How does MediVault protect my sensitive medical data?

MediVault uses end-to-end client-side encryption (AES-GCM-256). Your medical files are encrypted in your browser before being transmitted to private object storage vaults. Only you and explicitly authorized doctors hold the decryption keys. MediVault never stores unauthenticated plaintext clinical records, adhering to Section 12 of the Digital Personal Data Protection Act (DPDPA 2023) and HIPAA security standards.

MediVault protects medical data using client-side AES-GCM-256 encryption, zero-knowledge private vaults, and DPDPA 2023 compliance. Files are encrypted in the browser before upload, ensuring only patients and explicitly authorized doctors can view them.

Why does healthcare data need blockchain technology?

Traditional hospital databases can be edited, deleted, or retroactively altered during malpractice lawsuits or insurance disputes. With MediVault, every medical document's cryptographic SHA-256 hash is anchored onto the Polygon blockchain. Once notarized, the record is mathematically tamper-proof—neither hospital staff nor MediVault can ever alter or backdate it.

Blockchain anchors cryptographic SHA-256 hashes of medical records to Polygon smart contracts. This makes clinical records mathematically tamper-proof, preventing unauthorized deletion or backdating during insurance claims and legal audits.

Do I need cryptocurrency, gas fees, or a MetaMask wallet to use MediVault?

No. MediVault is built with a Gasless Web3 Architecture. All on-chain notarizations and state anchors on the Polygon blockchain are sponsored and computed automatically in the background. You get all the cryptographic security of Web3 without needing crypto tokens, gas fees, or browser extensions.

No crypto or MetaMask wallet is needed. MediVault uses a gasless architecture where all blockchain verification transactions on Polygon are sponsored and processed automatically in the background.

How does the Emergency Medical Pass work during trauma situations?

Patients generate an offline-compatible physical and digital Emergency Pass with a standard medical QR code. In an emergency, first responders scan the pass to perform a statutory 'Break-Glass' override, revealing only golden-hour critical data (blood group, critical allergies, chronic conditions, and emergency ICE contacts). The access session is time-limited and logged to a tamper-evident audit trail that notifies the patient's emergency contacts.

During an emergency, first responders scan the patient's Emergency QR pass to view vital blood type, critical allergies, and ICE contacts without unlocking the phone. The break-glass override is time-limited and logged to an immutable audit trail.

How does the AI Clinical Copilot extract and verify data from handwritten prescriptions?

When you upload paper prescriptions or lab reports, MediVault's multimodal AI engine—combining Google Gemini 1.5, NVIDIA NIM, and specialized TrOCR vision neural networks—extracts drug names, dosages, and dosing frequencies. Every extracted metric is cross-referenced against the RxNorm and WHO Essential Medicines catalog, verified with confidence scoring, and linked directly to the original source document.

MediVault combines Google Gemini 1.5, NVIDIA NIM, and TrOCR neural networks to transcribe handwritten prescriptions. It resolves clinical entities, matches dosages against RxNorm drug catalogs, and flags drug interactions in real time.

Can doctors access my records without my explicit permission?

No. Doctors cannot browse your records at will. When you visit a clinic or hospital, you grant a time-bound consent grant (e.g., 15 minutes, 24 hours, or 30 days) with a specific clinical purpose. When the timer expires, the cryptographic access token invalidates instantly with an immutable audit log. Only verified emergency room physicians can initiate break-glass trauma overrides.

Doctors cannot access patient records without explicit permission. Patients issue time-bound consent grants (24 hours to 30 days) that expire automatically. Every access event is recorded in a tamper-evident audit log.

Is linking an Aadhaar or ABHA ID compulsory to use MediVault?

No, government ID integration is 100% voluntary. You can use MediVault as a standalone private health locker without providing Aadhaar or ABHA. However, linking an Ayushman Bharat Health Account (ABHA) ID allows you to fetch official lab reports from AIIMS, Apollo, Max, and sync your Ayushman PM-JAY card in one click.

