Health records are classified as sensitive personal data under Indian law for a reason. Here is the concrete security checklist to hold any health vault against — including ours.
The five non-negotiables
MedNode AI implements all five: AES-256 in transit and at rest, DPDP-aligned consent and data rights, share codes that expire and revoke instantly, and optional TOTP two-factor authentication. Any serious competitor should meet the same bar — the point of this checklist is that you should verify rather than assume, for every vendor including us.
Minimum security bar for any app holding your medical records
Questions to ask any vendor before uploading
- Where is my data stored, and in which country/region? (MedNode: Microsoft Azure, Central India region)
- Is my data ever sold, or used for advertising? (Acceptable answer: never)
- Can I download my original documents and delete my account myself?
- When I share with a doctor, exactly what do they see, and how do I end it?
- What happens to signed download links — do they expire? (MedNode’s expire in ~30 minutes)
- Is there an audit trail of access to my records?
Red flags that should end the evaluation
- No written mention of encryption at rest anywhere in the privacy policy
- Sharing implemented as permanent public links
- The privacy policy permits sale or “monetisation” of health data
- No way to export your own records
- Login without any second-factor option, for an app holding years of medical history
Security vs. usability is a false choice
The most common failure mode is not a breach — it is abandonment. A vault so locked-down that uploading feels like filing taxes ends up empty, and an empty vault protects nothing. This is why capture channels like WhatsApp upload and automatic extraction matter to security in practice: the secure system that gets used beats the perfect system that does not. Judge platforms on both axes together.
Common questions
What does the DPDP Act 2023 mean for my medical records?
India’s Digital Personal Data Protection Act 2023 requires platforms to process personal data only with consent and for stated purposes, and gives you rights to access, correction and erasure. Health records qualify as sensitive data, so the bar is higher. A compliant vault states its DPDP posture explicitly in its privacy policy.
Is cloud storage of health records less safe than keeping paper files?
Paper files cannot be hacked, but they burn, fade, get lost in moves and cannot be searched in an emergency. A properly encrypted cloud vault (AES-256, 2FA, revocable sharing) is more resilient and more useful than paper for most families. The genuine risk is choosing a platform with weak practices — hence the checklist above.
What is data residency and does it matter?
Data residency is where your data physically lives. Storage within India (MedNode uses Azure’s Central India region) keeps your records under Indian jurisdiction and typically improves access speed. For health data, in-country residency is a reasonable preference to state in your evaluation.
This article is general health information, not medical advice. Reference ranges differ between laboratories — always read the range printed on your own report and discuss results with a qualified doctor.
Get this read automatically
Upload your report to MedNode AI and every value is extracted, checked against its reference range and tracked over time — so you see the trend, not just today’s number.
Start free — 1 month Pro