We built Mobile Health Vault from the ground up with security first. Every technical decision — from database schema design to API authentication — was made to protect your most sensitive data.
Three principles guide every security decision we make.
No data collection beyond what's necessary. No advertising. No sharing with third parties. Your health records are never used to train AI models.
Multiple independent security layers — if one fails, the others hold. No single point of failure in our authentication or data access architecture.
Complete audit trails. Every access to your data is logged. You can see who accessed what and when. Export or delete all your data at any time.
Login is OTP-only via mobile number — no passwords to leak. Short-lived JWT access tokens (15 min expiry) and rotating refresh tokens. All tokens invalidated on logout.
All communication between app and server uses TLS 1.3 with certificate pinning in the mobile app. No HTTP fallback. HSTS enforced on all web endpoints.
All uploaded documents (PDFs, images, DICOM files) stored with AES-256 server-side encryption. Encryption keys managed via hardware security module (HSM). Database fields with PII encrypted at column level.
Each hospital, lab, or enterprise customer gets a completely separate PostgreSQL schema (pod). Database-level row security policies prevent any cross-tenant data access — even in the event of application bugs.
The Secure Vault within the app requires a separate biometric authentication (Face ID or fingerprint) or PIN before any document is displayed. Vault auto-locks on app background. Failed attempts trigger progressive lockout.
Granular role-based access: patient, family member, doctor, lab_staff, pod_admin. Shared records have expiry dates. Doctors see only what patients explicitly share. Provider staff see only their institution's records.
Every API action — record upload, view, share, delete, OTP generation — is logged to an isolated audit microservice (separate DB, write-only). Anomaly detection alerts on unusual access patterns. Real-time security dashboard for administrators.
Request a complete export of all your health records in standard formats (PDF, FHIR JSON, DICOM). Delivered within 48 hours.
Permanently delete your account and all associated data at any time. Deletion is irreversible and completes within 30 days per our data retention policy.
See a complete log of every time your records were accessed, shared, or modified — by you, family members, or healthcare providers.
Found a security vulnerability? We appreciate responsible disclosure. Our security team reviews all reports within 48 hours and provides updates throughout our remediation process.
📧 security@mobilehealthvault.inPlease do not publicly disclose vulnerabilities before we've had a chance to address them. We commit to responding within 48 hours.