Security at Health Bridge

Health Bridge is being built for employees and employers who will trust us with information about their health needs. That trust has to be earned by what the system actually does, not by badges on a web page. So this page separates two things clearly: what protects this website today, and what we require before the product platform handles any employee health data.

In place today (this website)

This website is a static site. It has no user accounts and no database of personal data.

• HTTPS everywhere, with HTTP Strict Transport Security (HSTS) so browsers only connect over an encrypted connection.
• Security headers, including a Content Security Policy (CSP) that limits where scripts and other content can load from, plus protections against clickjacking and content-type sniffing.
• No third-party trackers. No advertising pixels or third-party analytics scripts run on this site.
• In-browser processing. The assistant and facility finder process your questions and searches in your own browser. They are not sent to our servers. Voice input is the exception: it uses your browser's built-in speech service (for example Google in Chrome), which processes the audio under that provider's terms.
• No personal data in browser storage. We do not store personal data in cookies, localStorage or similar browser storage.
• Minimal forms. Contact and demo forms ask only for what we need to reply, and the details reach us by email.

Required before handling employee health data

The employer programme's product platform will process employee details and service requests. The following controls are requirements we hold ourselves to before any employee health-related data is processed on it. They are commitments, not claims about systems that are already live.

• Secure authentication, with multi-factor authentication (MFA) required for all HR and administrator accounts.
• Role-based access control, so HR users can reach only aggregate, anonymised reports, and staff can reach only what their role requires.
• Encryption of data in transit (TLS) and at rest.
• Secure sessions using HttpOnly, Secure and SameSite cookies, with session expiry.
• API protection, including authentication on every request, input validation and rate limiting to prevent abuse.
• Audit logging of access to personal data and administrative actions, with logs protected from tampering and kept free of health query content.
• Backups that are encrypted, access-restricted and regularly tested for restoration.
• Incident response: a documented plan for containing and investigating incidents, and notifying affected people, employers and the Data Protection Board of India as required by the Digital Personal Data Protection Act, 2023.
• Vulnerability management: dependency updates, security testing before release, and a public responsible-disclosure channel (below).
• Data minimisation: we collect only what the service needs and delete or anonymise it as described in our Privacy Policy.

Responsible disclosure

If you believe you have found a security vulnerability in Health Bridge, please email docotorbrainai@gmail.com with the subject line "Security". Please include enough detail for us to reproduce the issue.

• Please do not access, change or delete data that is not yours, and do not disrupt the service;
• Give us reasonable time to fix the issue before sharing it publicly;
• We will acknowledge your report, keep you updated, and credit you if you wish.

We do not currently run a paid bug bounty programme.

Questions

Employers evaluating Health Bridge can ask us for more detail about our security approach at docotorbrainai@gmail.com. See also our Privacy Policy and Compliance page.