Linking an ABHA or Aadhaar ID is completely voluntary. Patients can use MediVault as a private health vault, or link ABHA to automatically fetch clinical reports from connected hospitals across India's ABDM network.

Is MediVault free to use for individual patients?

Yes. Individual patient accounts with unlimited cloud storage, ABHA health card issuance, DigiLocker sync, AI prescription explanations, and the emergency trauma pass are completely free.

Yes, MediVault is completely free for individual patients, including document storage, AI prescription scanning, ABHA health card integration, and emergency QR pass generation.

Can insurance companies or employers see my health records?

Never. MediVault operates on zero-knowledge encryption and patient data sovereignty principles. No third party—including insurance firms, employers, or even MediVault system administrators—can view your medical documents without your explicit, time-bound consent.

No insurance companies, employers, or administrators can see health records. Patient data is encrypted with zero-knowledge keys, meaning only the patient can authorize temporary access.

What happens if I lose access to my account?

Your records are secured by your verified credentials, biometric WebAuthn passkeys (FaceID, TouchID, Windows Hello), and cryptographic recovery protocols, ensuring you can regain access securely at any time while preventing unauthorized account takeover.

Accounts are protected by biometric WebAuthn passkeys and cryptographic recovery protocols, allowing patients to regain secure access anytime while defending against credential theft.

Back to Home

Statutory Compliance · DPDPA 2023 & HIPAA Standard

MediVault Privacy Policy

Effective Date: August 29, 2026 · Version 3.2 (Production Release)

Our Sovereign Privacy Commitment in 30 Seconds

Zero Ad Selling: We never sell, monetize, or broker your personal or health data to advertisers, pharmaceutical companies, or life insurers.
Client-Side Encryption: Documents are encrypted in your browser using AES-256 GCM before cloud transmission. MediVault operators cannot read your clinical records.
Indian Data Residency: All primary databases and encrypted object stores reside strictly within Indian borders (AWS Mumbai `ap-south-1`) in compliance with the DPDPA 2023.
Time-Bound Doctor Consent: Doctors access your vault only via explicit, revocable time tokens (15m, 1h, 30d).

1. Introduction & Regulatory Framework

MediVault Chain AI Inc. ("MediVault", "we", "our", or "us") operates the MediVault decentralized healthcare platform, Personal Health Record (PHR) health locker, and Clinical AI Assistant. This Privacy Policy governs our collection, storage, encryption, processing, and disclosure of data across our patient portal, doctor workstation, and administrative interfaces.

MediVault strictly complies with the following statutory regimes:

Digital Personal Data Protection Act (DPDPA), 2023: Act No. 22 of 2023 (Government of India).
Ayushman Bharat Digital Mission (ABDM): Health Data Management Policy issued by the National Health Authority (NHA).
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).
Indian Computer Emergency Response Team (CERT-In) Cyber Security Directions of April 2022.
Health Insurance Portability and Accountability Act of 1996 (HIPAA): 45 CFR Part 160 and Part 164 (Security and Privacy Rules for global interoperability).

2. Categories of Information We Collect

Depending on which features you activate, we process the following categories of data:

A. Identity & Government ID Data

Full name, mobile number, date of birth, gender, state, 14-digit Ayushman Bharat Health Account (ABHA) number, `@abdm` virtual health handle, and masked Aadhaar reference numbers. Biometric data (fingerprint or face) is processed exclusively locally by your device's Secure Enclave for FIDO2 WebAuthn and is never transmitted to our servers.

B. Protected Health Information (PHI)

Medical prescriptions, laboratory panels (blood, metabolic, lipid), diagnostic imaging scans, discharge summaries, vaccination records (CoWIN), health insurance policies (PM-JAY), and Emergency Trauma data (blood type, critical drug allergies, chronic conditions, ICE contacts).

C. Cryptographic & Blockchain Proofs

SHA-256 cryptographic hashes of uploaded documents, Polygon Amoy blockchain transaction hashes (`txHash`), block numbers, and consent state verification tokens.

