How Medfolio protects your data.
Encryption, authentication, and access controls — explained plainly. Built for medical records, not as an afterthought.
Encrypted everywhere.
Medical records move through Medfolio with the same kind of cryptography that banks and tax authorities use for their most sensitive data.
Only you, only your devices.
Sign-in is built on short-lived tokens with strict rotation. Sensitive actions ask for a fresh verification, even on a trusted device.
Sharing without surrender.
Every share link Medfolio generates is scoped, time-limited, OTP-verified, and audited. You stay in control after you press send.
The promises that aren't in the small print.
We don't sell data
Your reports, your timeline, your trends — none of it is for sale, in aggregate or otherwise. Our revenue comes from optional paid features, not from your data.
We don't train AI on your records
Your uploads are processed for your account only. The extraction model is trained on synthetic and consented public datasets, never on user records.
We don't share with insurers or labs
No backchannel partnerships. Insurers, labs, and pharmacies see what you choose to share with them through a Medfolio share link — and nothing else.
If something goes wrong.
No system is 100% impenetrable, and we won't pretend otherwise. If a breach occurs that affects user data, our policy is to notify affected users per the requirements of India's Digital Personal Data Protection (DPDP) Act, 2023 — including by direct in-app notification, email where on file, and disclosure to the Data Protection Board where required.
We publish a summary of any material security incident on this page within 72 hours of confirmation, including: what was affected, what data was exposed, what we've done, and what (if anything) you need to do.
Reporting a vulnerability: if you believe you've found a security issue, email security@medfolio.co.in. We acknowledge within 48 hours and don't pursue legal action against good-faith researchers who follow responsible-disclosure practice.
Private by design. Yours by default.
Keep your family's reports in a place built to protect them.