A doctor cannot look a patient up. There is nothing to look up in.
MedFile has no patient directory and no patient search — anywhere. The only way a record opens is that the patient's own phone issues a code, the doctor redeems it, and a time-boxed session begins. This page describes that mechanism, and the guarantees built around it.
Grant → session → end. Nothing else opens a record.
The QR the patient shows works exactly once and expires within five minutes if unused. For a patient with no connection, a prepared backup code does the same job and expires on its own schedule. The system stores only a cryptographic digest of each code — the code itself is never kept, and never appears in any log.
Redeeming the code opens a session — and the session is the authorisation. Every read and write is checked against it; no request ever names a patient directly. Sessions lock when left idle and expire after an hour. A doctor holds one open chart at a time, and switching charts must be confirmed by name.
Access ends when the hour runs out, when the doctor closes it, or the moment the patient presses "End access now" — whichever comes first. When a patient revokes access, the workspace closes immediately. Every ending is recorded, and the patient's app shows what happened during the session.
Built into the structure of the system, not written into a policy.
Each of the following is a property of how MedFile is constructed. None of them depends on anyone following a rule.
Hospital administrators hold no permission of any kind on clinical data — the database itself refuses them. It is not a setting that can be changed, and the administrative screens have no path to a patient record.
Access logs and signed records are append-only: the database forbids updating or deleting them, for every role — including the system's own service accounts. Corrections are added as addenda; history stands.
Every access — who, when, from which hospital and branch, and what they did — is visible in the patient's own app, not only to the hospital.
A doctor's account is checked against the Nepal Medical Council register and stays pending until the register confirms it. Nobody activates an account by hand — not even the hospital's administrator.
When a patient ends access, it ends — signing is re-checked at the moment it happens, so nothing can land in a record after the patient has closed the door. An expiring session lets the doctor finish only the record they had already started, and nothing else.
The workspace offers no export and no download of a patient's history — deliberately. When the session ends, the doctor's access to the record ends with it.
Access codes exist in full only on the patient's phone, once, at the moment they are shown. The system keeps a one-way digest — enough to recognise a code, never enough to reconstruct one.
Consent for every access, purpose-bound sessions, patient-visible logging and append-only records are the directives' expectations, built in as structure rather than added as paperwork.
Consent that can be watched, not just trusted.
Before a doctor is let in, the patient's screen states in plain words — Nepali or English — what the doctor will and will not be able to do. While the session runs, the patient sees it running, with the time remaining and a button to end it. Afterwards, the app reports what happened.
A guarantee a patient cannot see is a promise. This one is a screen.
Put these guarantees in front of your own compliance review.
We are glad to walk your hospital's administration and legal counsel through the access model in whatever depth they require.
Request a pilot