Cybersecurity, Service Availability & Business Continuity Policy

This policy explains how Digi Craft Studio approaches the security of ClinicFlow AI, the availability of the service, and recovery when something goes wrong.

ClinicFlow AI is a software service provided by Digi Craft Studio. In this policy, “ClinicFlow AI” means that software service, “Digi Craft Studio”, “we”, “us” and “our” mean the provider of the service, and “you” means the clinic that uses it.

This policy describes the product as it is today. It states what the software does and what we do not promise. It is not a certification, an audit report or an independent security assessment, and it does not claim to be one.

It applies to the ClinicFlow AI web application, the ClinicFlow AI website and the support channels. It should be read together with the Terms of Service and the related policies listed in section 22.

Digi Craft Studio implements reasonable technical and organisational measures designed to protect ClinicFlow AI and the information in it. No internet-connected service can be guaranteed completely secure or continuously available, and this policy does not promise otherwise.

Security and availability are shared. We are responsible for the software and the way it is operated. You are responsible for how your clinic uses it: who has access, how credentials are kept, and what is done with information after it leaves the service (section 5).

For this policy, security means protecting ClinicFlow AI and clinic information from unauthorised access, alteration, loss and disruption. It covers the application and its administration. It does not cover your clinic’s own devices, networks, email accounts, bank accounts or paper records, which are yours to protect.

The following controls are part of the product today:

• Role-based access. A Clinic Admin and Front Desk Users see and do only what their role allows. The rule is enforced on the server, not only on the screen.
• Clinic separation. Each clinic’s information is read and changed only within that clinic’s own scope.
• Password protection. Passwords are stored using salted password hashing and are never kept in readable form. We do not ask you to send a password to support.
• Signed sessions. A signed-in session uses a signed cookie that page scripts cannot read, marked secure in production. A session ends when the user’s password is changed, when the user is disabled, and when an account is closed.
• Rate limiting. Repeated failed sign-ins and other sensitive actions are rate limited, and a repeatedly failed sign-in is temporarily locked.
• Audit trail. Important actions are recorded in an audit trail that the database does not allow to be edited or deleted.
• Encrypted integration credentials. Credentials for connected services, such as the mailbox password, are encrypted before they are stored.
• Encrypted backup files. A ClinicFlow backup file (.cfbackup) that a Clinic Admin downloads is encrypted, and can be checked without restoring it.
• Controlled Platform administration. Administration of ClinicFlow AI itself is restricted to ClinicFlow platform roles; sensitive configuration is reserved to a smaller set of administrators, and those actions are recorded.
• Incident register. Security incidents are recorded and managed in an internal register.

This list is the whole of what this policy claims. It does not claim a security certification, a penetration test, a vulnerability scan, encryption of the whole database at rest, or that an incident cannot happen.

You are responsible for:

• keeping credentials confidential, using individual accounts, and not sharing a password;
• giving access only to authorised staff, choosing the right role for each person, and disabling users who should no longer have access;
• using devices and networks you trust, keeping them up to date, and signing out on shared devices;
• being careful with emails, links and attachments, and never sharing a password, one-time password (OTP), UPI PIN or card details with anyone claiming to be support;
• protecting exports, printouts and backup files once they have left the service; and
• telling us promptly at support@digicraftstudio.in if you suspect unauthorised access, a lost device or a compromised account.

Online services are exposed to risks that no provider can remove entirely, including:

• unauthorised access, credential theft and phishing;
• malware and ransomware, on our systems or on yours;
• denial-of-service attacks that make a service slow or unavailable;
• software vulnerabilities, including in third-party components; and
• mistakes and misconfiguration.

We take reasonable steps to reduce these risks and may update the software to address them. We do not promise that an attack, a breach or a loss will not occur.

ClinicFlow AI depends on third-party infrastructure, email delivery and payment services. We do not control those services. A failure, outage or security event at a provider can affect ClinicFlow AI, and we may be able to do little until the provider restores its service.

This policy does not state where ClinicFlow AI is hosted or where backups are kept. We will state a fact only when it has been verified.

