Encrypted in transit and at rest
Clinical and laboratory records are encrypted on the way to us and while they are stored. Sensitive fields carry their own protection on top of that, so a record cannot be read out of the database in the clear.
Security
How we handle your data.
MedOS and LabOS hold clinical and laboratory records, which is about as sensitive as business data gets in India. This page states what protects them in terms a practice manager can act on. The engineering detail behind each line goes to a named person on request, not onto a public page.
What protects a record
Four things, stated as outcomes.
Access is scoped to a role
Reception, nursing, pharmacy, laboratory, billing and clinical staff each see the part of the system their work needs. Sessions expire, and access ends when an account is removed.
A trail you can hand an assessor
Record changes, sign-ins and privileged actions are written to a tamper-evident audit trail, so an edit made after the fact is detectable rather than merely discouraged. In LabOS a result cannot be released by the person who entered it.
Your data leaves with you
Records stay exportable while you are a customer, and for 30 days after a MedOS subscription ends. There is no fee to take your own data out, and no step that has to go through us.
Where your data is
Records in India. Attachments, we will not overstate.
The MedOS patient record database is in India. Attachments — uploaded files and generated report PDFs — are held in a regional facility that we do not guarantee is inside India. Almost every vendor in this market compresses both of those into “your data is stored in India”. We will not, because it is only true of the first.
If data residency is a condition of your purchase — and for a hospital it usually is — ask before you buy. We will confirm in writing exactly where the records for your product and plan are held, which is a better basis for your contract than a sentence on a web page.
Responsible disclosure
Found something? Tell us before you tell anyone else.
We will acknowledge a credible report, keep you updated while we fix it, and we will not take legal action against anyone who investigates in good faith, works with data they own, and gives us a reasonable window to respond.
Please do not use another practice’s records to demonstrate an issue. If you believe you can reach data that is not yours, stop and describe it to us instead.