Security
Read the controls, then read the gaps.
What is in place today, product by product, and where our limits are. If you are evaluating us for something that matters, send this page to whoever asks the hard questions.
Controls
What is in place today.
Each control is named against the product it is true of. Where a property holds for one product and not another, this page says which.
In the applications
- Multi-tenant data is scoped to the organisation and fails closed: a query without a tenant context returns nothing, and automated tests assert it on every change.
- Clinitricks encrypts patient identifiers and clinical records with AES-256 and a blind index for search, and keeps an append-only, SHA-256 hash-chained audit log.
- Consent is versioned and typed: four consent categories with dated, revocable records.
- Role-based access control with custom roles, TOTP two-factor authentication, idle and absolute session timeouts, and a device limit per account.
- Rate limits on login, password reset and API endpoints; CSRF protection on every state-changing form.
On the platform
- Cloudflare in front of the public site: TLS, security headers and rate limiting on the endpoints that accept input.
- Cloudflare Turnstile on lead, application and assistant entry points, with a honeypot field and server-side rate limiting behind it.
- Approval-gated production deploys, with a database dump taken before every migration and a secret scan running in CI.
- Uptime monitoring across our own properties, with email alerts to the operations inbox.
Under DPDP
- Itemised notice and unticked, affirmative consent on every form and on the site assistant; consent records are stored with who, what, when and which version.
- Published routes to access, correct, erase or nominate — with a ticket ID for each request.
- A named Grievance Officer with published acknowledgement and resolution timelines.
- Access logs retained for one year; personal data erased when the purpose it was collected for is served.
- Breach handling: affected people informed without delay and the Data Protection Board notified, with a detailed report inside 72 hours.
Limits
Where our limits are.
The three below are about the company. The list under them is about the software, and it is the one an evaluator usually wants.
- We do not hold ISO 27001 or SOC 2 certification, and we do not display badges for either.
- We are not a certified data-security auditor and do not issue compliance attestations to customers.
- Products are described as “designed for” DPDP obligations, never as “certified” under them.
What the products do not do
- Is there WhatsApp or SMS automation?
- No. Every product shares documents and reminders through wa.me deep links, which a person sends. There is no WhatsApp Business API automation and no SMS gateway in any product.
- Do you integrate with ABDM or ABHA?
- No. Clinitricks stores a health ID as free text. There is no registry integration behind it.
- Do you file GST returns, e-invoices or e-way bills?
- No. Clinitricks and Biztricks produce correct GST documents — Tax Invoice or Bill of Supply, CGST and SGST or IGST by place of supply — and registers you can export. Filing, e-invoicing, e-way bills and Tally sync are not in the products.
- Are there native mobile apps?
- No, and that is deliberate. The flagship products are progressive web apps that install to the home screen from the browser, so a fix reaches every user the day it ships.
- Is customer data encrypted at rest in every product?
- No. Clinitricks encrypts patient identifiers and clinical records at rest, with a blind index for search. HamaraPG does not encrypt personal data at rest today and does not offer two-factor authentication; organisation scoping, hashed OTP authentication and audited access apply there instead.
- Does an AI model see or change our data?
- Only in HamaraPG, and only to read. The owner copilot picks one of eight hand-written, organisation-scoped queries; it never writes SQL and never writes data, and every turn is audited and capped. The Smart Insights cards in Biztricks are a rule-based engine and are not AI.
Statutory
Who to write to, and by when we answer.
Vedatricks Technologies Private Limited has appointed a Grievance Officer under the IT Rules 2021, the Consumer Protection (E-Commerce) Rules 2020 and the DPDP Act 2023. The full block, with the statutory response times, opens here.
Grievance Officer — name, contact and response times
Vedatricks Technologies Private Limited has appointed a Grievance Officer who receives complaints about this website, our products, your personal data and anything published or transmitted through our services.
- Name
- Pooja D
- Designation
- Director
- hello@vedatricks.com
- Phone
- +91 88578 60930
- Postal address
- Vedatricks Technologies Private Limited, SMC, Thalaghattapura, Bengaluru, Karnataka 560109, India
- Office hours
- Mon–Sat, 10:00–19:00 IST
- Content and platform complaints (IT Rules 2021): Acknowledged within 24 hours, resolved within 15 days.
- Consumer complaints (E-Commerce Rules 2020): Acknowledged within 48 hours, resolved within 1 month.
- Personal-data requests and grievances (DPDP Act 2023): Data-principal requests resolved within 90 days (target 30).
The quickest route for a personal-data request is the form at /privacy/requests/, which issues a ticket ID you can quote in any follow-up.
If you are not satisfied with how we handled your complaint, you may complain to the Data Protection Board of India under section 13(3) of the Digital Personal Data Protection Act 2023. Please raise the matter with us first — the Board expects you to have exhausted our grievance process.
Reporting
Found something? Tell us.
Report a vulnerability in good faith and we will not pursue action against you. Scope, safe harbour and expected timelines are on the disclosure page.
- Vulnerability reports
- Machine-readable policy
- Privacy and data requests
- Grievance Officer
- Response times