Security Policy

Protecting patient health data and payment information is fundamental to JagaU. This page summarises the measures we take.

• All online payments are processed by Curlec (Razorpay), which is PCI DSS Level 1 certified. Card details are entered on Curlec's secure payment page and never pass through JagaU servers.
• Payment confirmations are received through signed webhooks and verified before any booking is dispatched.

• All communication between the app, website and our servers is encrypted with TLS 1.2 or higher.
• Databases and file storage (including uploaded documents and photos) are encrypted at rest and hosted with reputable cloud providers.

• Role-based permissions restrict what staff, Providers and suppliers can see. Providers can only view records of patients they are assigned to.
• Administrative access is limited to authorised staff, logged, and reviewed. Login attempts are rate-limited and accounts lock after repeated failures.
• Provider onboarding includes identity (KYC) and professional registration checks before any patient data is shared.

• Authentication uses secure tokens; sessions expire and can be revoked.
• Input validation, audit trails and soft-deletion protect the integrity of records.
• Software dependencies are updated regularly and security patches applied promptly.

• Keep your password and phone secure and do not share your OTP with anyone. JagaU staff will never ask for your password or OTP.
• Only make payments inside the JagaU app or on Curlec's payment page. Do not transfer money directly to Providers for platform bookings.

If you discover a vulnerability or suspect unauthorised access to your account, email zen.integrated@gmail.com immediately with "SECURITY" in the subject line. We investigate all reports and will notify affected users and authorities where required by law.