1. Our approach
The safest health data is data that isn't sitting in a central database. Patient-Tap keeps your record encrypted on your tag and phone, so there is no store of medical records to breach. Everything else is built on least privilege and defence in depth.
2. What protects you
| Layer | Protection |
|---|---|
| The record | AES-256-GCM authenticated encryption on the tag — tampering is detected, not just hidden |
| Transport | HTTPS only, HSTS with preload, TLS terminated by our host |
| Browser | A strict, per-request nonce Content-Security-Policy; frame, MIME-sniffing and referrer protections; and a permissions policy that allows only the camera, only on our origin |
| API | Same-origin checks, JSON-only size-capped bodies, schema validation, honeypots and per-IP rate limits |
| Database | Row-Level Security on every table and no direct table access. Every call goes through audited functions gated by a server-only secret. Hosted in India. |
| Privacy | IP addresses salted and hashed before use; camera frames never leave the browser |
| Supply chain | npm audit on every change, CodeQL static analysis, and Dependabot updates |
3. Reporting a vulnerability
If you find a security issue, please email security@patient-tap.shop (or use the contact form, topic “Security issue”) with:
- a description of the issue and its impact;
- steps to reproduce it, or a proof of concept;
- the affected URL, app version or component.
We'll acknowledge your report within 3 business days and keep you updated until it's fixed. Our machine-readable contact details are in /.well-known/security.txt.
4. Rules of engagement
Please:
- test only against your own accounts, tags and data;
- stop as soon as you have shown the issue, and don't view, keep or change other people's data;
- don't run denial-of-service, spam or social-engineering attacks, and don't test physically;
- give us reasonable time to fix the issue before telling anyone else.
If you follow these rules in good faith, we won't pursue or support legal action against you for your research, and we'll credit you if you'd like.
5. If something goes wrong
If a personal data breach affects you, we will tell you and the Data Protection Board of India as the DPDP Act requires, and report cyber-security incidents to CERT-In under its directions of 28 April 2022.