Security & compliance
Lab data security: an audit trail for NABL, hosted in India
PathLab Software keeps ISO 15189 evidence in the product, hosts patient data in India, encrypts it, and records WhatsApp consent as the DPDP Act 2023 expects. HIPAA Compliant is our only compliance claim; NABL accreditation and ABDM registration remain your lab's own.
Full audit trail
Results, edits, validations, sign-offs and WhatsApp sends are logged with user, time and IP; a released report is amended with a reason, never silently edited.
Role-based access
Front desk, technician, pathologist, accounts and owner roles; per-department permissions; two-level validation enforced.
Critical-value acknowledgement log
Every auto-call attempt, failed call, escalation and acknowledgement (by call, WhatsApp ACK or manually) is retained with the result. It supports, never replaces, the lab's duty to inform.
Reagent lots now, internal QC planned
Reagent lot numbers, expiry alerts and consumption are live. Levey-Jennings charts and Westgard flags are planned, not yet in the product.
Encryption and backups
TLS in transit, encryption at rest, daily encrypted backups kept in India for 30 days.
DPDP consent and export
WhatsApp consent recorded per patient at registration, purpose-limited use, patient deletion on request, full export on request at no charge.
How we build and run PathLab Software
- Isolation. Every record carries your workspace ID and every query is scoped to it at the data layer, so one customer can never read another's data.
- Encryption. TLS 1.2+ in transit; encrypted disks at rest; passwords hashed with Argon2id; API keys stored only as hashes.
- Access control. Roles (owner, admin, staff, viewer) with per-module permissions, session hardening and login throttling with temporary lockout after repeated failed attempts. Two-factor authentication is on the roadmap.
- Audit trail. Every create, edit and delete is logged with who, when, from where and what changed.
- Backups. Nightly encrypted backups, kept on a 30-day rolling cycle.
- Data ownership. Your data is exported for you on request (and much of it is available through the REST API). If you leave, you get a 30-day export window and then your data is deleted.
- Read more. See our privacy policy, terms of service, the full PathLab Software feature list and pricing.
- Responsible disclosure. Found a vulnerability? Email info@radiatus.com and we will respond within 2 business days.
Security questions
Who can see a patient's report?
In PathLab Software a report is visible to the patient on the registered WhatsApp number, the referring doctor named on the order, and lab users with the Reports role. Lab-side actions are written to the audit trail with user, time and IP address, and every QR verification is counted and time-stamped on the report.
Can I get my data out if I leave?
Yes. On request we export your patients, orders, results and signed reports as CSV files and a ZIP of report files, at no charge, before or within 30 days after you cancel. A self-serve export button in Settings is planned. After that window, or sooner on your request, we delete your data.
Which compliance claims does PathLab Software make?
One: HIPAA Compliant, for the administrative and technical safeguards listed on this page (access control, audit logs, encryption, backups). PathLab Software holds no other certification such as SOC 2 or ISO 27001 and is not NABL or ABDM certified, because those apply to your lab or need your own registration. For Indian labs the main law is the DPDP Act 2023.
What happens to lab data if the internet goes down?
The analyzer connector we set up on the lab PC is designed to queue results locally and send them when the connection returns; this offline queue is checked during on-site validation at go-live. Registration and validation need the internet, so keep a mobile hotspot as backup. Received results keep their time stamp in the audit trail.
Your lab, live in two working days.
Free setup and migration from Excel, Word or your current lab software. We connect your analyzers over a screen share and train your staff in Tamil or English. Monthly billing from ₹1,999, no annual lock-in, cancel any month, and a full data export on request at no charge.