Patient data, treated as sensitive
Prescriply is built “security by design” — the minimum data necessary, per-doctor isolation, and encryption by default. Here is how that works in plain terms.
In short
Prescriply protects patient data with HTTPS/TLS encryption, bcrypt-hashed passwords with optional authenticator-app two-factor, mobile OTP for registration and the patient portal, and strict per-doctor data isolation. Public prescription links withhold the patient’s national health ID, mobile and address, and everything is hosted in AWS Asia Pacific (Singapore, ap-southeast-1) with the database on Amazon RDS for PostgreSQL in that same region.
Encrypted in transit & at rest
All traffic runs over HTTPS/TLS, and data is encrypted at rest at the infrastructure provider. Nothing sensitive travels or sits in the clear.
One doctor, one vault
Every record is scoped to the owning doctor, and every query is filtered by that scope — so one practice's patients, prescriptions and earnings are never visible to another.
Password + optional two-factor
Doctors sign in with a password and can add authenticator-app (TOTP) two-factor with single-use backup codes; mobile OTP with anti-abuse rate limiting guards registration, password reset and the patient portal.
Privacy by design
We collect the minimum needed. The public prescription link shows the Rx but deliberately withholds the patient's national health ID, mobile number and address.
Known, stable hosting
The app, database and files run in AWS Asia Pacific (Singapore, ap-southeast-1), with the database on Amazon RDS for PostgreSQL in that same region. We don't quietly move data between regions.
Money that can't drift
Every fee and settlement is computed in paisa-exact integers — never floating-point — so chamber accounts always reconcile to the last taka.
Least privilege + audit trail
Passwords are hashed with bcrypt, internal access is least-privilege, and security-relevant events are written to an audit trail.
Incident response
We work to detect and prevent incidents, and in a verifiable breach we notify affected users and the authorities without undue delay, in line with applicable law.
The formal statements, in full
This page summarises our posture. For the authoritative detail — controls, sub-processors, data location, cross-border transfer and breach posture — read the full statements.
Found a vulnerability? Please report it to info@publicpulse.com.bd.