Security Policy
The safeguards REACH applies to protect the platform and the health information within it.
1.Our Commitment
Stratech Ventures Private Limited designs and operates REACH to protect the confidentiality, integrity and availability of the information entrusted to it by Client Organisations and their patients. This Security Policy summarises our main controls.
2.Hosting and Infrastructure
REACH is hosted with reputable cloud infrastructure providers that maintain recognised security certifications. Production environments are logically separated from development and testing environments.
3.Encryption
Data is encrypted in transit using TLS and encrypted at rest using industry-standard algorithms. Credentials are stored using salted, one-way hashing.
4.Access Control
Access to the Platform is role-based, so authorised users see only the data and functions their role requires. Client Organisations control their own user roles. Internal access to production systems is limited to personnel who need it, protected by strong authentication, and logged.
5.Tenant Isolation
Each Client Organisation’s data is logically segregated so that it cannot be accessed by other Client Organisations.
6.Monitoring and Logging
We maintain audit logs of significant user and system activity, including AI actions under each governance tier, and monitor the Platform for suspicious behaviour, availability issues and security events.
7.Secure Development
Changes to REACH go through code review, testing and controlled release. Dependencies are monitored for known vulnerabilities and patched according to severity.
8.Backup and Continuity
Data is backed up regularly, and backups are encrypted and tested for recovery. We maintain procedures to restore service following an outage or incident.
9.Personnel and Vendors
Staff and contractors with access to Platform data are bound by confidentiality obligations and receive security and privacy awareness guidance. Service providers that process data on our behalf are assessed and bound by contractual security obligations.
10.Incident Response
We maintain an incident response process. If we become aware of a personal data breach affecting a Client Organisation’s data, we will notify the Client Organisation without undue delay and provide the information reasonably needed to meet its own notification obligations, including those to the Data Protection Board of India or CERT-In where applicable.
11.Customer Responsibilities
Security is shared. Client Organisations and users are responsible for protecting credentials, assigning appropriate roles, removing access for departing staff, securing their own devices and networks, and uploading only data they are lawfully permitted to process.
12.Reporting a Vulnerability
If you believe you have found a security vulnerability in REACH, report it to info@reach-care.net with enough detail for us to reproduce it. Please do not access, modify or disclose other users’ data, disrupt the service, or publicly disclose the issue before we have had a reasonable opportunity to fix it. We will not pursue action against good-faith researchers who follow these guidelines.
13.Contact
Security questions can be sent to info@reach-care.net.