked by their contents, not their name. Patient documents are accepted only as PDF, JPG, PNG or WebP. Images are re-encoded, which removes hidden content and location data, and PDFs with scripts or embedded files are refused.
• Booking page: every online booking is confirmed with a code sent to the patient's WhatsApp, the patient agrees to the clinic's privacy notice first, and the page never shows anything about other patients.
• Review links: the short links in review requests can lead only to a Google address.

8How is data backed up?

Continuously, and again every night, in Mumbai.

• Point-in-time recovery: every change to the database is copied within about a minute to a separate, encrypted store in Amazon S3, Mumbai, locked against deletion. The database can be restored to any moment in the last 14 days.
• Nightly backups: a full, encrypted database backup every night, locked against deletion (daily copies kept 35 days, monthly copies about 13 months), plus daily disk snapshots and nightly encrypted backups of each clinic.
• Checked daily: backups are verified automatically every day, and an alarm goes off if one is missing.

9How do you watch for attacks?

• Attack blocking: rate limits on sign-in, codes and public pages, a bot check on public forms, and blocking of suspicious IP addresses.
• Security alerts: attempts on another clinic's files alert the Nabhaya team and the clinic's administrators. Repeated failed sign-ins alert the user and the administrators, and blocked uploads alert the administrators. Each event adds to a risk score that our team reviews.
• Infrastructure: AWS logging and threat detection, and alarms for server health and backups.
• Verified integrations: WhatsApp messages and Razorpay and Cashfree payment notices are accepted only with a valid signature; notices from other payment providers are confirmed with the provider before anything changes.
• Browser hardening: a strict content security policy blocks injected scripts, other sites cannot frame the app, and requests to the app from other websites are refused.

If a breach happens, we tell the affected clinic without undue delay, help it notify the Data Protection Board of India and affected people, and report to CERT-In as the law requires.

10How does Nabhaya help with the DPDP Act?

Your clinic is the Data Fiduciary and decides how patient data is used. Nabhaya is its Data Processor, under the data processing terms the clinic accepts online when it signs up. Nabhaya gives your clinic tools that help it meet its DPDP duties:

• Consent recorded for every patient: when, how (in person, signed form or online) and against which version of your privacy notice. For a child, the parent or guardian is recorded.
• Your own privacy notice, published from Settings, with every version kept.
• Separate marketing consent: review requests and announcements go only to adult patients who opted in. Care messages do not depend on it, and once a patient withdraws consent, no more messages are sent.
• A patient privacy page where patients can withdraw consent, ask for a copy, correction or erasure, nominate someone or raise a grievance, after a WhatsApp code check, with a 30-day tracker for your team.
• Erasure once your medical-record retention period ends (by default 3 years after the last visit). Bills are kept, as tax law requires.

Nabhaya does not sell data, and does not use patient data for advertising, analytics or training artificial-intelligence models. For Nabhaya's own role: Grievance Officer: Vikash Kumar Pal, Chief Executive Officer, improveFX Technologies Private Limited, E-49/5, First Floor, Okhla Industrial Area Phase II, New Delhi, Delhi 110020, India. Contact details are in our privacy policy. We acknowledge grievances within 48 hours and resolve them within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

11What happens to our data if we leave?

Admins can export patients, appointments, visits, prescriptions, vitals, bills and payments, pharmacy and stock records, with uploaded files, in Excel or CSV at any time.

Everything keeps working for 7 days after the plan ends. Then the account is read-only for 90 days, and administrators can still sign in to renew or export for 90 more days before the data is deleted. Reminders go out when the plan ends and 60, 30 and 7 days before deletion.

If you close your account, deletion is confirmed with a code and held for 7 days, so you can change your mind. When data is deleted, your administrators get a deletion certificate. Encrypted backup copies expire on their normal schedule and are never restored for use.

12Which providers process data for Nabhaya?

These providers process personal data for Nabhaya. Updated 22 October 2026.

Payment gateways, card machines, Google accounts and WhatsApp or email accounts that a clinic connects are the clinic's own providers, under the clinic's own agreements with them. For video consultations, Nabhaya only creates or stores the meeting link; it sends the video service no patient details and does not host or record calls.

13Can we get Nabhaya's security documentation?

Yes. Clinics and their security reviewers can ask for our security documentation, shared under NDA, at support [at] nabhaya.com. How we handle personal data is set out in our privacy policy and in the data processing terms your clinic accepts when it signs up.

14How do I report a security issue?

Write to support [at] nabhaya.com with what you found, the page or address involved and the steps to reproduce it.

• Do not access, change or delete data that is not yours, and stop as soon as you have shown the problem.
• Give us reasonable time to fix the issue before telling anyone else.
• We will confirm that we received your report and keep you informed.