Security is part of the product.
Health data is the most sensitive data we handle. Below are the controls built into EziiCloud today, described as they work. EziiCloud is designed to support HIPAA and India's DPDP Act requirements. It has not been independently certified against either, and we will say so in any questionnaire.
Six pillars
Tamper-evident access log
Opening a patient's records is written to an access log that shows who opened what, and when. The log is built so that any change to it shows.
Protected sessions
Signed-in sessions are protected against takeover, encrypted, and expire.
Each hospital kept apart
Each hospital's data, brand and web address are its own, kept apart from every other hospital's.
Versioned consent
Sign-up and video-visit consent store the exact version of the text the patient agreed to. Video-visit consent is written to India's Telemedicine Practice Guidelines (2020) and the DPDP Act.
Encrypted in transit
Every page is served over HTTPS (TLS 1.2 or later) with HSTS, so browsers refuse an unencrypted connection.
A private AI model
The assistant runs on an open medical model on servers Virceton Technologies operates or the hospital hosts. Patient data is not sent to third-party AI services. Each hospital decides whether to switch it on.
What patients see
Only their own record
A patient can open only their own record.
Record download (FHIR R4)
Patients can download their record as a FHIR R4 Bundle at any time and take it to another provider.
Records requests
Patients can ask for copies of their records and see the request's status. The hospital's medical records team answers it, and every release is logged.
Close an account
Patients can close their account from Account Settings. Their sign-in ends; the hospital keeps the medical record, as hospitals must.
What hospital IT sees
Your data, kept apart
Each hospital's data is kept apart from every other hospital's. Nothing is shared between hospitals.
Multi-factor sign-in
Staff sign-in supports multi-factor authentication.
Abuse protection
Sign-in and forms are protected against password guessing and automated abuse.
Security headers
A strict content security policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy on every page.
No public CDNs
Every script, stylesheet and font is served from the hospital's own address. No third-party CDN sees your patients' page views.
Incident tracing
Incidents can be traced end to end in our logs.
Have a security questionnaire?
Send it to us. We'll answer it and walk your IT and compliance teams through these controls.