Security & Compliance

• Health and personal data is encrypted at rest using AES-256-GCM.
• All traffic between your device and our services is encrypted with TLS.
• Credentials are stored hashed, never in plain text.
• Backups are encrypted and access to them is restricted and logged.

• Role-based access control across every module — a receptionist does not see what a consultant sees.
• Individual accounts, so audit trails attribute actions to a person rather than a shared login.
• Full audit logging of record access, edits and exports.
• In Medler Health, family sharing is PIN-protected and every access is recorded in a log the account holder can review.

• ABDM / ABHA — ABHA creation and linking, Health Facility Registry, Healthcare Professional Registry, and ABDM consent flows.
• FHIR R4 — implemented against the profiles published by NRCES, so records are portable rather than locked in.
• DPDP Act 2023 — our processing, consent and grievance handling are aligned with the Act. See the privacy policy.
• NABH — Medler HMS includes an accreditation toolkit to help facilities assemble the evidence NABH assessment requires.
• Telemedicine — tele-prescription workflows follow NHA telemedicine practice guidelines.

Our AI features are clinical decision support. They surface information and draft documentation; the clinician reviews, edits and takes responsibility for what is saved and acted upon. We do not present AI output as an independent diagnosis, and we do not automate clinical decisions.

MedScribe operates consent-first and does not retain consultation audio. The transcript becomes a draft SOAP note that the doctor must review before it enters the record.

If you believe you have found a security vulnerability in any Medler product, please tell us before telling anyone else. Email contact@medler.ai with “Security” in the subject line and include enough detail to reproduce the issue.

We will acknowledge your report, keep you updated while we investigate, and we will not pursue action against researchers who report in good faith, avoid accessing or altering other people’s data, and give us reasonable time to fix the issue.

We monitor for unusual access and maintain an incident process covering containment, investigation, remediation and notification. Where a breach is likely to cause harm, we notify affected users and the relevant authorities as required under the DPDP Act.

No system is unhackable, and any vendor who tells you otherwise is selling something. What we commit to is defence in depth, honest disclosure, and fixing problems quickly when they are found.