Security

How we protect your data

Last updated: June 2026

MyHealthX is built with security as a foundation, not an afterthought. Your medical data is protected by multiple layers of security controls including encryption, access controls, audit logging, and monitoring. We continuously work to strengthen our security practices.

🔐

Data Encryption

Field-level encryption (AES-256-GCM)
Sensitive medical data — phone numbers, emergency contacts, allergies, medications, and medical conditions — are encrypted before storage. Even direct database access shows only encrypted values.
HTTPS everywhere
All supported traffic between your device and our servers is encrypted using HTTPS/TLS.
Data protection at rest
Data stored in our infrastructure is protected with encryption at rest as provided by our cloud infrastructure provider.
🛡️

Access Control

Phone-based authentication
Login requires OTP verification sent to your registered phone number via WhatsApp or SMS. No passwords to steal.
Strict data isolation
You can only access your own medical data. Our database rules enforce this at the infrastructure level — not just in the application.
Admin authentication
Administrative access is controlled using Firebase Custom Claims and is limited to authorized accounts. Admin actions are logged and monitored.
Doctor verification
Healthcare providers must register and receive manual admin approval before accessing any patient data.
🚨

Emergency Page Security

4-minute session tokens
When your QR is scanned in an emergency, the session expires after 4 minutes. Bookmarking the page does not work — a fresh scan is always required.
Masked phone numbers
Emergency contacts are shown with masked phone numbers (e.g., 910XXXX66). Full numbers are never exposed in the browser.
Server-side call routing
When someone calls your emergency contact through the scan page, the call routes through our server — the actual phone number never appears in the browser.
Rate limiting
Emergency page access is rate-limited to prevent abuse. Every scan is logged with timestamp and anonymised IP address.
🔍

Upload Security

Virus scanning
Uploaded files are routed through scanning controls where enabled before acceptance. Infected files are rejected.
File type verification
We verify file content at the byte level (magic byte check), not just the file extension. This prevents renamed malware from bypassing filters.
Strict type whitelist
Only JPG, PNG, and PDF files are accepted. All other file types are blocked.
Size limits
Maximum file size is 10 MB per upload.
📊

Monitoring & Alerting

Security monitoring
Suspicious activity such as repeated failed logins, unusual access patterns, and threat detections trigger alerts that our team reviews.
Audit logging
Key events such as logins, profile edits, report uploads, emergency scans, and administrative actions are logged with timestamp and device information for security and accountability.
Automated anomaly detection
Per-IP and per-phone rate limiting automatically blocks brute force attacks on login and OTP verification.
🌐

Infrastructure Security

Data residency
Our primary Firebase infrastructure is configured in the Mumbai, India (asia-south1) region. Some service providers may process limited operational metadata according to their service terms.
Security headers
Our platform uses security headers including HSTS, Content Security Policy, and X-Frame-Options to help prevent common web attacks.
No advertiser or analytics sharing
Your medical data is never sold or shared with advertisers or analytics providers. Service-delivery providers (such as payment, communication, and infrastructure) receive only the minimum data necessary for their function under appropriate agreements. See our Privacy Policy for details.
Webhook verification
All incoming webhooks are verified using HMAC-SHA256 signatures to prevent tampering.
📋

Compliance

DPDPA 2023
We comply with India's Digital Personal Data Protection Act, 2023. You have the right to access, correct, and delete your data at any time.
Consent-based processing
We collect your data only with explicit, informed consent. You can withdraw consent at any time through your dashboard.
Right to erasure
You can delete your account and all associated data. Deletion is processed within 30 days, with a recovery window if you change your mind.
Breach notification
In the event of a reportable cyber security incident, we will report to CERT-In within the timeline prescribed under applicable directions (currently within 6 hours of being notified), and notify affected users as required under applicable law including the DPDPA 2023.

Responsible Disclosure

If you discover a security vulnerability in our platform, please report it responsibly to security@myhealthx.co.in. We take every report seriously and will respond within 48 hours. Please do not publicly disclose vulnerabilities before we have had an opportunity to address them.

Questions about our security practices?

support@myhealthx.co.in

MyHealthX Private Limited — The Next-Gen Care.