Security and data protection

What Clinic24x7 does

Each clinic's data is separate

Every record belongs to one clinic, and every request is checked against the signed-in user's clinic. Staff of one clinic can never see another clinic's patients, even by changing a link.

Every action is checked against your role

What you can do depends on your role (Clinic Admin, Doctor, Receptionist). The server checks permissions on every action, not just by hiding buttons. See Roles and permissions.

Sign-in security

• Passwords are stored only as one-way hashes (Argon2), never as text. Nobody at Clinic24x7 can read your password.
• Sessions use secure, HttpOnly cookies that scripts on a page can't read.
• After repeated wrong passwords, the account is locked for a while.
• Log out of all devices ends every session at once (Settings → Sessions).
• Platform administrators also confirm sign-in with a one-time code sent to their email.

Where data is kept

Clinic24x7's servers and database are in Mumbai, India. Text sent to the AI provider for AI features (with names and contact details removed, see below) is processed by that provider.

Encrypted connections

All traffic between your browser or phone and Clinic24x7 uses HTTPS.

A tamper-proof audit trail

Changes to patients, visits, bills and settings, sign-ins and data exports are recorded with who, when and from where. Audit entries can't be edited or deleted. See The audit log.

AI features

When you use AI features (Bee in Quick Visit, AI Scribe, the history summary), the text sent to the AI provider has the patient's name, phone numbers and email addresses removed first. AI suggestions are only saved when you choose to apply them.

Patient rights built in

Consent capture, consent withdrawal and patient data requests (copy and erasure) are part of the product. See Patient consent and Patient data requests.

Payments

Clinic24x7 never handles your patients' money. UPI payments go straight from the patient's UPI app to your clinic's account.

What your clinic should do

• One account per person, never shared.
• Deactivate leavers the same day.
• Use strong, unique passwords, and lock computers at the front desk when you step away.
• On phones, turn on Auto-lock in the mobile app.
• Be careful with exports (patient list CSV, data downloads). Don't email them or leave them on shared computers.
• Get consent before uploading photos of patients, and don't put patients' faces on your website without written permission.
• Report anything suspicious to Clinic24x7 through Help & support straight away.

More

Read our Privacy Policy and Terms.