Security and compliance
How patient data is protected
Controls implemented in ECMO Universe, mapped to ISO/IEC 27001:2022 Annex A and the Digital Personal Data Protection Act, 2023. The platform is designed to support your institution's ISMS; formal certification applies to the operating organisation's ISMS as a whole.
ISO/IEC 27001:2022 Annex A controls
| Control | Requirement | How ECMO Universe meets it |
|---|---|---|
| A.5.10 | Acceptable use of information | Every user acknowledges the privacy notice and acceptable-use terms before first access and again whenever they change. |
| A.5.15 | Access control | Role-based access (admin, consultant, perfusionist, nurse, etc.) with patient-level assignment; staff only see patients they are assigned to. |
| A.5.17 | Authentication information | Passwords hashed with scrypt, never logged. Minimum length enforced; account locks after repeated failed attempts. |
| A.5.24–5.28 | Incident management | Security incident and breach register per institution, with 72-hour regulator deadline tracking and evidence in the audit trail. |
| A.5.33 | Protection of records | Append-only audit trail enforced by database triggers; before/after snapshots of every clinical change; CSV export with SHA-256 checksum. |
| A.5.34 | Privacy and protection of PII | DPDP-aligned privacy notice, data principal rights register, Grievance Officer contact per institution. |
| A.8.2 | Privileged access rights | Platform (super-admin) roles are separate from tenant roles and have no access to clinical records by default. |
| A.8.3 | Information access restriction | Strict multi-tenant isolation: every query is scoped to the caller's organisation. |
| A.8.5 | Secure authentication | TOTP two-factor authentication with backup codes; administrators can make 2FA mandatory. |
| A.8.11 | Data masking | Public referral status links expose only minimal, token-scoped information. |
| A.8.13 | Information backup | Continuous write-ahead-log backup with point-in-time restore on managed Postgres. |
| A.8.15 | Logging | Actor, role, IP, user agent, time, action, and outcome captured for every sign-in, view-sensitive action, change, and export. |
| A.8.24 | Use of cryptography | TLS 1.2+ in transit with HSTS; AES-256 encryption at rest for database and file storage; private, signed access to clinical images. |
| A.8.26 | Application security requirements | Server-side validation, parameterised queries, electronic signatures with password re-entry, and security response headers. |
| A.7.7 / A.8.1 | Clear screen and endpoint | Automatic sign-out after 15 minutes of inactivity and 12-hour maximum session on shared devices; user-trusted devices stay signed in for up to 30 days. |
DPDP Act 2023 obligations
| Section | Requirement | How ECMO Universe meets it |
|---|---|---|
| s.5 | Notice | Itemised privacy notice at /privacy, acknowledged in-app by every user. |
| s.6 | Consent | Digitally generated, signed consent forms for ECMO initiation, referral, and decannulation on the institution's letterhead. |
| s.8(5) | Reasonable security safeguards | ISO 27001-aligned controls listed above. |
| s.8(6) | Breach intimation | Breach register with 72-hour Board intimation deadline and principal notification tracking. |
| s.8(7) | Erasure when purpose ends | Retention policy page and erasure request workflow, subject to medical-records law. |
| s.8(9)–(10) | Grievance officer and redressal | Each institution publishes DPO / Grievance Officer contact; grievances tracked to a 90-day deadline. |
| s.9 | Children's data | Guardian consent captured; no tracking or advertising of any kind. |
| s.11–14 | Data principal rights | Register for access, correction, erasure, nomination, and withdrawal requests with 30-day due dates. |
Payment collection
| Standard | Requirement | How ECMO Universe meets it |
|---|---|---|
| PCI DSS 4.0 (SAQ A) | Cardholder data out of scope | Card details are entered only in Stripe's embedded checkout frame. Card numbers never reach ECMO Universe servers, logs, or database. |
| PCI DSS 6.4.3 | Payment page script control | An enforced Content Security Policy limits scripts and frames on payment pages to the application and Stripe. |
| RBI PA-PG Directions | Licensed payment aggregator | Payments are collected through Stripe, a regulated payment processor. Settlement goes directly to the company's verified bank account. |
| RBI e-mandate / AFA | Recurring payments and card-on-file | Subscriptions use Stripe's mandate and two-factor authentication (AFA) flow. No card data is stored by the application; card-on-file tokenisation is handled by Stripe. |
| Integrity | Tamper-proof payment events | Stripe webhooks are verified by signature before any subscription changes. Prices and seat counts are recomputed on the server, and idempotency keys prevent double charging. |
| Currency and records | Indian rupee billing and invoices | All plans are priced in INR. Invoices and receipts are available to the institution administrator through the Stripe customer portal. |
Shared responsibility
The platform provides the technical controls above. Each institution remains responsible for staff onboarding and offboarding, assigning roles, enforcing 2FA, obtaining patient consent, appointing a Grievance Officer, and responding to data principal requests using the Data protection register in the admin area. Data processing terms between the institution and the platform are set out in the Data processing agreement.