How we protect patient data.

Access control

Each person can reach only the data their role needs.

• Patient consent. A doctor sees a patient only after the patient links and the doctor approves. The patient can disconnect at any time.
• Database rules. Access rules are enforced per row in the database itself, not only in the app.
• Staff. Invite-only. Staff can add lab results but cannot read reports back, and a patient appears only after agreeing.

Sign-in protection

• Doctors and staff sign in with a 6-digit email code. The portal has no password.
• For shared computers, idle sign-out runs after 30 minutes for doctors and 60 for staff. A staff login older than 14 hours is signed out the next time the staff page opens.
• On a shared computer, unsent staff entries are kept per login, so they don't go out under the next person's login.
• Sign-up has a bot check and rate limits.
• Patients can sign out of their other devices from the app.

Audit and data integrity

• Changes to patient data go into an append-only log, with who made them. The database refuses edits to that log.
• Entries are kept for 3 years, and are erased when the account is deleted.
• If two people edit the same record, one change is never silently lost. The second person is told and can reload.
• For dialysis sessions the centre's entry takes priority. If staff enter a session on a day the patient already logged, the centre's entry takes over and the earlier values stay in the audit log. The book reader skips dates that already have a session.
• Patients can't alter a session the centre recorded, but they can flag it as wrong, and the doctor sees the flag.

Hosting and encryption

• Data is stored on Supabase in Singapore (AWS ap-southeast-1) and encrypted at rest.
• The app, portal and website all use HTTPS.
• The portal enforces a strict Content Security Policy.
• Automated checks run on code changes, and portal uptime is monitored.

Use of AI

• Google Gemini's paid API reads reports and dialysis books, and writes explanations.
• AI explanations, diet advice and meal plans are instructed never to suggest starting, stopping or changing a medicine.
• A person checks what AI read before a centre record is saved. Every dish in an AI meal plan is checked by the app against the patient's limits.

Privacy and the DPDP Act

NephroLife is designed around India's Digital Personal Data Protection Act 2023.

• The privacy notice is in Tamil and English.
• Patients can download their data, name a nominee and delete their account from the app.
• There is a Grievance Officer and a written procedure for data breaches. If a breach occurs, we will inform affected people and the Data Protection Board of India.
• When an account is deleted, data is erased from live systems at once. The privacy notice gives the full details.
• NephroLife is for people aged 18 and over.

Service providers

The companies that handle personal data for us. Some of this processing happens outside India.

Google Play and Razorpay handle payments on their own responsibility. Card and bank details are entered on Razorpay's or Google Play's payment pages. Razorpay may ask for your consent to save your card. That is with Razorpay: we don't store card or bank details.

Certifications and audits

NephroLife does not yet hold ISO 27001 or SOC 2 certification, and has not yet had an independent security audit. ISO certification is a future plan, and we will say so here when that changes. NephroLife is not a medical device.

Report a security issue

If you find a vulnerability, email support@nephrolife.in with “Security” in the subject. Please do not open or change real patient data. Centres can send security questionnaires to doctor@nephrolife.in.