Security and privacy
How VedVic keeps patient data safe, and where each audit and certification stands.
Where data lives
Patient records, reports, files and backups are stored in India. Uploaded files are kept in private storage that is never public. AI features run on Amazon Bedrock in the India region.
How it is protected
- AES-256 encryption at rest.
- TLS 1.2 or newer for every connection, inside our systems as well as outside.
- ABHA tokens and consent keys get an extra layer of column-level encryption.
- Patient names, phone numbers and documents never appear in logs.
Who can see it
- Each organisation’s data is walled off from every other.
- Every screen and action is allowed by role, and anything not allowed is refused.
- Doctors and admins sign in with two-factor authentication.
- Every access to a record is logged.
AI and patient data
AI features process data on Amazon Bedrock in the India region. Amazon Bedrock does not use this data to train its models. The clinic can switch each AI feature off. The doctor makes every clinical decision.
Consent and patient rights
Processing follows the patient’s consent, as the DPDP Act 2023 requires. Patients can ask the clinic to see, correct or erase their data, and we help the clinic respond. Details are in the privacy policy.
Your data is yours
Your clinic’s data belongs to you. If you leave, you take a full export of your patients, visits, prescriptions and reports with you.
Audits and certifications
- ABDM ABHA creation and linking, and health-record sharing (milestones M1 and M2)In progress
- DPDP Act 2023 Consent, purpose and erasure built into the patient recordBuilt in
- CERT-In security audit Application security audit by a CERT-In empanelled auditorBefore ABDM go-live
- ISO/IEC 27001 and 27701 Security and privacy management, built to the controlsCertification planned
- CDSCO Medical device software rules for clinical decision supportIn assessment
We show a certification as held only after an independent body grants it.
Report a security issue
Write to contact@vedvic.com. We acknowledge within one business day.
Questions
Is VedVic HIPAA compliant?
HIPAA is a US law for US healthcare providers. Clinics in India are governed by the DPDP Act 2023, the IT Act and ABDM rules, and VedVic is built to these.
Is patient data shared with anyone?
Only with the services needed to run VedVic for the clinic, such as hosting in India and WhatsApp for messages the clinic sends. It is never sold.
Questions about security?
We can walk your team through how VedVic handles patient data.