ClinicFlow AI works over the internet and has no offline mode. The service may be slow, interrupted or unavailable because of:

• cyberattack, malware, ransomware or denial-of-service attack;
• internet or network failure;
• hosting or infrastructure failure, or a failure at a third-party provider;
• software or hardware failure;
• planned maintenance and updates; and
• events outside our reasonable control.

We aim to provide a reliable service, but we do not promise uninterrupted or error-free availability, and this policy sets no uptime percentage, response time or service credit.

We may carry out maintenance and updates that make the service unavailable or limited for a period. Where it is practicable, we will give reasonable notice. Some maintenance, such as an urgent security fix, may have to be done without notice.

If a server, cloud or network failure interrupts the service, we will work to restore it. We cannot state how long that will take. While the service is unavailable, registrations, bills and receipts cannot be recorded in ClinicFlow AI, and your clinic should have its own way to carry on and to record transactions until the service is back.

ClinicFlow AI includes application-level backup tools: a Clinic Admin can download an encrypted ClinicFlow backup file, download readable exports and check a backup file.

• Your copy is your protection. A backup you download is a copy you keep. ClinicFlow AI does not make one for you automatically, so download one regularly and keep it somewhere safe.
• Infrastructure arrangements depend on the hosting environment. Server and infrastructure backup arrangements are a matter for the environment ClinicFlow AI is hosted in. This policy does not state a backup schedule, an off-site arrangement, or how long any infrastructure backup is kept.
• Restore has limits. A restore returns information to the state of the backup. Information entered after that backup may not be recoverable. Restoring a clinic from a backup file is done through ClinicFlow support and is subject to verification.
• No recovery objective is promised. This policy does not state a recovery point objective or a recovery time objective.

Information can be lost or become unavailable because of a failure, an attack, a mistake or an event we do not control, and a backup may be out of date or unusable. You should export and back up information you cannot afford to lose, and keep your own records as your clinic’s legal and professional obligations require.

When we become aware of a suspected security incident, we investigate it, take steps to contain it, and record it in our incident register. What we do depends on the incident. We do not state a fixed time to detect, respond or resolve, and we do not state that monitoring is continuous.

To contain an incident or protect other users, we may temporarily suspend or isolate an account, a user, a feature or the whole service, to the extent reasonably necessary. Where practicable we will tell you why and when it is resolved. Suspension for security reasons is also covered by the Terms of Service.

We may require or perform a password reset, end signed-in sessions or disable a user where we reasonably believe credentials are compromised. You may be asked to set a new password through a secure link sent to your account email address.

Business continuity means carrying on, and disaster recovery means restoring the service, after a serious disruption. We will work to restore ClinicFlow AI after a serious disruption, using the backups and tools available to us at the time.

This policy describes this in general terms only. It does not state that a disaster-recovery plan has been tested, that the service is redundant or fails over automatically, or how long recovery will take.

Where applicable law requires us to notify an affected clinic, an authority or an individual of a security incident or personal data breach, we will do so as the law requires. We may notify a clinic through its account email address or the application. This policy does not state a notification period that is not set by law.

ClinicFlow AI uses layered technical and access controls designed to protect clinic information. We do not guarantee that the service will be free from unauthorised access, malware, interruption, error or loss, or that it will be available at any particular time.

Liability for loss arising from a security incident, an interruption, a failure of a third-party service or any other event described in this policy is governed by the Terms of Service and by applicable law. Nothing in this policy excludes or limits a right or liability that cannot lawfully be excluded or limited.

We are not in breach of our obligations to the extent that a failure is caused by an event outside our reasonable control, as the Terms of Service and applicable law provide. This does not remove our obligation to take the reasonable measures described in this policy.

To report a suspected security issue or ask a question about this policy, write to Digi Craft Studio at support@digicraftstudio.in, or use the ClinicFlow AI contact page. Please do not include passwords or card details in a message.

• Terms of Service
• Privacy Policy
• Data Processing Agreement
• Subscription, Billing, GST & Auto-Renewal Policy
• Cancellation & Refunds Policy
• Service Delivery & Account Activation Policy
• Product & Medical Disclaimer
• Cookie Policy

Changes to this policy are published with a revised date.