Prvaha is a technology platform only. Healthcare providers are solely responsible for all clinical decisions made using the platform. Prvaha does not provide medical advice or clinical diagnosis.
Data Isolation
Each clinic on Prvaha operates in a completely isolated database schema. Your patient records, appointment data, staff profiles, and configuration are stored separately from every other clinic on the platform. There is no shared storage layer, no co-mingling of records, and no possibility of one clinic’s data appearing in another clinic’s view. This architecture means:- A data incident at one clinic cannot expose another clinic’s data
- Prvaha staff access is scoped — support engineers can only access a specific clinic’s schema with explicit authorization
- Your subdomain (
[subdomain].prvaha.com) maps directly to your isolated schema
Encryption
All data handled by Prvaha is protected by encryption at every layer:| Layer | Protection |
|---|---|
| Data in transit | TLS encryption on all API and web traffic — data is never transmitted in plaintext |
| Data at rest | Sensitive fields are encrypted in storage using industry-standard encryption algorithms |
| Passwords & credentials | Credentials are hashed and salted; plaintext passwords are never stored |
No system is 100% secure. While Prvaha implements industry-standard protections, we cannot guarantee absolute security against all threat vectors. We conduct regular security reviews to identify and address vulnerabilities.
Authentication
Prvaha uses multiple secure authentication mechanisms to protect account access:- OTP Login
- Google SSO
Log in using a one-time password (OTP) sent to your registered phone number or email address. OTPs expire after a short window and are single-use, preventing replay attacks.
Role-Based Access Control
Prvaha enforces strict role-based access control (RBAC) across every endpoint and UI surface. Each user is assigned exactly one role, and that role determines what data they can view, create, modify, or delete.| Role | Access Level |
|---|---|
| Admin | Full access to all clinic data, settings, and staff management |
| Doctor | Access to assigned appointments, patient records, prescriptions, and clinical notes |
| Receptionist | Access to appointment scheduling, patient registration, and check-in |
| Nurse | Access to patient vitals, assigned workflows, and clinical support tasks |
| Lab Technician | Access to lab investigations, results entry, and assigned lab workflows |
| Patient | Access to their own records, appointments, and prescriptions only |
| Guest | Read-only, limited access — no write permissions |
Audit Logs
Every data access event and change made within Prvaha is logged. Audit logs capture:- Which user performed an action
- What action was performed (view, create, update, delete)
- The timestamp of the action
- The affected record or resource
Compliance
Prvaha operates in compliance with applicable data protection legislation:- Indian IT Act
- GDPR
Prvaha complies with the Information Technology Act, 2000 and the IT (Amendment) Act, 2008, including the Sensitive Personal Data or Information (SPDI) Rules, 2011. Healthcare data is treated as sensitive personal information and handled accordingly — with explicit consent mechanisms, access controls, and security practices that meet statutory requirements.
No Data Selling
Prvaha does not sell, rent, or trade your personal data or your patients’ data to any third party — ever. Data collected on the platform is used solely to provide and improve the Prvaha service.Third-Party Services
Prvaha uses a carefully selected set of trusted third-party providers to operate the platform:| Category | Examples of Use |
|---|---|
| Cloud Hosting | Secure infrastructure for data storage and compute |
| Analytics | Aggregate, anonymized usage metrics to improve the platform |
| Communication | SMS and email delivery for appointment notifications |
- Handle data securely and confidentially
- Use data only for the purpose for which it was shared
- Meet data protection standards equivalent to those Prvaha applies
Your Rights
As a Prvaha user — whether a clinic admin, staff member, or patient — you have the following rights regarding your personal data:- Access — Request a copy of the personal data Prvaha holds about you
- Correction — Request correction of inaccurate or incomplete information
- Deletion — Request permanent deletion of your personal data
- Portability — Request your data in a portable, machine-readable format
- Withdraw Consent — Withdraw previously given consent for data processing at any time