Engineered like infrastructure, not just software
Hospitals trust MedNote with their most sensitive data and their busiest hours. Here's the engineering that earns that trust.
0+
granular permissions
0
role presets
0%
actions audited
Your data gets its own house, not a room
Most multi-tenant systems mix every customer's rows in shared tables, separated only by an ID column — one buggy query away from a data leak. MedNote gives every hospital its own PostgreSQL schema: physically separated tables, with per-tenant database clients routed and cached at the connection layer.
- Schema-per-tenant isolation — stronger than tenant-ID filtering
- Cached per-tenant clients keep requests fast under load
- A shared platform schema handles subscriptions, never patient data
Hospital A
own schema
Hospital B
own schema
Hospital C
own schema
Isolated schemas per hospital · shared schema only for platform data
Eighty permissions, zero guesswork
Access is defined as module:action pairs — pharmacy:sell, ipd:nursing, billing:issue — not vague 'admin vs user' switches. Start from seven hospital-ready role presets, then customise per hospital. Plan ceilings ensure a subscription tier caps what even admins can enable.
Locked down by default
Healthcare data deserves bank-grade defaults — not security as an afterthought.
JWT with refresh tokens
Short-lived access tokens with secure refresh rotation — sessions stay safe without constant re-logins.
Hashed credentials
Passwords stored with bcrypt hashing. Nobody — including us — can read them.
Rate limiting & hardening
Helmet security headers, CORS policy, compression and rate limits — with a stricter limiter on authentication endpoints.
Validated at the edge
Every request is validated before it touches business logic, with structured error responses.
Dual-layer audit trail
Tenant-level activity logs for hospital actions, platform-level logs for operator actions. Everything leaves a trace.
Accountable impersonation
Support can enter a tenant to troubleshoot — through a controlled, logged impersonation flow, never shared passwords.
Plugged into India's national health network
The Ayushman Bharat Digital Mission is reshaping Indian healthcare. MedNote ships ABDM integration in the box — not as a future promise.
ABHA linking
Create and link ABHA numbers via OTP, search by ABHA, and persist health IDs on the patient record.
HFR & HPR registration
Link your facility to the Health Facility Registry and your doctors to the Healthcare Professionals Registry.
Consent management
Request, track and honour patient consent artifacts exactly as the ABDM framework specifies.
FHIR-native records
Prescriptions, lab reports and discharge summaries are generated as standards-compliant FHIR bundles.
Health Locker push
A queued delivery worker pushes records to patients' health lockers reliably — retries included.
Full ABDM audit log
Every ABDM transaction is logged for compliance review.
A SaaS control plane behind the scenes
Payments through Razorpay with webhook reconciliation. Patient messaging over WhatsApp and SMS via Gupshup, plus email. And a dedicated operator console runs the business side.
Tenant provisioning
Spin up a new hospital — isolated schema, admin account, plan assignment — in one flow.
Plans, billing & ledger
Priced tiers with usage limits and trial periods; full/partial/advance payments tracked in a per-transaction ledger.
Coupons & invoicing
Percent or flat discounts with redemption caps and expiry, plus platform-level invoicing to hospitals.
Announcements & support
Broadcast to all hospitals, manage support tickets and publish FAQ content — from one console.
Built on a modern, proven stack
Want the deep-dive with our engineers?
We're happy to walk your IT team through the architecture, security model and ABDM integration in detail.
Or write to us at support@zyptr.com