D. Regulatory Telemetry & Access Logs

IP addresses, timestamps, user-agent headers, and consultation access event IDs. Maintained in immutable audit logs for 180 days in compliance with CERT-In directions.

3. Purpose Limitation & Lawful Grounds for Processing

Under Section 4 and Section 6 of the DPDPA 2023, MediVault processes personal and health data only on the lawful grounds of **explicit, informed consent** for specified clinical purposes:

Vault Custody & Retrieval: Storing, organizing, and rendering your clinical records in an encrypted digital repository.
Government ABDM Synchronization: Communicating with the National Health Authority gateway to link your ABHA ID and DigiLocker certificates upon your explicit authorization.
AI Clinical Extraction: Running automated Optical Character Recognition (OCR) and biomarker analysis (via Google Gemini 2.5 Flash Cloud) to transcribe handwriting and alert on drug-drug interactions.
Emergency First-Responder Access: Presenting non-sensitive emergency trauma information (blood group, anaphylactic allergies, and emergency phone numbers) when an emergency pass QR is scanned.
Legal & Regulatory Compliance: Fulfilling incident reporting and forensic logging requirements under CERT-In and Indian law.

4. Technical Safeguards & Zero-Knowledge Cryptography

MediVault is engineered with zero-trust architectural boundaries to prevent unauthorized inspection:

Client-Side Encryption Standard:

All clinical files are encrypted in the user's browser using AES-256-GCM before payload transmission. Decryption keys are derived directly from the patient's authenticated hardware passkey (WebAuthn) and are never stored on MediVault backend servers.

Transit Security:

All API endpoints mandate TLS 1.3 encryption with HTTP Strict Transport Security (HSTS) and binary magic-byte inspection to prevent spoofing.

5. Third-Party Sub-Processors & Data Sharing

We share data only with verified sub-processors necessary to operate the platform under strict Business Associate Agreements (BAAs) and Data Processing Addendums (DPAs):

Sub-Processor	Purpose	Data Transferred	Location
Amazon Web Services (AWS)	Encrypted Cloud Storage & Database	AES-256 Encrypted Blobs	Mumbai (`ap-south-1`), India
National Health Authority (NHA)	ABHA & ABDM Gateway Verification	Aadhaar verification tokens, ABHA ID	New Delhi, India
DigiLocker / MeriPehchan	Government Certificate Synchronization	PM-JAY & CoWIN Document URIs	MeitY, India
Google Gemini AI Cloud	Multimodal Clinical OCR & Lab Parsing	Prescription image for transient inference	Enterprise Zero-Retention API
Polygon Amoy Network	Decentralized Document Hash Notarization	One-way SHA-256 Hash (No raw PHI)	Public Distributed Ledger

6. Rights of Data Principals (Patients)

Under Chapter III of the DPDPA 2023 and HIPAA, you hold complete sovereignty over your health data:

✓ Right to Access & PortabilityYou can review all stored records and download a complete, unencrypted FHIR R4 XML/JSON export at any time.

✓ Right to Correction & UpdatingYou may edit or update incomplete medical tags, emergency contacts, or allergy records.

✓ Right to Erasure ("Right to be Forgotten")You may trigger irreversible cryptographic deletion of your medical vault. All files and database pointers will be purged.

✓ Right to Revoke Consent InstantlyYou can terminate active doctor consultation sessions with a single click, immediately invalidating access tokens.

7. Data Protection Officer (DPO) & Grievance Redressal

In compliance with Section 10 of the DPDPA 2023, MediVault has designated a formal Data Protection Officer to oversee healthcare privacy compliance and address user inquiries:

MediVault Data Protection & Privacy Office

Designation: Data Protection Officer (DPO) & Grievance Officer

Entity: MediVault Chain AI Inc.

Official Grievance Email: privacy@medivault.app / dpo@medivault.app

Response Statutory Window: Formal acknowledgment within 48 hours; full resolution within 30 days.

Jurisdiction: Mumbai, Maharashtra, India.