DPDP Act 2023 Compliance
How Beshaj Multi-Clinic System protects patient health information (PHI), enforces encryption, and complies with Indian law.
1. Legal Framework & Digital Personal Data Protection (DPDP) Act 2023
Beshaj Healthcare Platform complies strictly with India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Ministry of Health & Family Welfare (MoHFW) Electronic Health Record (EHR) Standards 2016.
Under these regulations, patients retain complete ownership of their Personal Health Data. Beshaj and registered partner clinics act as Data Fiduciaries and custodians processing records solely for medical consultations and diagnostic care.
2. Data Encryption & Security Safeguards
- Encryption in Transit: All API communication, web traffic, and database queries run over TLS 1.3 / HTTPS encryption.
- Encryption at Rest: Patient records and clinic credentials are stored using AES-256-GCM authenticated cryptographic encryption.
- Private Storage Buckets: Prescriptions and lab reports are stored in private buckets and rendered via short-lived signed URLs.
3. Medical Record Retention (NMC Regulations)
In accordance with National Medical Commission (NMC) regulations, outpatient consultation logs are preserved for a minimum of 3 years. Historical records older than 1 year are preserved in secure encrypted cold storage while remaining accessible on-demand to patients and treating doctors.
4. Patient Data Rights
Patients have the right to request access, correction, or updating of their personal information at any time by contacting their registered clinic administrator or emailing dpo@beshaj.com.