Data Security

Security at ByOnco

Last Updated: October 24, 2026

At ByOnco, the security of your data, medical, personal, or financial, is at the core of everything we build. We are committed to protecting the confidentiality, integrity, and availability of your information through advanced security practices, continuous monitoring, and compliance with applicable Indian data protection laws, including the Digital Personal Data Protection Act (DPDP Act), 2023.

Our Security Measures

1. End-to-End Data Encryption

  • In transit: HTTPS/TLS 1.3 to secure all API and web communications.
  • At rest: AES-256 encryption for databases and storage.
  • OTP and personal identifiers are hashed using salted algorithms.

2. Role-Based Access Controls (RBAC)

  • Limited to authorized personnel
  • Controlled using RBAC and time-limited session tokens
  • Logged and auditable

3. Authentication and Identity Management

  • Secure OTP-based login via Firebase Auth
  • Biometric authentication (for future mobile release)
  • Multi-factor authentication for internal tools and admin portals

4. Continuous Monitoring & Intrusion Detection

  • Suspicious activity is flagged in real-time
  • Automated alerts are integrated with our internal response workflows

5. Regular Vulnerability Assessments

  • Quarterly penetration testing with certified ethical hackers
  • Monthly vulnerability scans and codebase security audits

Our Commitment to Data Protection

  • Complying with India's DPDP Act and other relevant medical privacy regulations
  • Never sharing your data with hospitals, labs, or partners without explicit user consent
  • Ensuring all hospital-side integrations follow secure API and sandboxed architectures
  • Training our team regularly in HIPAA-equivalent data security best practices
  • Working with trusted third-party processors (e.g., Razorpay for payments) that meet our security standards

Breach Response Protocol

  • Affected users will be notified within 72 hours
  • Regulatory authorities will be informed, as per DPDP Act guidelines
  • Internal audits and forensic analysis will be triggered immediately

Third-Party Processors

We work with trusted third-party service providers to deliver our Services, including payment processors (Razorpay), cloud infrastructure providers, and analytics services. All third-party processors are required to meet our security standards and comply with applicable data protection laws. Payment information is handled directly by our payment gateway partner and is not stored on our servers.

Best Practices for Users

  • Use a strong, unique password for your ByOnco account
  • Enable two-factor authentication when available
  • Do not share your account credentials with others
  • Log out from shared or public devices
  • Keep your device software and browser updated
  • Be cautious of phishing attempts, ByOnco will never ask for your password via email or phone

Transparency and Trust

We believe security is not a feature, it's a promise. We continuously invest in improving our infrastructure and uphold best practices across engineering, design, and operations.

Contact Our Security Team

Have concerns or questions about your data's safety?

Email: care@getbyonco.com

Subject: "Security Inquiry - [Your Concern]"