How does MediVault protect my sensitive medical data?

MediVault uses end-to-end client-side encryption (AES-GCM-256). Your medical files are encrypted in your browser before being transmitted to private object storage vaults. Only you and explicitly authorized doctors hold the decryption keys. MediVault never stores unauthenticated plaintext clinical records, adhering to Section 12 of the Digital Personal Data Protection Act (DPDPA 2023) and HIPAA security standards.

MediVault protects medical data using client-side AES-GCM-256 encryption, zero-knowledge private vaults, and DPDPA 2023 compliance. Files are encrypted in the browser before upload, ensuring only patients and explicitly authorized doctors can view them.

Why does healthcare data need blockchain technology?

Traditional hospital databases can be edited, deleted, or retroactively altered during malpractice lawsuits or insurance disputes. With MediVault, every medical document's cryptographic SHA-256 hash is anchored onto the Polygon blockchain. Once notarized, the record is mathematically tamper-proof—neither hospital staff nor MediVault can ever alter or backdate it.

Blockchain anchors cryptographic SHA-256 hashes of medical records to Polygon smart contracts. This makes clinical records mathematically tamper-proof, preventing unauthorized deletion or backdating during insurance claims and legal audits.

Do I need cryptocurrency, gas fees, or a MetaMask wallet to use MediVault?

No. MediVault is built with a Gasless Web3 Architecture. All on-chain notarizations and state anchors on the Polygon blockchain are sponsored and computed automatically in the background. You get all the cryptographic security of Web3 without needing crypto tokens, gas fees, or browser extensions.

No crypto or MetaMask wallet is needed. MediVault uses a gasless architecture where all blockchain verification transactions on Polygon are sponsored and processed automatically in the background.

How does the Emergency Medical Pass work during trauma situations?

Patients generate an offline-compatible physical and digital Emergency Pass with a standard medical QR code. In an emergency, first responders scan the pass to perform a statutory 'Break-Glass' override, revealing only golden-hour critical data (blood group, critical allergies, chronic conditions, and emergency ICE contacts). The access session is time-limited and logged to a tamper-evident audit trail that notifies the patient's emergency contacts.

During an emergency, first responders scan the patient's Emergency QR pass to view vital blood type, critical allergies, and ICE contacts without unlocking the phone. The break-glass override is time-limited and logged to an immutable audit trail.

How does the AI Clinical Copilot extract and verify data from handwritten prescriptions?

When you upload paper prescriptions or lab reports, MediVault's multimodal AI engine—combining Google Gemini 1.5, NVIDIA NIM, and specialized TrOCR vision neural networks—extracts drug names, dosages, and dosing frequencies. Every extracted metric is cross-referenced against the RxNorm and WHO Essential Medicines catalog, verified with confidence scoring, and linked directly to the original source document.

MediVault combines Google Gemini 1.5, NVIDIA NIM, and TrOCR neural networks to transcribe handwritten prescriptions. It resolves clinical entities, matches dosages against RxNorm drug catalogs, and flags drug interactions in real time.

Can doctors access my records without my explicit permission?

No. Doctors cannot browse your records at will. When you visit a clinic or hospital, you grant a time-bound consent grant (e.g., 15 minutes, 24 hours, or 30 days) with a specific clinical purpose. When the timer expires, the cryptographic access token invalidates instantly with an immutable audit log. Only verified emergency room physicians can initiate break-glass trauma overrides.

Doctors cannot access patient records without explicit permission. Patients issue time-bound consent grants (24 hours to 30 days) that expire automatically. Every access event is recorded in a tamper-evident audit log.

Is linking an Aadhaar or ABHA ID compulsory to use MediVault?

No, government ID integration is 100% voluntary. You can use MediVault as a standalone private health locker without providing Aadhaar or ABHA. However, linking an Ayushman Bharat Health Account (ABHA) ID allows you to fetch official lab reports from AIIMS, Apollo, Max, and sync your Ayushman PM-JAY card in one click.

Linking an ABHA or Aadhaar ID is completely voluntary. Patients can use MediVault as a private health vault, or link ABHA to automatically fetch clinical reports from connected hospitals across India's ABDM network.

Is MediVault free to use for individual patients?

Yes. Individual patient accounts with unlimited cloud storage, ABHA health card issuance, DigiLocker sync, AI prescription explanations, and the emergency trauma pass are completely free.

Yes, MediVault is completely free for individual patients, including document storage, AI prescription scanning, ABHA health card integration, and emergency QR pass generation.

Can insurance companies or employers see my health records?

Never. MediVault operates on zero-knowledge encryption and patient data sovereignty principles. No third party—including insurance firms, employers, or even MediVault system administrators—can view your medical documents without your explicit, time-bound consent.

No insurance companies, employers, or administrators can see health records. Patient data is encrypted with zero-knowledge keys, meaning only the patient can authorize temporary access.

What happens if I lose access to my account?

Your records are secured by your verified credentials, biometric WebAuthn passkeys (FaceID, TouchID, Windows Hello), and cryptographic recovery protocols, ensuring you can regain access securely at any time while preventing unauthorized account takeover.

Accounts are protected by biometric WebAuthn passkeys and cryptographic recovery protocols, allowing patients to regain secure access anytime while defending against credential theft.

Back to Home

Legally Binding Patient & Clinical Agreement

Terms of Service & Clinical Disclaimers

Effective Date: August 29, 2026 · Version 3.2 (Production Release)

CRITICAL MEDICAL & CLINICAL AI DISCLAIMER

1. MediVault is NOT a Licensed Medical Provider: MediVault is a digital health record management software and decentralized cryptographic locker. MediVault does NOT practice medicine, dispense pharmaceutical drugs, or provide formal diagnoses.

