Security & Privacy
Patient trust begins with responsible technology.
Here is how we approach security, privacy and AI in Arogyam Rx — and, just as importantly, what we do not claim.
Our principles
- Patient information belongs to the practice and is used to deliver care and run the practice — never for advertising.
- Access should be deliberate: each person signs in as themselves and sees what their role needs.
- AI output is always labelled, sourced where supported, and reviewed by a clinician before it is relied on.
- We tell you plainly what we have and haven’t done — including certifications we do not yet hold.
Access control and permissions
Every user of the Arogyam Rx clinical application has an individual account. Practices assign roles — for example doctor, reception or administrator — and each role determines what that person can view and change. Administrators add and remove users as teams change, and reset passwords in the app.
Audit trail
An audit log records logins, clinical actions, report views and prescription signatures, so a practice can see who did what, and when.
Patient data protection and handling
Arogyam Rx stores the information a practice records — patient details, visits, prescriptions, notes and uploaded documents — so that the treating team can use it. We do not sell patient data or use it for marketing. The pilot is set up to store patient records and uploaded files in Google Cloud’s Mumbai region, so they stay in India. AI-assisted summaries are generated by Google’s Gemini models, called from our servers. Our detailed documentation on hosting, encryption, backups, retention and AI data processing is shared with practices during evaluation.
Responsible AI
Arogyam Intelligence produces AI-assisted summaries of information already in the record. These summaries are drafts: they may be incomplete or wrong, they are labelled as AI-assisted, and they are kept separate from clinician-authored notes. Nothing generated by AI is saved to the record without the doctor’s review. Arogyam Rx does not diagnose, prescribe or replace a doctor’s judgement.
Certifications and compliance
If your organisation has specific regulatory or contractual requirements, raise them early in the conversation and we’ll respond in writing.
This website
The forms on arogyamrx.com collect only professional contact details to respond to enquiries. They do not ask for, and should not be used to send, patient health information. Submissions are validated on our server, protected against automated spam, and handled as described in our Privacy Policy.
Questions we encourage you to ask
- Where is patient data hosted, and in which country?
- How is data encrypted in transit and at rest?
- How are backups taken, and how would data be restored?
- How can our practice export its data, and what happens if we stop using Arogyam Rx?
- What happens to data sent to AI services, and is it used to train models?
- How are user accounts removed when staff leave?
We’ll answer each of these during your evaluation.
Reporting a security concern
If you believe you’ve found a security issue, please email sales@arogyamrx.com with the subject “Security concern”. Please don’t include patient information in your message.