Data & privacy
Your patients’ data, handled like it matters.
Clinic software asks a doctor to hand over the most sensitive records they hold. This page says exactly what happens to them.
Six decisions, made before the first patient.
Patient health data is personal data under India's DPDP Act, 2023, and we handle it with strict access controls.
Aadhaar is never stored
OPDesk has no Aadhaar field and never asks for one. Please do not type Aadhaar numbers into notes.
One clinic cannot read another
Every row carries its clinic, and the filter is injected by the data layer rather than typed into each query by hand. A query that forgets its clinic returns nothing rather than someone else’s patient. The failure mode is empty. It is checked with deliberate cross-clinic attack tests.
Patient data stays out of the logs
Request and response bodies are never written to logs. Error logs record the request path, time and IP address, not patient details.
Identity and clinical records sit apart
Who the patient is and what happened in the consultation are separate tables, so access to one does not hand you the other.
Logins are hardened, not just password-checked
Passwords are stored with argon2, sessions ride in a cookie JavaScript cannot read, and login attempts are rate-limited. A disabled staff account can no longer sign in.
A copy of your records, on request
Write to hello@myopdesk.com and we will arrange a copy of your records. There is no fee for asking.
The part most vendors leave off the page.
Security claims are worth what their disclosure is worth. So, plainly:
- No independent security audit yet. The tenant-isolation and DPDP review is a planned, scheduled piece of work, and it will be done by a human reviewer rather than self-certified. Until that has happened, this page will keep saying so.
- No formal certification. There is no ISO 27001 or SOC 2 report, and any vendor of this size claiming one deserves a second look.
- No live ABDM connection. ABHA fields exist on the patient record. Nothing is sent to ABDM today.
- Where it is hosted. Hostinger hosts this website and the clinic app. Supabase hosts the clinic database in Mumbai, India.
What you can ask for, and how fast.
| You want to | How | Cost |
|---|---|---|
| Get a copy of your clinic history | Write to us | Free |
| Correct a patient’s details | Write to us | Free |
| Delete your clinic and everything in it | Write to us | Free |
| Keep using your data after you leave | It is already yours | Free |
The full legal text is in the privacy policy. This page is the plain-language version, and if the two ever disagree, tell us. That is a bug.