01
Hosting and data residency
Production, backups and logs run in two AWS regions in India (Mumbai primary, Hyderabad failover) with no replication outside the country. Each clinic’s data is logically isolated by tenant key; Enterprise chains may opt for a dedicated instance. Infrastructure is defined as code, reviewed and versioned; nobody changes production by hand.
02
Encryption
- In transit: TLS 1.2 or higher with modern ciphers, HSTS, certificate pinning in the mobile apps.
- At rest: AES-256 for databases, object storage, backups and logs, with keys in a hardware-backed key management service, rotated annually and on any suspected compromise.
- In use: embryo images and documents are decrypted only for the authenticated session that requests them; no plaintext caches on devices.
03
Access control and authentication
Every staff login is a named person with two-factor authentication (authenticator app or SMS fallback), role-based permissions configured by your admin, session timeouts and device sign-out. Patients authenticate by OTP to their registered mobile. ConceiveX staff have no standing access to clinic data: support access is granted by your account owner per session from the in-app chat, is time-limited, read-only by default, and every action is logged and visible to you.
04
Audit trail and witnessing
Every create, read, update and delete on a patient, cycle, lab or billing record is logged with who, what, when and from where, in an append-only store retained for ten years. In the embryology module, eleven witness points are gated by barcode scan and cannot be bypassed; mismatches stop the step and are recorded. Audit exports are available to clinic admins and format-ready for State Board inspection.
05
Backups and recovery
Point-in-time recovery for the previous 7 days and encrypted daily snapshots retained for 35 days, replicated to the failover region. Recovery objectives: RPO 15 minutes, RTO 4 hours. We run a full restore test every month and a region failover test twice a year, and publish the results in the quarterly security summary available to account owners.
06
Application and infrastructure security
- Secure development lifecycle: code review on every change, dependency scanning, static analysis, secrets scanning, signed releases shipped weekly behind feature flags.
- Web application firewall, DDoS protection, rate limiting on the public API, network segmentation with no public database endpoints.
- Vulnerability management: critical patches within 72 hours, high within 14 days.
- Independent penetration test every year (most recent July 2026, by a CERT-In empanelled firm) plus a continuous bug-bounty programme. Summary letters are available under NDA.
- Endpoint management, disk encryption and phishing-resistant MFA for every ConceiveX employee; background checks and annual security training.
07
Incident response and breach notification
A 7-day on-call rotation, documented runbooks and a named incident commander. If we confirm a personal-data breach affecting your clinic we notify your account owner within 24 hours with what happened, what data, what we have done and what you should do, and we file with CERT-In within six hours and the Data Protection Board as required. Post-incident reviews are published to affected clinics; the public incident history is on the Support page.
08
Compliance and certifications
09
Sub-processors
The third parties that may process clinic or patient data on our behalf. All are contractually bound to equivalent protections; we give 30 days’ notice before adding one.
10
What we ask of your clinic
Security is shared. We ask you to: give each staff member their own login and turn on two-factor for all; review roles when people join or leave; keep clinic devices updated and locked; use the in-app chat, never email or WhatsApp, for anything involving a patient record; and tell us immediately at [email protected] if you suspect a problem. Your admin console shows a security checklist with your clinic’s current score.
11
Reporting a vulnerability
If you find a security issue, write to [email protected]. We acknowledge within one working day, keep you informed, and do not pursue researchers acting in good faith. Please do not access patient data beyond what is needed to demonstrate the issue. Our PGP key and the bug-bounty scope are in the API documentation.
