> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rxnote.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Data protection

> What RxNote stores, and how patient data is handled.

* **Roles.** The account — the clinic, or the clinician — decides why patient data is processed. RxNote processes it
  on the account's behalf. In India this follows the Digital Personal Data Protection Act; a data processing agreement
  is signed before production use.
* **What is stored.** What the service needs: the consultation audio, transcript, note, summary, and the patient
  details you send. Patients and visits are stored in RxNote like any recorded in the app;
  retention and deletion terms are agreed in the data processing agreement.
* **Minimum data.** Send only what the note needs. A patient needs only a `name`; age and sex help the note.
* **Transport.** HTTPS only. Audio goes straight to encrypted storage through a short-lived upload URL.
* **Logs.** RxNote logs ids, counts, durations and status codes — never transcripts, notes or prompts.
* **Keys.** API keys are stored only as hashes; webhook secrets are encrypted at rest.
* **Sandbox.** Use synthetic test patients only. Never send real patient data to the sandbox.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.