Security and privacy
What a Patient Tells You Stays with You
What a patient tells you, they tell you, not a software company. Nirnoy Rx is built that way: your whole practice is one encrypted file on your own computer, and it is not a file we can open.
AES-256, on your machine
The whole database is encrypted with SQLCipher. Somebody who copies the file away still cannot read a line of it.
The key, held two ways
Once by the machine’s own protection, so you are not typing a password every morning; once by your recovery passphrase, so a new machine can get it back.
Nothing of yours on our servers
Not even a patient’s name reaches us. There is no cloud account, no login, nothing syncing.
How the key is held
Wrapped Twice, for Two Different Reasons
The database’s real key is thirty-two random bytes made by the machine, nothing anyone could guess. It is then wrapped twice. Once by Windows’ own key store, so the app can open it on your machine without asking you for anything. Once by a key derived from your recovery passphrase with scrypt, so a backup can be opened on a different machine.
- No password every morning, which is what a chamber needs
- A backup carries only the second wrapping, so it is useless without the passphrase
- You can change the passphrase; older backups still open with the older one
What leaves the chamber
Online Serials Send the Least That Will Work
The chamber’s computer holds a line open to a relay, and the outside world may ask for six addresses and no others: the board, one patient’s own place in the queue, and the booking page. Anything else is refused by your machine, not by the relay. Which means that even a relay in the wrong hands cannot ask for a patient list.
- Online serials never send a prescription, diagnosis or medicine through the relay
- An assistant’s phone that comes through the relay is sealed on the phone (AES-256-GCM) and opened only on your computer, and its key never reaches the relay
- Online serials are off until you switch them on; the phones’ sealed road runs only while the desk is on, and dies with the app
Backup
The Copy Is Shut Just as Tight
A backup is one file: keep it on a pen drive or in your own Google Drive. Even in Drive, Google cannot see what is inside it, because the file is shut with your passphrase. The permission we ask for is narrow too: we can see only the files this app itself created, and nothing else in your Drive.
- Opening it needs the passphrase: we would need it too, and we do not have it
- The drive.file scope in Google Drive; the rest of your Drive is invisible to us
- When it was last backed up is written on the screen
For whoever asks you the technical question
The Technical Shape of It
| Database | SQLite, SQLCipher (AES-256) |
|---|---|
| Key | 32 random bytes; wrapped by the OS key store and by scrypt (N=2¹⁵, r=8) |
| Licence | Ed25519 signature, machine-bound, verified offline |
| Relay | Six public paths for online serials; the refusal happens on the chamber’s machine, not the relay |
| Phones via the relay | AES-256-GCM, a key per phone; the key travels in the # of a link, which a browser never sends; no message is accepted twice |
| Google Drive | OAuth with PKCE, the drive.file scope only |
| Drug register | A signed data file; refused if the signature does not match |
If you find a security problem, write to [email protected]. We answer, and once it is fixed we tell you what it was.
Questions
The Ones Doctors Actually Ask
Can you read my patients’ records?
What if the laptop is stolen?
What if I forget the recovery passphrase?
What leaves the chamber when online serials are on?
Where does a video visit’s picture and sound go?
Does the software phone home?
Where do patient photos go?
See It in Your Own Chamber
Fourteen days free. Unplug the internet and use it: that is the simplest test there is.