Security

Patient records are the most sensitive files most people will ever have. Here is precisely how we handle them — and where the responsibility is yours rather than ours.

Last updated: August 2026

Where your data lives

MolarPlus and SyrupDesk run as hosted applications. Your practice's data sits in our managed database rather than on the computer at your front desk, which is what lets the web, mobile and desktop apps show the same record to different people at the same time.

The desktop apps hold a local working copy so billing and record-keeping survive an internet outage, and reconcile with the server once you are back online.

Access control

Within a practice, you control who sees what:

Create accounts with different permission levels for owners, doctors and staff
Control who can view, edit or delete patient records
Review user activity through audit logs
Remove a user’s access immediately when they leave

Regulatory position

We build against India's Digital Personal Data Protection Act, 2023, which is the law that governs patient data held by an Indian practice, alongside the IT (Reasonable Security Practices) Rules, 2011.

We do not claim HIPAA compliance or ISO 27001 certification. HIPAA is United States legislation and does not govern an Indian clinic; ISO 27001 is a certification held after an external audit, and we will say so here when we hold one rather than before.

What remains your responsibility

We secure the platform. The practice secures its own use of it — and in practice this is where most real incidents begin:

Use strong, unique passwords and do not share logins between staff
Remove accounts for staff who have left
Keep desktop apps and the operating systems they run on updated
Restrict physical access to computers left logged in at the counter
Keep your own exported backups if your retention obligations require them

Reporting a vulnerability

If you find a security issue, tell us before you tell anyone else and we will work it promptly. Email security@clinohealth.app or call +91 87667 42410. We do not take legal action against researchers who report in good faith and give us reasonable time to fix the issue.

See the privacy policy for what we collect and why, and how we build for the engineering decisions underneath all of this.

The controls, in short

Tenant isolation

Every clinic, laboratory and store is a separate tenant. Queries are scoped to the practice that owns the record, so one practice cannot reach another practice’s data.

Role-based access control

Owners, doctors, technicians and front-desk staff hold different permissions. You decide who can view, edit or delete a record, and you can revoke access immediately.

Encryption in transit and at rest

All traffic between your device and our servers runs over TLS. Stored data is encrypted at rest using industry-standard algorithms.

Audit logging

Record access and changes are logged with the user and timestamp, so there is a trail to inspect if a question is ever raised.

Offline resilience

The desktop apps keep working through an internet outage and sync when the connection returns. A dropped line stops the sync, not the clinic.

Regular security updates

Fixes ship to the hosted apps continuously and to the desktop apps as updates. Keeping the desktop app current is the one part that needs you.