Trust
Security
Last updated [Month DD, YYYY] · Version [1.0]
Your clients trust you with their stories. This page explains how dhatri protects them, in plain language.
In shortRecords stay in the US, practices are kept apart, practitioners use two-factor sign-in, and every view of a client record is logged.
Where your data lives
Records are stored in the United States on Google Cloud, under a business associate agreement. Every practice also receives a signed BAA with dhatri. [Confirm encryption wording with counsel: encrypted in transit and at rest.]
Each practice is kept apart
Every request is limited to the practice that made it. One practice can never see another’s clients, forms or plans.
Signing in
- Practitioners always use two-factor sign-in, with recovery codes in case a phone is lost.
- Clients have no password. They sign in with a one-time link sent to their email.
- Repeated wrong attempts temporarily lock sign-in for [15] minutes.
Every access is logged
We record each time a client record is created, changed or viewed, and by whom. Entries cannot be edited or removed by the application.
Quiet emails
Emails from dhatri never contain health details. They carry a short note and a secure link. Plans, invoices and forms are read after signing in.
Medha AI and your data
Medha AI runs within our US cloud environment. We never use client records to train AI models. [Confirm: the AI provider’s agreement covers the Medha AI model, #93.] AI output is marked and waits for your approval.
Our team
Access to production data is limited to the few people who need it, and is logged. We never use real client records for testing or demos. [Confirm access policy.]
Backups and recovery
[Confirm: backup frequency, retention and recovery targets.]
HIPAA and your BAA
dhatri is built to support practices that need a business associate agreement. A BAA is offered to every practice. Using dhatri does not by itself make a practice compliant; that depends on how you run yours. [Confirm final wording with counsel before launch.]
Report a security concern
If you think you’ve found a vulnerability, write to [security@dhatri.app]. Please include steps to reproduce it and don’t access other people’s data. We’ll reply within [2] business days. [Confirm disclosure process.]