Medical scheduling involves sensitive health records and professional licensing. Every layer of Care Ceylon (Android package org.rotaframe.careceylon) enforces strict access control, credential verification, and statutory compliance.
Pursuant to Section 29 of the Sri Lanka Medical Ordinance, practitioners must provide valid medical registration certificates and NIC/Passport proof before their profile is visible to patients. Certificate scans are stored in an isolated private bucket accessible only to authorized verification administrators.
Row-Level Security (RLS) policies in PostgreSQL isolate patient health notes, allergies, and bookings so only the specific consulting doctor you booked can view them. Data is never sold or shared with advertising networks.
All high-risk account operations—including new registration, password recovery, administrative login, and self-service account deletion—require real-time 6-digit Email OTP verification.
Both the patient and the consulting doctor independently confirm whether a scheduled consultation was Completed or Missed. Any conflict is automatically logged and routed to Administrative Arbitration.
Deleted accounts are held in a 90-day encrypted recovery vault to protect against accidental deletion. Upon final purge, personal identifiers are permanently scrubbed while preserving de-identified clinical audit counters.
All mobile and web API traffic is encrypted via TLS 1.3, and all underlying database tables, authentication tokens, and private document vaults are encrypted at rest using AES-256.
Our Privacy Policy and Terms of Service are synced live with the Care Ceylon mobile app for both Patient Mode and Doctor Mode.