2. Assistive Clinical AI Limitations: MediVault's multimodal Optical Character Recognition (OCR), Prescription Explainer, Lab Reference Biomarker range indicators, and Drug-Drug Interaction Safety engines are assistive informational algorithms designed to facilitate patient organization. Under the Medical Device Rules (CDSCO MDR 2017) and NMC Telemedicine Guidelines, our AI models do NOT constitute certified Software as a Medical Device (SaMD) or primary medical diagnostics.

3. Always Consult a Physician: Never discontinue, modify, or begin any prescription medication or medical therapy based solely on output from the MediVault AI Copilot. In case of acute chest pain, trauma, or medical distress, dial 112 / 102 or proceed to the nearest emergency department immediately.

1. Acceptance of Terms & Scope

By accessing, registering an account, linking an Ayushman Bharat Health Account (ABHA), uploading documents, or utilizing the doctor terminal on MediVault (the "Platform"), you acknowledge that you have read, understood, and agreed to be legally bound by these Terms of Service ("Terms") and our Privacy Policy. If you do not agree to these Terms, you must immediately discontinue use of the Platform.

2. User Accounts, Passkeys & Security Responsibility

MediVault utilizes hardware-backed FIDO2 / WebAuthn passwordless authentication (biometric face/fingerprint or security key). You are solely responsible for:

Maintaining physical custody and security of devices registered as your authorized biometric passkeys.
Ensuring that uploaded medical documents, lab results, and personal details reflect authentic and accurate health information.
Promptly revoking access or alerting MediVault administrators if you suspect unauthorized access to your account or credentials.

3. Government ABDM & DigiLocker Sync Rules

MediVault provides API interoperability with the National Health Authority (NHA) Ayushman Bharat Digital Mission (ABDM) and DigiLocker (MeitY):

Voluntary Participation: Generating or linking an ABHA number via MediVault is strictly voluntary. You may use MediVault as a private offline health vault without providing an Aadhaar or ABHA identifier.
Third-Party Gateway Availability: MediVault does not control the uptime or response latency of government identity servers (UIDAI or NHA). We are not liable for transient authentication failures resulting from government gateway downtime.
Document Authenticity: Documents pulled through DigiLocker (e.g. CoWIN certificates, PM-JAY cards) are certified directly by the issuing authority and are imported into your vault in an unadulterated state.

4. Doctor Consultation Sessions & Time-Bound Consent

A. Patient-Controlled Consent: When you share your vault with a physician, you grant a time-limited cryptographic delegation token (e.g. 15 minutes, 1 hour, or 30 days). You retain the right to terminate access prematurely using the "Revoke Access" button.

B. Doctor Professional Duty: Licensed medical practitioners using the Doctor Terminal must verify patient identity and uphold standard duty of care in compliance with the National Medical Commission (NMC) regulations. Doctors may not download, re-distribute, or photograph patient records outside the authorized clinical session.

C. Emergency 15-Minute Hospital Override: Verified hospital trauma physicians may trigger an emergency bypass in acute resuscitation cases. Every emergency override generates an immutable on-chain audit trail and immediately notifies the patient via SMS/Email.

5. Emergency Trauma Pass Usage & Limitations

The Golden Hour Emergency Pass renders essential resuscitation data (blood type, critical allergies, and emergency phone numbers) when scanned by paramedics:

The emergency pass operates in public or unauthenticated mode to allow paramedics and first responders immediate life-saving triage data without requiring your phone unlock code.
You are solely responsible for verifying that your listed blood group and allergy disclosures are medically accurate. MediVault bears no responsibility for adverse clinical reactions resulting from inaccurate patient-submitted allergy data.

6. Prohibited Activities

You agree not to engage in any of the following unauthorized activities:

✕ Falsifying Medical CredentialsImpersonating a licensed medical doctor, healthcare provider, or emergency responder on the platform.

✕ Malicious PayloadsUploading executables, malicious binaries, scripts, or corrupted files disguised as medical PDFs or images.

✕ Scraping & Data HarvestingUsing bots, crawlers, or automated tools to scrape provider directories or patient information.

✕ Circumventing Consent TokensAttempting to reverse-engineer, forge, or tamper with Polygon blockchain notarizations or cryptographic consent tokens.

7. Limitation of Liability & Indemnification

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MEDIVAULT CHAIN AI INC., ITS DIRECTORS, EMPLOYEES, AND PARTNERS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF DATA, MEDICAL COMPLICATIONS, CLINICAL ERRORS BY ATTENDING PHYSICIANS, OR SERVICE INTERRUPTIONS RESULTING FROM NETWORK OR BLOCKCHAIN LATENCY. IN NO EVENT SHALL MEDIVAULT'S TOTAL AGGREGATE LIABILITY EXCEED THE GREATER OF ONE THOUSAND INDIAN RUPEES (INR 1,000) OR THE TOTAL FEES PAID BY YOU TO MEDIVAULT IN THE PRECEDING TWELVE MONTHS.

8. Governing Law & Dispute Resolution

These Terms shall be governed by, construed, and enforced in accordance with the laws of the Republic of India, without regard to its conflict of law principles. Any dispute, claim, or controversy arising out of or relating to these Terms or the breach, termination, enforcement, interpretation, or validity thereof shall be submitted to the exclusive jurisdiction of the competent courts situated in Mumbai, Maharashtra, India.

For legal notices or questions regarding these Terms, contact our legal counsel at legal@medivault.app.