Security & compliance

Built for clinical trust. Designed for secure, connected care.

Protecting the information that supports every clinical decision — the record itself, and the continuity of care that depends on it.

Talk to us about your governance review
What holds the record

Four things stand behind a decision in OncoSync

The guideline a recommendation cites, the shape of the data that carries it, who is allowed to open it, and what it all runs on.

Clinical guidelinesIn the product today

The guideline on the screen. The decision with your tumour board.

In OncoSync's breast cancer pathways a recommendation arrives with the reference behind it, so the panel can see what the suggestion rests on before it agrees or departs from it.

Neoadjuvant recommendations cite the NCCN page behind each indication
Targeted therapy ranked by NCCN category — Category 1 preferred, 2A recommended
Doses above the maximum are blocked; passing a block takes a written reason
A radiation prescription more than 5% off its library schedule needs a rationale
Amending a decision creates a new version rather than overwriting the last

Guideline-referenced, not guideline-certified. OncoSync holds no certification from NCCN or any guideline body, and a recommendation is not an approval — the treating clinician decides.

Healthcare interoperabilityNot claimed yet

A record kept as structured clinical data

FHIR is the healthcare standard for exchanging clinical data between systems in an agreed shape, so a diagnosis or a medication means the same thing on both sides of the exchange. That shape starts with how the record is captured.

Identity captured as discrete fields, ABHA ID among them
Diagnosis, clinical staging and receptor status held as coded values
Investigations, regimens and cycles recorded per item rather than as notes
Care plans and follow-up captured against the case, not in free text

FHIR exchange is not live in OncoSync today, and no hospital, EHR, PACS or LIS integration is claimed. What is described here is the structured record such exchange would be built on.

Privacy & governanceIn the product today

Who may open a record, and what they did with it

Patient information carries the strictest handling in the platform. Access follows the role rather than the person, it is scoped to the case, and what happens to a record afterwards stays on it.

Role-based access, scoped by specialty, site and case
Two-factor authentication on clinician accounts
Record activity written to an audit trail
An external specialist's access covers the case they were invited to — reversible, and logged on both sides

OncoSync's position on India's DPDP Act and on ISO/IEC 27001 is still being established. Neither is claimed here, and no certification is implied, until there is something to point at.

Secure infrastructureIn the product today

Run on AWS, configured by us

The platform runs on Amazon Web Services. AWS supplies the infrastructure and the security capabilities available on it; how OncoSync configures, monitors and operates on top of that is ours to account for.

Hosted on AWS in the Asia Pacific (Mumbai) region
Data encrypted in transit with TLS 1.2 or higher
Data encrypted at rest with AES-256, using AWS-managed keys in AWS KMS
Databases reachable only through private endpoints, never from the public internet
Daily encrypted database backups
Account activity logged with AWS CloudTrail
Multi-factor authentication on all administrative and cloud console access
System clocks synchronised to a standard time source

Naming a cloud provider settles nothing on its own, so the controls are ours to show, and the ones listed here are the ones in place today. Backup retention, restore testing and further detail are set out in the security pack sent ahead of a demo.

One continuous record
Patient record
Identity, history, investigations
Treatment plan
Intent, regimen, decisions
Clinical workflow
MDT, handover, follow-up

The clinician remains the decision-maker. OncoSync supports multidisciplinary decision-making and records how a decision was reached; responsibility for patient care stays with the treating clinicians and their organisation.