Skip to main content
  • Roles. The account — the clinic, or the clinician — decides why patient data is processed. RxNote processes it on the account’s behalf. In India this follows the Digital Personal Data Protection Act; a data processing agreement is signed before production use.
  • What is stored. What the service needs: the consultation audio, transcript, note, summary, and the patient details you send. Patients and visits are stored in RxNote like any recorded in the app; retention and deletion terms are agreed in the data processing agreement.
  • Minimum data. Send only what the note needs. A patient needs only a name; age and sex help the note.
  • Transport. HTTPS only. Audio goes straight to encrypted storage through a short-lived upload URL.
  • Logs. RxNote logs ids, counts, durations and status codes — never transcripts, notes or prompts.
  • Keys. API keys are stored only as hashes; webhook secrets are encrypted at rest.
  • Sandbox. Use synthetic test patients only. Never send real patient data to the sandbox.