Data Security & ABDM
Effective date: 15 October 2026
1. Ayushman Bharat Digital Mission (ABDM)
Aasaanop is not yet ABDM certified. We are integrating with ABDM through its sandbox, in the order NHA defines:
- Milestone 1 (M1): ABHA number creation, capture and verification at patient registration. Today patients can add their ABHA number and address voluntarily; it is shown as unverified until ABDM verification is live.
- Milestone 2 (M2): Health Information Provider (HIP) services to share prescriptions, lab reports and discharge summaries with the patient's ABHA, with consent, as FHIR R4 records.
- Milestone 3 (M3): Health Information User (HIU) services, so doctors can view a patient's history from other facilities with the patient's consent.
Providing an ABHA is always optional; patients without one are registered and treated as usual. Facilities and doctors can record their HFR and HPR registry IDs.
2. Where data is stored
Clinical records, reports and files are stored in India (AWS Mumbai region, through our database provider Supabase).
3. How it is protected
- Encryption in transit (HTTPS/TLS) and at rest (AES-256).
- Role-based access enforced in the database, not just in the screens: each staff role sees only what it needs, and doctors see only their own patients.
- Optional two-step sign-in for staff.
- Short-lived signed links for files.
- Audit logs.
- Hourly encrypted backups with a daily tested restore.
4. Incidents
We report cyber-security incidents to CERT-In within six hours, and notify personal data breaches to the Data Protection Board and affected users as the DPDP Rules require.
5. No sale of data
Aasaanop does not sell, license or broker personal or health data to advertisers, insurers or anyone else.