Security & data protection

Who owns the data

Your hospital owns its data. We hold it only to run the service you have bought, on your written instructions. We do not mine it, sell it, share it with other customers, or use it to train models. You can export your data in full, in an open format, at any point during the subscription and on exit.

Where it lives

Patient data is stored on infrastructure located in India, whether you take our managed cloud or run Medara on-premise on your own servers. On-premise deployments keep data inside your building; nothing is uploaded to us unless you send it to us for support.

Encryption

• All traffic between browsers, apps, and the server runs over TLS.
• Data at rest is encrypted at the storage layer.
• Backups are encrypted with keys held separately from the data.
• Passwords are stored as salted one-way hashes and are not recoverable, by us or by anyone.

Access control

• Every user has a named individual account. Shared logins are not supported by design.
• Role-based permissions decide what each role can see and do — a pharmacy user does not see billing, a receptionist does not see clinical notes.
• Sessions time out on inactivity, and administrators can revoke access immediately.
• Our own staff have no standing access to your production data. Support access is granted for a specific request, is time-bound, and is logged.

Audit trail

Every create, edit, and delete is recorded with the user, the timestamp, and the previous value. Clinical and billing records are never silently overwritten. The trail is readable by your NABH and internal auditors, and it cannot be edited from within the application.

Backups and continuity

• Encrypted backups run daily, with retention agreed in your contract.
• Restores are tested — a backup nobody has restored is not a backup.
• For on-premise sites we help you configure local redundancy so a single disk or power failure does not stop admissions.

ABDM and consent

Where you join the Ayushman Bharat Digital Mission network, records are shared only against a valid patient consent artefact, and every link, fetch, and revocation is logged. Consent can be withdrawn by the patient, and withdrawal takes effect immediately. See our ABDM summary for what Medara implements.

Development practices

• Changes are reviewed before release and deployed from version control, never edited on a live server.
• Dependencies are monitored for known vulnerabilities and patched.
• Test environments use anonymised or synthetic data, never a copy of live patient records.

If something goes wrong

We will tell you. On confirming a personal data breach affecting your installation we will notify you without undue delay with what we know, what we are doing, and what we recommend you do — and we will support your notification to the Data Protection Board of India and to affected individuals as the DPDP Act requires.

Reporting a vulnerability

Email contact@techfrien.com with the detail needed to reproduce the issue. We will acknowledge within two business days. We will not pursue legal action against anyone who reports a genuine issue in good faith, gives us reasonable time to fix it, and does not access or alter other people’s data in the process.

Certifications

We support hospitals through NABH documentation requirements and implement the ABDM flows described above. We make no claim to any certification we do not hold. If your procurement process requires a specific standard, ask us and we will tell you plainly where we stand.