Security and privacy

Prescriptions are medical records. This page explains, without jargon, how they are protected.

#Your account

• Passwords are never stored. Only a one-way scrypt hash is kept, using the strength OWASP recommends. Nobody, including us, can read your password.
• Email code on new devices. When email is set up, signing in from a browser we have not seen asks for a 6-digit code sent to your email. You can choose to trust that device for 60 days.
• Two-step sign-in, if you want it. Turn it on in Settings → Security and every sign-in, on every device, also asks for a code from an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, 1Password and similar). It takes the place of the email code, a password reset by email does not skip it, and ten one-time recovery codes cover a lost phone. Someone who learns your password, or gets into your email, still cannot sign in.
• Common passwords are refused. New passwords must be 10 characters or more, and the thousands of long passwords seen most often in data breaches are turned down.
• Guessing is throttled. Repeated wrong passwords or codes for an account, or from one network, are slowed down and then blocked for a while.
• See and end your sessions. Settings → Security lists every device signed in to your account. Sign any of them out, or all of them at once. Changing your password signs out every other device.

#Your patients' records

• Only you see them. Every patient and prescription belongs to one doctor's account, and every request is checked against the signed-in account. Administrators of the service manage accounts and plans; the admin console has no screen for reading doctors' patients or prescriptions. Opening it needs a code from an authenticator app as well as a password, and what administrators look at is recorded.
• Signed prescriptions cannot be altered. Once signed, a prescription is locked and fingerprinted. A correction is signed as a new version under the same number, with the reason, and every earlier version stays on record as it was signed, with its own fingerprint; or the prescription is voided with a reason, which stays on record.
• The verification QR reveals little. A pharmacist who scans it sees the prescription number, date, doctor and registration number as signed, the patient's initials, and whether it was voided or replaced by a newer version. The medicines with their doses and instructions show only while the prescription is in use: until its last valid day, or 30 days after signing when it has none, and never once voided. Never the patient's full name, contact details or notes.
• Who opened what is recorded. When a patient's record, a signed prescription, a document or a bill is opened or downloaded, by you or your front desk, the log notes who, which and when, never what it holds (the same person opening the same record again within half an hour may be noted once). Your front desk's openings are in Front desk → Review.
• Your mobile numbers are off the print by default. Turn them on per pad only if you want them.

#Video calls and live chat

• Device to device. Video, sound, chat messages and files go directly between your browser and your patient's, encrypted end to end. They never pass through our servers, and we do not record calls.
• We do not listen in. Our server only passes a few small setup messages between the two browsers, and those are sealed with a key that is part of the link you send. Without the key, the server can neither read them nor slip itself into the middle of the call. The key sits in a part of the link that browsers never send to us. If you use Send to patient, RxKite needs the whole link to send it, so the key passes through our server once, on its way to the email or WhatsApp message, and is never stored or logged.
• Links that run out. The patient's link carries a long random code, stored by us only as a one-way hash. It stops working when you end the call, and after 3 hours at most.
• No relay, by design. A relay server would carry the video, so there is none. On a few very strict networks a call therefore cannot connect, and the call screen suggests trying another network.
• Chats are kept only if you choose. When you end a chat you either save it to the patient's record or destroy it, and you pick which attachments to keep as the patient's documents.

#In transit and in the browser

• All traffic uses HTTPS, and browsers are told to insist on it (HSTS).
• Every page is served with a strict Content Security Policy that allows only our own scripts, which blocks most cross-site scripting attacks. Visitor statistics and the Google tools described in our privacy policy run on the public pages only, never inside the app; Google's never run while you are signed in.
• Requests that change anything must come from our own pages; forged requests from other sites are rejected.
• Session cookies are HTTP-only and secure, so page scripts cannot read them.

#Backups

• The database and every uploaded file are backed up every night to a separate storage location from the one the app uses.
• Backups are encrypted (AES-256 with an HMAC check) with a key that is not stored with them.
• The last few nightly backups are kept, and none older than 90 days apart from the newest, so deleted records leave the backups within about three months. Every backup is checked for each stored file its records point to, and restores are tested with the same tools used in an emergency.
• A patient you erase stays erased: if an older backup is ever restored, the erasure is applied again.

#Signed prescriptions are locked

• The PDF copy of every prescription you sign, and of every version of one you edit, is kept in storage that refuses any change or deletion for at least 10 years from signing, so the record you signed stays exactly as you signed it.
• Your letterheads, signatures and patients' documents are kept apart from these copies, so they can still be replaced and deleted as usual.

#Your control

• Export everything, patients, prescriptions and their PDFs, from Settings → Your data whenever you want.
• Delete your account from the same page. Deletion happens after 30 days, so an accident can be undone; after that, your records are removed from the live database, and they age out of backups as those are rotated. The locked copies of signed prescriptions stay until their lock ends, and can no longer be opened in RxKite.
• An audit log records sign-ins, failed attempts, important actions such as signing, voiding and exporting, and which records were opened. It is kept for at least a year and cannot be cleared sooner, as CERT-In's directions and the DPDP Rules ask.

#If something goes wrong

• We keep an incident plan: who acts, what evidence is kept, and the reports that go to CERT-In within 6 hours and, for a personal data breach, to the Data Protection Board and the people affected.
• If your patients' data is affected, we email you at once, with what happened, what it may mean, what was done and what your patients can do, and give you a ready notice to send them.

#Reporting a problem

If you believe you have found a security issue, email support@rxkite.com with the details, or getrxkite@gmail.com if that address does not reach us. Please do not access other people's data or disrupt the service while testing. We reply to every report.

We do not run a bug bounty programme, so we do not pay for reports. The same contacts are in our security.txt.