How we protect the platform.

Account & access

• Token-based authentication — sign-in issues a secure API token; every protected request is authenticated.
• Passwords are hashed — your password is never stored in plain text.
• Role-based authorization — patients, receptionists, doctors, and administrators can only access what their role allows.
• Ownership checks — you can only view and manage your own bookings and wallet.

Bookings & payments

• Idempotent booking — retrying a booking request can never create a duplicate token or double charge.
• Signed payment callbacks — wallet credits require a cryptographically verified signature; unverified callbacks are rejected.
• Fail-closed design — if the payment gateway secret is not configured, payment verification refuses to run rather than trusting unverified data.
• Database transactions — wallet debits, refunds, and commission entries run inside atomic transactions with row-level locking.
• Precise arithmetic — money is handled with exact decimal arithmetic, never floating-point rounding.

Abuse protection

• Rate limiting — login, registration, browsing, booking, and wallet operations are throttled.
• Input validation — API requests are validated before processing.
• Controlled cross-origin access — the API accepts requests only from configured origins.

Accountability

• Audit logging — administrative actions (approvals, overrides, cancellations) are recorded.
• Notification logs — every notification attempt is recorded with its delivery status.
• Refund records — every cancellation produces a traceable refund ledger entry.

Your part

Keep your password private, sign out on shared devices, and contact us promptly if you suspect unauthorized access. The patient portal stores your login token in your browser's local storage — treat the device you sign in on as trusted.

Reporting a security issue

If you believe you've found a vulnerability, please report it responsibly via support@doctormynumber.com rather than exploiting it. We'll acknowledge and investigate.

See also: Data Protection · Privacy Policy