We run and secure the platform; you control who on your team can sign in and what they can see. This page describes both sides honestly, including where our practices are simple rather than certified — we are a young product and we would rather be accurate than impressive.
1. Our approach
ClinicDesk stores clinic records, patient details, appointments and revenue figures. We treat that data as confidential medical-adjacent information and apply a small set of proven controls consistently: encrypt everything in transit, encrypt what we store, restrict who can reach it, keep backups, log access, and tell you when something goes wrong.
2. Encryption in transit
All traffic between your browser (or your patients' phones) and ClinicDesk travels over HTTPS using TLS. Connections without TLS are refused. This covers the dashboard, the public booking pages, and API calls.
3. Encryption at rest
Data is encrypted at rest using industry-standard encryption provided by our database and storage platform. Backups inherit the same protection. We never store full card numbers — payments are handled by our payment processor.
4. Access control inside the product
- Role-based permissions. You decide which staff members can view patients, manage appointments, see revenue, or change settings.
- Separate logins. Each staff member signs in with their own account — never a shared password.
- You can revoke access instantly. Removing a staff member from your clinic cuts their access immediately.
5. Access control on our side
Our own staff cannot casually browse customer data. Access to production systems requires individual accounts with multi-factor authentication, is limited to the people who need it to support you, follows least-privilege rules, and is logged.
6. Authentication and sessions
- Passwords are stored securely hashed — never in plain text.
- Sessions expire, and signing out ends the session on the server.
- We recommend every clinic uses a unique password and changes it if a device is lost.
7. Backups
Backups are taken daily and retained on a rolling schedule. They exist to recover from accidental deletion, corruption or a service failure. For your own copies, use the data export in your dashboard; after you cancel, your data stays exportable for 30 days.
8. Monitoring and incident response
- We monitor service logs for unusual activity such as repeated failed logins and unexpected access patterns.
- If a security incident affects your data, we will notify you and the relevant authority as required by law, and we will tell you what we know and what we are doing about it.
- Incidents are documented, and we fix the cause — not just the symptom.
9. Payments
Subscription payments are processed by a PCI-DSS compliant payment provider. Card details are entered on their systems; ClinicDesk receives only confirmation of the transaction. We do not see or keep your card number.
10. Infrastructure
ClinicDesk runs on established cloud infrastructure, as described in our Privacy Policy.
11. Reporting a vulnerability
If you find a security issue in ClinicDesk, email security@clinidesk.in with details and steps to reproduce it. Please give us a reasonable time to investigate and fix it before publishing.