Security and privacy

Prescriptions are medical records. This page explains, without jargon, how they are protected. If you run your own RxKite server, the same protections apply and the data never leaves your infrastructure.

#Your account

• Passwords are never stored. Only a one-way scrypt hash is kept, using the strength OWASP recommends. Nobody, including us, can read your password.
• Email code on new devices. When email is set up, signing in from a browser we have not seen asks for a 6-digit code sent to your email. You can choose to trust that device for 60 days.
• Guessing is throttled. Repeated wrong passwords or codes for an account, or from one network, are slowed down and then blocked for a while.
• See and end your sessions. Settings → Security lists every device signed in to your account. Sign any of them out, or all of them at once. Changing your password signs out every other device.

#Your patients' records

• Only you see them. Every patient and prescription belongs to one doctor's account, and every request is checked against the signed-in account. Administrators of the service manage accounts and plans; the admin console has no screen for reading doctors' patients or prescriptions.
• Signed prescriptions cannot be altered. Once signed, a prescription is locked and fingerprinted. Mistakes are corrected by voiding it with a reason, which stays on record.
• The verification QR reveals little. A pharmacist who scans it sees the prescription number, date, doctor, registration number, the patient's initials and the medicines, and whether it was voided. Never the patient's full name, contact details or notes.
• Your mobile numbers are off the print by default. Turn them on per pad only if you want them.

#In transit and in the browser

• All traffic uses HTTPS, and browsers are told to insist on it (HSTS).
• Every page is served with a strict Content Security Policy that allows only our own scripts, which blocks most cross-site scripting attacks.
• Requests that change anything must come from our own pages; forged requests from other sites are rejected.
• Session cookies are HTTP-only and secure, so page scripts cannot read them.

#Backups

• The database and every uploaded file are backed up every night to a separate storage location from the one the app uses.
• Backups are encrypted (AES-256 with an HMAC check) with a key that is not stored with them.
• Several generations are kept: the last few days, weeks and months. Restores are tested with the same tools used in an emergency.

#Your control

• Export everything, patients, prescriptions and their PDFs, from Settings → Your data whenever you want.
• Delete your account from the same page. Deletion happens after 30 days, so an accident can be undone; after that, your records are removed from the live database, and they age out of backups as those are rotated.
• An audit log records sign-ins, failed attempts and important actions such as signing, voiding and exporting.

#Reporting a problem

If you believe you have found a security issue, email support@rxkite.com with the details. Please do not access other people's data or disrupt the service while testing. We reply to every report.