Trust
Security & data protection
Last updated: 2026-10-21
Health records are sensitive. This page lists the protections that are built into Vitalix today, and says plainly what is not claimed.
Sign-in required everywhere
Every patient screen and every data request requires a signed-in staff account. Anything not explicitly public is private by default.
Role-based access
Admin, doctor, camp lead and technician roles each see only the screens and actions they need. Permissions are enforced on the server, not just hidden in the interface.
Passwords protected
Passwords are stored only as salted scrypt hashes, never in readable form. New staff receive a one-time password and must choose their own at first sign-in. Repeated wrong attempts temporarily lock the account.
Safe sessions
Sessions use signed, HTTP-only cookies that browsers will not hand to page scripts. The browser signs staff out after 30 minutes of inactivity, sessions expire after 12 hours (30 days with “remember me”), and a password change or role change signs the person out on other devices.
Activity log
Sign-ins, record changes, report downloads and report sends are recorded with who did them and when, so an administrator can review access.
Private report links
Reports sent on WhatsApp use signed links that cannot be guessed or edited, expire after a set time, and are not indexed by search engines.
Browser protections
The site sends security headers (content security policy, clickjacking protection, strict transport security in production) and blocks cross-site form submissions.
Honest data handling
The platform never invents clinical values. Anything not recorded is shown as not recorded.
Where data is kept
Records are held in a managed PostgreSQL database hosted in Mumbai, India. Uploaded reports and machine files are kept in private object storage that is not publicly listed, and each centre can only reach its own records.
What we do not claim
- Vitalix does not currently hold third-party security certifications such as ISO 27001 or SOC 2.
- Two-factor sign-in is not yet available.
- Data-at-rest encryption depends on how and where a centre hosts the platform; ask us about your deployment.
For diagnostic centres
- Create accounts only for people who need them, and disable accounts when staff leave.
- Use the doctor role for sign-off and keep the admin role to as few people as possible.
- Obtain and record consent before examining and before sending reports on WhatsApp.
Report a vulnerability
If you find a security problem, please tell us privately via the Contact page before sharing it publicly. We will acknowledge your report and keep you informed.
See also the Privacy Notice and Terms of Use.