AES-256 encryption at rest
The clinical database is encrypted on disk with SQLCipher. A stolen or resold clinic PC does not hand over your patient history.
Cybersecurity
Protect the record where it is written.
Saaniya EMR encrypts the clinical database on clinic hardware and keeps diagnoses, notes, and prescriptions out of the cloud entirely. Booking contacts in the managed portal are personal data, and are treated as such.
Keys derived properly, not guessed
Argon2id key derivation with a per-install salt. Your passphrase is never used directly as the encryption key, and the session key lives in the operating system keychain.
Recovery codes at setup
Printed recovery codes are generated during installation, so a forgotten passphrase is a recoverable event rather than a permanent loss.
Role-based access and audit logging
Doctors and front-desk staff see different things. The audit log records who accessed which record, never the record contents.
Sync is an allowlist, not a filter
Only explicitly listed booking fields can ever leave the clinic. A new clinical field is unsyncable by default, and an automated test fails the build if that changes.
Signed updates
Update packages are cryptographically signed and verified before installation. The application refuses builds it cannot verify.
Tenant isolation in the cloud layer
Booking data is separated per clinic by row-level security driven by verified session claims, with both read and write policies enforced at the database.
Incident response before launch
A written runbook, contact list, and notification templates exist ahead of the first clinic, so a breach clock is met with a procedure rather than improvisation.
Threat model
The risks a private clinic actually faces.
Nation-state adversaries and hardware side channels are out of scope, and saying so is more useful than pretending otherwise. These six are in scope.
A stolen or resold clinic PC
The clinical database is encrypted at rest, so possession of the machine is not possession of the records.
Ransomware on the practice network
Encrypted local snapshots with integrity checks, a reminder cadence, and a restore path that is drilled rather than assumed.
Staff browsing records they should not
Separate doctor and front-desk roles, with an append-only audit log of access that never stores the record contents.
A tampered installer
Update packages are cryptographically signed and verified before installation. Unsigned or mismatched builds are refused.
One clinic seeing another clinic's bookings
Row-level security on every tenant table, driven by verified session claims rather than anything a client can send, with both read and write policies.
A leaked credential or committed secret
Service-role keys stay server-side, environment files are excluded from version control, and dependency audits run before each release.
Compliance
Accurate claims, written agreements.
The clinic is the Data Fiduciary and Saaniya Software LLC is a processor for the booking layer only. That relationship is contractual, documented, and deliberately narrow.
You are the Data Fiduciary. We are a processor.
Under India's DPDP Act the clinic determines why and how patient data is processed. Saaniya Software LLC processes booking contacts on your behalf, under a written Data Processing Agreement supplied with your licence.
Data minimisation, built into the product
The clinical record never reaches our infrastructure, so the volume of personal data we hold on your behalf stays deliberately small. Minimisation is an architectural property here, not a policy promise.
Consent and clear notice
Your booking page carries a specific, readable privacy notice covering what is collected and why, rather than blanket consent buried in a form.
Breach notification support
If an incident affects data we process for you, we notify you quickly enough to meet your own regulatory clock with the Data Protection Board and your patients.
Correction, erasure, and retention
Records are editable and deletable, with a documented retention policy that respects medical council retention obligations where they override an erasure request.
Beyond India
The architecture is built for GDPR Article 28 processor terms in the UK and EU, cross-border disclosure expectations in Australia and New Zealand, and the LGPD controller/processor model in Brazil. Market-specific contracts are confirmed before any sale in those regions.
Before the first paid clinic
What has to be in place before we take money.
Saaniya Software LLC treats these as gates rather than aspirations. A pilot conversation can start today; a paid deployment waits for all five.
- 01Counsel-reviewed licence agreement, Data Processing Agreement, privacy policy, and service terms
- 02Tax advice covering India OIDAR/GST treatment and United States obligations
- 03Payment-processor onboarding completed for licence and maintenance fees
- 04Incident-response runbook and breach notification templates in place
- 05Backup and restore verified on a real clinic machine