Hospital management software, built for India

Trust & security

Patient data, handled like patient data.

Encryption in transit and at rest. Tenant isolation. An append-only audit log. Hosted in India and designed for the DPDP Act 2023.

Request security packHow we protect data
Clean, empty CT scanner room with the gantry and patient table, white walls and ceiling lights
How Carexa is built
Security controls
  • DPDP Act 2023Designed for
  • ABDM · ABHABuilt in
  • Patient data hostingIndia only
  • Tenant dataIsolated
  • Audit logAppend-only
See our security controls

Commitments in writing

Uptime and recovery commitments are set out in your contract.

Security controls at a glance

In every plan

  • Encryption
    In transit · at rest
  • Role-based access
    Least privilege
  • Audit log
    Append-only
  • Data residency
    India only
  • Tenant isolation
    Per tenant

Security controls

Encrypted everywhere. Audited everywhere.

Developers & API
Clinician reviewing a patient record on a tablet
Patient record · fields
Encrypted
Name•••••• ••••
Phone+91 98xxx xx214
ABHA91-4820-xxxx-3317
Data keyPer tenant · KMS

Encryption

Encrypted everywhere. Always.

  • In transit · TLS 1.3

    Strict cipher policy. HSTS preload. Certificate renewal automated. No mixed-content paths.

  • At rest · AES-256-GCM

    Encrypted databases, file storage and backups. Per-tenant data keys, managed in a key management service.

  • Field-level encryption

    PII fields (name, phone, ABHA, Aadhaar) wrapped with envelope encryption.

  • Key rotation

    Key-encryption keys and token-signing keys rotate on a schedule, without downtime.

An elderly hand wearing a pulse-oximeter clip is held by another hand on a hospital blanket
Audit log · entry
Hash-chained
UserDr. S. Iyer
ActionAllergy updated
Before → afterNone → Penicillin
IP10.24.6.18

Access control

Least privilege. Audited everywhere.

  • Role-based access (RBAC)

    Built-in roles for every hospital team, plus custom roles per tenant. Fine-grained per resource.

  • MFA + WebAuthn

    TOTP for everyone, hardware keys for admin and clinical leads.

  • Append-only audit log

    Every clinical write logged with user, IP and before/after value. Hash-chained.

  • Break-glass access

    Emergency override leaves a permanent banner on the audit trail.

Compliance

Built for the rules Indian hospitals work under.

Read our DPDP notice
Designed for

DPDP Act 2023

Consent records, purpose limitation, data-principal requests and breach-reporting hooks, built into the product.

Built in

ABDM

ABHA creation and verification, Scan & Share, and consent-based sharing of health records.

Append-only

Audit-ready records

Every clinical write is logged with user, time and before/after value, ready for internal review and inspections.

Consent first

Patient consent

Consent is captured, stored and honoured per purpose, and a withdrawal is recorded and respected.

On request

Security reviews

Send us your security questionnaire. We walk your IT and compliance teams through our controls under NDA.

India only

Indian data residency

Patient data is stored and processed in India, on multi-zone hosting with tenant isolation.

Clinical safety

Software that supports clinicians, never replaces them.

Carexa is built for registered healthcare providers. It does not give medical advice to patients.

Decision support, not decisions

Alerts and suggestions help clinicians. Diagnosis and treatment stay with the treating clinician and the hospital.

Alerts can be incomplete

Checks rely on reference data and on what is recorded for the patient. A missing alert doesn’t mean it’s safe.

Clinicians sign off

Templates and generated documents, such as discharge summaries, are reviewed by the responsible clinician before signing.

Report a safety concern

Email support@carexaos.com with “Clinical safety” in the subject if you think the software contributed to a clinical risk.

Full wording in our terms, section 3.

Infrastructure

Tenant isolation. Encrypted backups. Recovery designed in.

Backups
EncryptedAutomated, encrypted backups of every tenant.
Recovery
Point-in-timeRestore a tenant to a chosen moment, not just to last night.
Hosting
Multi-zone, IndiaSpread across availability zones inside India.
Isolation
Per tenantSeparate data keys and access boundaries for each hospital.

Uptime and recovery commitments are set out in your contract.

Need our security pack?

A detailed write-up of our architecture, security controls, hosting and data-protection approach, for your IT and compliance teams.

Request security pack Privacy notice

Shared under NDA. We reply within one working day.