Data Security Policy

At MediSuggest Services India Pvt. Ltd., security is not an afterthought -- it is foundational to every layer of our platform. We handle sensitive healthcare billing data, financial records, and personally identifiable information for hospitals and consultants across India.

This document describes the technical and organisational measures we implement to protect your data. Our security architecture is designed around three core principles:

• Defence in depth: Multiple layers of security controls at the application, network, and infrastructure levels.
• Least privilege: Users and systems are granted only the minimum level of access required to perform their functions.
• Zero trust: Every request is verified, regardless of whether it originates from inside or outside the network perimeter.

ConsultPro serves multiple organisations on a shared infrastructure. Each tenant's data is completely separated and isolated to ensure that no organisation can access another organisation's data.

2.1 Database-Level Isolation

Every database query is scoped to the authenticated tenant's context. This is enforced at the ORM layer (Prisma), ensuring that tenant boundaries cannot be bypassed by application-level code. Row-level security policies provide an additional layer of enforcement at the database engine level.

2.2 API-Level Enforcement

Every API request is validated against the authenticated user's tenant context. Cross-tenant requests are rejected at the middleware layer before reaching any business logic.

2.3 Isolation Testing

We conduct regular cross-tenant data leakage tests as part of our quality assurance process. Any potential isolation breach is treated as a critical severity incident and resolved immediately.

3.1 Encryption at Rest

All data stored in our databases and file systems is encrypted using AES-256 (Advanced Encryption Standard with 256-bit keys), one of the strongest encryption standards available. Encryption keys are managed through a dedicated key management service with automatic rotation.

3.2 Encryption in Transit

All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. We enforce HTTPS on all endpoints and use HTTP Strict Transport Security (HSTS) headers to prevent downgrade attacks.

3.3 Sensitive Field Encryption

Certain highly sensitive fields, such as PAN numbers and financial account details, are additionally encrypted at the application level with separate encryption keys, providing an extra layer of protection even in the event of a database breach.

4.1 Token-Based Authentication

ConsultPro uses JSON Web Tokens (JWT) for session management. Access tokens are short-lived and paired with secure refresh tokens to maintain sessions without exposing credentials. Tokens are signed using RS256 and validated on every request.

4.2 Account Lockout

To protect against brute-force attacks, accounts are temporarily locked after five consecutive failed login attempts. Locked accounts can be unlocked through a verified email-based password reset flow or by contacting the tenant administrator.

4.3 Password Security

Passwords are hashed using bcrypt with an appropriate cost factor. We enforce minimum password complexity requirements and never store passwords in plain text. Password reset tokens are single-use and expire within a limited timeframe.

ConsultPro implements granular role-based access control (RBAC) to ensure that users can only access the data and features relevant to their role. The following roles are supported:

All access control checks are enforced server-side. Role assignments are managed by tenant administrators and can be updated at any time.

6.1 Cloud Hosting

ConsultPro is hosted on enterprise-grade cloud infrastructure with data centres located in India. Our cloud provider maintains ISO 27001, SOC 2, and other industry certifications.

6.2 Network Security

Our network is protected by Web Application Firewalls (WAF), DDoS mitigation services, and intrusion detection systems. Internal services communicate through private networks that are not accessible from the public internet.

6.3 Monitoring & Alerting

We employ 24/7 infrastructure monitoring with automated alerting for anomalous activity, resource exhaustion, and potential security events. Our engineering team maintains on-call rotations to respond to critical alerts promptly.

7.1 Daily Backups

Full database backups are performed daily and stored in a geographically separate location from the primary data centre. Backups are encrypted using the same AES-256 standard as production data.

7.2 Point-in-Time Recovery

Our database infrastructure supports point-in-time recovery (PITR), allowing us to restore data to any specific moment within the retention window. This capability minimises data loss in the event of accidental deletion or corruption.

7.3 Recovery Testing

We regularly test our backup and recovery procedures to ensure that data can be restored within our defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO). Recovery drill results are documented and reviewed as part of our operational readiness process.

ConsultPro is committed to meeting the highest standards of regulatory compliance relevant to healthcare billing in India:

8.1 SOC 2 Readiness

Our security controls are designed to meet SOC 2 Type II requirements across the Trust Service Criteria of security, availability, processing integrity, confidentiality, and privacy. We are actively pursuing formal SOC 2 certification.

8.2 HIPAA Alignment

While HIPAA is a US regulation, we align our data handling practices with HIPAA standards as a benchmark for healthcare data security. This includes administrative, physical, and technical safeguards for protected health information.

8.3 Indian IT Act Compliance

ConsultPro complies with the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We implement reasonable security practices as defined under these regulations for the protection of sensitive personal data.

9.1 Detection

We employ automated security monitoring tools that continuously scan for suspicious activity, unauthorised access attempts, and anomalous data patterns. Our alerting systems notify the security team in real-time for any events that meet our threat thresholds.

9.2 Response & Containment

Upon detection of a security incident, our incident response team follows a documented playbook that includes immediate containment, root cause analysis, remediation, and post-incident review. All incidents are classified by severity and handled accordingly.

9.3 Notification

In the event of a confirmed data breach that affects your organisation's data, we will notify affected tenants within 72 hours of confirmation. Notifications will include the nature of the breach, the data affected, the remediation steps taken, and recommendations for any actions you should take.

10.1 Comprehensive Action Logging

Every significant action on the platform is logged, including user logins, data access, billing approvals, payment transactions, role changes, and administrative operations. Logs capture the user identity, timestamp, action performed, and affected resources.

10.2 Immutable Audit Trail

Audit logs are stored in an append-only format, ensuring that records cannot be modified or deleted after creation. This immutability is essential for regulatory compliance, dispute resolution, and forensic investigations.

10.3 Log Retention

Audit logs are retained in accordance with our data retention policy. Application and access logs are retained for 90 days. Financial audit trails are retained for 7 years in compliance with Indian tax regulations. Tenants may request access to their audit logs at any time.

If you have questions about our security practices, wish to report a vulnerability, or need to report a security incident, please contact our security team:

MediSuggest Services India Pvt. Ltd. -- Security Team

Security: [email protected]

General support: [email protected]

Website: consultpro.in.net

We appreciate responsible disclosure of security vulnerabilities. If you discover a potential security issue, please report it to [email protected] and we will respond within 24 hours to acknowledge receipt and begin our investigation.