Built for healthcare data.

Access control

Every user has a role — reception, nurse, doctor, billing, admin — and sees only what that role permits. Multi-location groups can further scope access by branch. There is no shared login: each staff member acts under their own account.

Encryption

Patient identifiers such as phone, email and address are encrypted at the application level, in addition to encryption in transit. Decryption happens only where the data is genuinely needed — for example when generating a patient PDF.

Auditability

Key actions are recorded with the user and timestamp, so a clinic can see who did what and when.

Infrastructure & backups

Yuktii runs on managed cloud infrastructure with regular automated backups. Clinics do not maintain local servers. Data is hosted in India.

Sub-processors

We use a small number of service providers to run the platform — cloud hosting, WhatsApp/SMS messaging, and (where a clinic enables it) an AI provider for documentation assistance. Each is engaged under contract and receives only the data needed to provide its part of the service. A current list is available on request.

Tenant isolation

Each clinic's data is scoped to that clinic. Records, billing and reporting for one clinic are not visible to another, and staff access is limited to their own clinic (and, in a group, their own branch).

Incident handling

If a security incident affecting personal data occurs, we investigate, contain it, track it against the 72-hour window the DPDP Rules give for reporting a breach to the Data Protection Board, and notify affected clinics and, where required, the relevant authority.

Data-rights requests

A patient can ask to exercise a data right – access, correction, erasure, consent withdrawal or nomination – and Yuktii logs the request with a due date, tracked to the ninety-day ceiling the DPDP Rules set. See DPDP data rights for clinics for what each right means and how erasure is handled.

Shared responsibility

Yuktii secures the platform and infrastructure. Clinics are responsible for managing their own users and roles, keeping credentials safe, and obtaining the patient consents recorded in the platform.

Regulatory context

Yuktii is aligned with the Digital Personal Data Protection (DPDP) Act 2023. ABDMComing soon support, including ABHA linking, is in development. Yuktii does not currently claim HIPAA, ISO or GDPR certification. For the status of any specific compliance requirement, contact us.