Software supports good practice. It does not confer compliance on its own.
Ask us how roles and branch scoping would map to your staff and a real person from our team will answer.
Ask us on WhatsAppIn a clinic running on CuraVerto, a role decides which screens a staff member can open, branch scoping decides which location's records they can see, and the audit log records who opened or changed what, when, and from where. CuraVerto's roles (admin, doctor, staff, receptionist, lab and others) can be assigned to a branch on every plan, including CMS, which scopes the appointment view and pharmacy inventory; database-level branch enforcement is enabled per clinic. The audit log itself is included on ART (₹50,000 per year) and HMS (₹10,000 per sanctioned bed per year).
Access control gets noticed when something goes wrong, usually in one of four ways.
Each role gets what the job needs and nothing more.
| Role | What the job needs | What it should not reach |
|---|---|---|
| Admin | Full clinic settings, staff accounts, billing configuration, and every branch the account is scoped to | Nothing within the clinic's own scoped branches is hidden from admin, which is exactly why an admin login needs the most careful handling of any role |
| Doctor | Their own patients' clinical notes, prescriptions and appointment schedule | Other doctors' consultation notes and clinic-wide financial reports |
| Receptionist / front desk | Appointment booking, patient contact details and billing at their own branch | Clinical notes, prescriptions and any other branch's records |
| Staff | The appointment queue and assigned tasks at their own branch | Full consultation notes, prescriptions and billing configuration |
| Lab | Test orders and result entry at their own branch | Consultation notes and billing |
Role answers what a person can open. Branch answers at which location.
A log that only says something changed does not help in a dispute. It has to answer six questions every time.
Software supports these practices, it does not confer compliance on its own.
Two ideas from India's Digital Personal Data Protection Act 2023 map onto access control directly: purpose limitation, meaning staff should only see the data their role actually needs, and a record of who accessed what, which is what an audit log provides. Neither idea is unique to the Act, both describe what a working access-control system looks like in practice.
CuraVerto does not claim to make a clinic DPDP compliant on the strength of roles and an audit log alone, the Act's obligations, notice, consent and breach reporting among them, extend well beyond access control. Our DPDPA compliance guide for Indian clinics covers the full obligation list.
Roles on every plan; the audit log on ART and HMS.
Yes. Admin, doctor, staff, receptionist and lab roles are scoped by branch on every plan, including CMS. The audit log that records the history of changes is the part reserved for ART and HMS, not the roles themselves.
CuraVerto's audit log, recording who changed a record, what changed, when, the before and after values, and which branch, is included on ART at ₹50,000 per year and on HMS. CMS has role-scoped access without the audit history.
It depends on the setup. Staff can be assigned to a branch, which scopes their appointment view and pharmacy inventory, and database-level branch enforcement is enabled per clinic. Ask for it to be switched on if separation between branches is a requirement.
No single piece of software confers compliance. CuraVerto's role-based access and audit log support two of the practices the DPDP Act points toward, purpose limitation and access logging, but the Act's full obligation set, including notice, consent and breach reporting, extends beyond access control.
An admin deactivates the account and CuraVerto's role-based access stops that login from opening any record immediately. On ART and HMS, the deactivation itself is captured in the audit log, so there is a record of when access ended.
Staff can be assigned to a branch on every CuraVerto plan, and the audit log is included on ART at ₹50,000 per year and on HMS, with no per-doctor fee at any headcount.
Prefer not to use WhatsApp? Leave your number and we will call.