Security and privacy

What a patient tells you stays with you

What a patient tells you, they tell you — not a software company. Nirnoy Rx is built that way: your whole practice is one encrypted file on your own computer, and it is not a file we can open.

AES-256, on your machine

The whole database is encrypted with SQLCipher. Somebody who copies the file away still cannot read a line of it.

The key, held two ways

Once by the machine’s own protection, so you are not typing a password every morning; once by your recovery passphrase, so a new machine can get it back.

Nothing of yours on our servers

Not even a patient’s name reaches us. There is no cloud account, no login, nothing syncing.

How the key is held

Wrapped twice, for two different reasons

The database’s real key is thirty-two random bytes made by the machine — nothing anyone could guess. It is then wrapped twice. Once by Windows’ or macOS’ own key store, so the app can open it on your machine without asking you for anything. Once by a key derived from your recovery passphrase with scrypt, so a backup can be opened on a different machine.

No password every morning — which is what a chamber needs
A backup carries only the second wrapping, so it is useless without the passphrase
You can change the passphrase; older backups still open with the older one

What leaves the chamber

Online serials send the least that will work

The chamber’s computer holds a line open to a relay, and the outside world may ask for six addresses and no others — the board, one patient’s own place in the queue, and the booking page. Anything else is refused by your machine, not by the relay. Which means that even a relay in the wrong hands cannot ask for a patient list.

No prescription, diagnosis or medicine ever passes through the relay
The relay is off until you switch it on, and it dies with the app
The chamber needs no fixed address and no open port

Backup

The copy is shut just as tight

A backup is one file — keep it on a pen drive or in your own Google Drive. Even in Drive, Google cannot see what is inside it, because the file is shut with your passphrase. The permission we ask for is narrow too: we can see only the files this app itself created, and nothing else in your Drive.

Opening it needs the passphrase — we would need it too, and we do not have it
The drive.file scope in Google Drive; the rest of your Drive is invisible to us
When it was last backed up is written on the screen

For whoever asks you the technical question

The technical shape of it

Database	SQLite, SQLCipher — AES-256
Key	32 random bytes; wrapped by the OS key store and by scrypt (N=2¹⁵, r=8)
Licence	Ed25519 signature, machine-bound, verified offline
Relay	Six public paths only; the refusal happens on the chamber’s machine, not the relay
Google Drive	OAuth with PKCE, the drive.file scope only
Drug register	A signed data file; refused if the signature does not match

If you find a security problem, write to [email protected]. We answer, and once it is fixed we tell you what it was.

Questions

The ones doctors actually ask

Can you read my patients’ records?

No. The records sit in an encrypted file on your computer, and the key to it is held on your machine and by your recovery passphrase. We have neither. If a court asked us we could not produce them — there is nothing on our side to produce.

What if the laptop is stolen?

The file is encrypted, and taking the disk out and putting it in another computer does not help: the key is tied to that machine’s own protection — DPAPI on Windows, the Keychain on macOS. You restore everything to a new machine from your backup.

What if I forget the recovery passphrase?

Nothing happens on the machine you are using — it opens with its own key. But the backup file can never be opened again, and not by us either. That is not a weakness, it is the point: a backup we can open is a backup somebody else can open. Write the passphrase down and keep it somewhere that is not the chamber.

What leaves the chamber when online serials are on?

What the patient typed themselves — name, mobile, age, and what is wrong — and the number currently being seen, for the board. No prescription, no diagnosis, no medicines, no earlier visits. The list of addresses the outside world may ask for lives on your own machine, and anything outside that list is refused by your machine, not by us.

Does the software phone home?

Not to check the licence — that happens offline on your machine, so a chamber with no connection is never locked out. It reaches us only when it looks for an update, and you can switch that off.

See it in your own chamber

Thirty days free. Unplug the internet and use it — that is the simplest test there is.

Buy Nirnoy Rx See pricing