Data Protection Statement

At Prescriply, patient clinical information is the most sensitive asset we handle. We follow a “security by design” approach — the minimum data necessary, tenant-based isolation, and encryption by default. This page summarises our security posture. To learn how each piece of information is used, see the Privacy Policy.

• HTTPS/TLS encryption for all traffic; at-rest encryption at the provider level.
• Passwords hashed with bcrypt — never stored in plain text.
• Mobile OTP verification (registration, password reset and patient portal).
• Role-based access control (doctor / assistant / admin) and doctorId-scoped row-level access on every query — one tenant’s data cannot be seen by another. Assistants are further limited to a permission mode and a chosen set of chambers.
• Optional two-factor authentication (2FA) via an authenticator app (TOTP), with single-use backup codes.
• Internal access is least-privilege, and access and security-relevant events are logged to an audit trail.

We use the following infrastructure partners to run the service:

• Amazon Web Services (AWS): hosting, storage and email.
• Amazon RDS for PostgreSQL (AWS): managed PostgreSQL database.
• Amazon Bedrock: AI assist (model inference).
• GenNet: OTP and SMS delivery.
• EPS (Electronic Payment Switch): subscription and credit-pack payments (bKash, Nagad and cards).
• Meta Platforms (advertising measurement), Google (usage analytics) and Microsoft (Clarity — heatmaps and session replay). These three run only on our public marketing pages and the account pages (sign-up, sign-in, password reset and first-run setup), never on the app, the patient portal or any prescription view, and they never receive patient or clinical data. See the Privacy Policy for what each one records.

The list of sub-processors may change; for the current list, contact info@publicpulse.com.bd.

The application, database and file storage are hosted in AWS Asia Pacific (Singapore) — region ap-southeast-1, with our PostgreSQL database on Amazon RDS in that same region. AI inference runs in Amazon Bedrock in ap-southeast-1. We do not move data to other regions without updating this statement.

Because the infrastructure above is located outside Bangladesh, your and your patients’ data undergoes cross-border processing. We rely on the consent of the people concerned and on contractual data-protection commitments with our sub-processors.

Bangladesh is strengthening its data-protection regime, and we actively monitor these developments (including any Personal Data Protection Ordinance/Act and the Cyber Security Act, 2023). Because patient clinical information is sensitive data in a healthcare context, our roadmap includes establishing a synchronised copy within Bangladesh for that data. This is a forward-looking commitment, not a statement that any specific provision is currently in force; the precise obligations are being confirmed with legal counsel.

We have internal processes to detect, prevent and respond to security incidents. In the event of a verifiable personal-data breach, we will notify affected users and the relevant authorities without undue delay and in line with applicable law.

If you notice a security vulnerability or anything suspicious, please report it promptly to info@publicpulse.com.bd.

• BM&DC-verified doctors: a doctor self-reports their BM&DC registration number at sign-up, and a Prescriply admin manually reviews and approves it before the “Verified” badge is shown. This is a manual review, not an automated or online check against the BM&DC’s own register.
• Bangladesh drug catalogue: brand, generic, strength and manufacturer data is compiled from the MedEx Bangladesh medicine index — a commercial drug-information source, not a DGDA data feed — and is provided for reference only.
• Paisa-exact service: all financial calculations are integer-based (paisa) — never floats — so settlements never drift.