
<p><strong>Hospital data in CareLite is separated per hospital, reachable only through role-based access, recorded in an insert-only audit trail, and backed up daily. Integration credentials are encrypted. The application database user cannot alter the schema.</strong></p>

<h2>Separation between hospitals</h2>
<p>Every record carries the hospital it belongs to, and every query filters on it. There is no shared table through which one hospital could read another's patients, bills or reports. A user's session is bound to one hospital.</p>

<h2>Access control</h2>
<p>Individual logins, permissions by role, and server-side checks on every screen rather than hidden buttons. Sessions expire on inactivity. Accounts lock after repeated failed attempts. Deactivating a user takes effect on their next action, not at their next sign-in.</p>

<h2>Encryption</h2>
<p>WhatsApp, email and ABDM credentials are stored encrypted with authenticated encryption, keyed from an application key held outside the database. Passwords are hashed, never stored or recoverable. Secrets and one-time passwords are masked before anything is written to a log — a compliance log is still a log.</p>

<h2>Traceability</h2>
<p>The audit trail is insert-only and covers creation, modification, cancellation, discount, refund, export, printing, sign-in and denied access, each with the before and after values. No screen in the hospital application can alter it.</p>

<h2>Backups</h2>
<p>A daily database backup runs on a schedule, is pruned on a retention window, and can be verified by actually restoring it into a scratch database and comparing rather than assuming the dump succeeded. Backups are meant to be copied off the server: a backup living on the machine it protects is not a backup. A failed backup raises an alert inside the application.</p>

<h2>Where responsibility sits</h2>
<p>CareLite provides the application controls above. Server hardening, network security, HTTPS certificates, physical access and the hospital's own password discipline sit with whoever operates the deployment. Where CareLite hosts, those are ours; where a hospital hosts on its own infrastructure, they are the hospital's. This is worth settling in writing before go-live rather than after an incident.</p>
