Patient Data Security
Enterprise-grade safeguards protecting outpatient serial numbers and clinic records.
Security Overview: Built for Patient Confidentiality
BookMySerial is built with defense-in-depth security principles. We protect everyday OPD queue operations with modern web security, strict role-based access, and Indian data sovereignty.
- 🔒Industry-standard encryption
- ⚖️DPDP 2023 aligned practices
- 🌐TLS encrypted communication
- 👥Role-based access control
🏛1. Security Architecture
Our multi-layered architecture separates public discovery from private queue management.
- Doctor search and clinic discovery are delivered as fast, cacheable web pages.
- Real-time counter counters and queue updates run on protected, authenticated API endpoints.
- Database partitions ensure one clinic cannot query or access records from another clinic.
🔒2. Encryption
Your data is protected in transit across the internet and at rest on secure servers.
- In Transit: All web traffic is encrypted using modern TLS (HTTPS) to prevent Wi-Fi eavesdropping.
- At Rest: Booking records and transaction references are stored using industry-standard disk encryption.
- Zero Plaintext Passwords: We do not store static user passwords that could be leaked or stolen.
📱3. Secure Login
Patients access bookings with time-limited mobile verification codes.
- Login requires a 6-digit one-time password (OTP) sent directly to your phone.
- OTPs expire after 5 minutes and cannot be reused or guessed.
- Authenticated sessions are remembered safely on your personal device using secure tokens.
👥4. Role-Based Access
Every user is restricted strictly to the minimum information required for their operational role.
| Role | Can View |
|---|---|
| Patient | Own bookings & live token status only |
| Doctor | Assigned patients for their active chamber session |
| Receptionist | Today's queue list for their specific clinic only |
| Sales Agent | No patient data (clinic onboarding metrics only) |
| Admin | Authorized platform operations with strict audit logging |
📝5. Audit Logs
Critical system actions are logged with immutable audit records to prevent unauthorized tampering.
- Every token reservation, queue call, and cancellation is logged with timestamp.
- Reception desk actions are recorded to resolve any token disputes fairly.
- System logs are protected against modification and archived for regulatory review.
🇮🇳6. Indian Data Residency
All user data, production databases, and backups reside within Indian borders.
- Primary databases and servers are hosted in secure data centers in India.
- Automated encrypted backups are maintained on domestic storage infrastructure.
- Fully aligned with Indian data localization guidelines under the DPDP Act 2023.
🚨7. Incident Response
We maintain structured protocols to identify, contain, and resolve potential security issues.
- Continuous monitoring detects unusual traffic patterns or brute-force attempts.
- Automated rate-limiting protects against malicious token reservation floods.
- In the event of a security incident, affected users and relevant authorities are notified promptly.
🔍8. Responsible Disclosure
We welcome ethical security researchers to help us keep BookMySerial safe.
If you discover a potential vulnerability, please report it responsibly:
Security Contact: support@bookmyserial.in
Guidelines: Please do not access or tamper with other users' accounts. Provide reasonable time for remediation before public disclosure.
Response Time: Our technical team acknowledges legitimate vulnerability reports within 24 hours.