Patient data, handled the way a lab would want
A lab information system holds some of the most sensitive data there is. This page explains, in plain terms, how the platform protects it and where the responsibilities sit. Every claim here describes how the product works today, not a plan.
Where your data lives
Indian labs answer to Indian law. The platform is hosted in India on managed cloud infrastructure.
- Hosted in India
- Application, database and stored reports run in India. Patient data is not transferred abroad to run the service.
- Encrypted in transit
- Every connection to the app and its database is encrypted with TLS, and reports and files are served over HTTPS only.
- Managed infrastructure
- Databases and storage are managed services with automated backups, so a lost laptop or a failed disk is never a lost record.
One lab cannot see another
Every lab on the platform is kept apart from every other. The separation is enforced by the application on every action, not left to a filter someone might forget.
- Each lab’s data kept apart
- The lab a user belongs to is fixed when they sign in, never taken from anything the browser sends. Every record is read and written within that lab only.
- Validated references
- When a screen refers to another record, such as a branch, a test or a template, the platform checks it belongs to the same lab before it is used.
- Report links that cannot be guessed
- Verification links use long random codes that cannot be guessed, and show only what a verifier needs to see.
Every action is tied to the lab of the signed-in account.
Nothing the browser sends can change which lab’s data is shown.
Who can do what
Reception should not release reports and a technician should not change prices. Access is permission-based and checked on the server.
- Roles with fixed ceilings
- Owner, admin, pathologist, technician, reception and more. Each role carries a fixed set of permissions, and no one can grant a role above their own.
- Immediate revocation
- Deactivate a user, change their role or reset a password, and their existing sessions stop working within seconds.
- Rate limiting
- Sign-in, password reset and other sensitive actions are rate-limited, so password guessing is slowed to a crawl.
The permission set each role carries.
The permission is checked before anything is read or changed.
Deactivating someone or changing their role ends their open sessions.
A record of every change
The audit trail is what makes a result defensible. It is written by the platform, not by the user, and it cannot be edited.
- Results and reports
- Entry, verification, release, amendment, print and delivery are logged with the user and the time. A released result is snapshotted so later edits are visible as amendments.
- Logins and settings
- Sign-ins, role changes and configuration edits are logged too, and the log is readable from the settings screen.
- DPDP-ready records
- The Digital Personal Data Protection Act 2023 expects purpose limitation, access control and accountability. The audit trail, the role model and hosting in India are designed to support your obligations as a data fiduciary. Nothing here is certified, and compliance stays your lab’s responsibility; the platform gives you the records to meet it.
What is written, and by whom, for every logged action.
Your data is yours
Nothing is locked in, and the pages your patients see keep working.
- Export from your lists
- Patients, orders, samples, results, reports and invoices download as CSV from their list screens, filters and visible columns included.
- Readable forever
- Downgrading, cancelling or a trial ending never deletes records. Your lab keeps read access to its full history either way.
- Verification stays up
- QR verification pages for released reports keep working as long as the lab exists on the platform, so an old report can still be checked.
What a stranger with the link sees
The report QR proves the page came from your lab: report number, issuing laboratory, status and dates. Your lab can require a date of birth or a patient code before any identifying detail appears, and the results themselves are never shown here.
The lab chooses whether a date of birth or patient code is asked for before the patient’s name appears.
What the bill QR shows
The tracking page answers one question, whether the work is done, with the patient name masked and no values on it. It saves the phone call without putting a medical result behind a guessable link.
A tracking link opens only the order it was printed for, with the patient’s name masked.
Set up your lab this afternoon.
Create your organisation, add your tests, print the first barcode. If you would rather see it first, ask for a walkthrough.