The interesting parts of healthcare are the medication and the people. Everything underneath should be predictable, fast, and well-defended.
Built around these standards
Six-digit code, three attempts before lock-out, bcrypt-hashed. The basics done well.
TOTP enrolment for accounts that want a second factor.
15-minute access tokens, 7-day refresh, revocable on the server.
Every sensitive action is logged. Admins can investigate, you can request a copy.
TLS in transit, AES at rest. Health data is treated as sensitive by default.
Separate, explicit consent for AI prescription parsing and analytics.
Verify identity, log every action, encrypt traffic, and let you delete your account.
Replace your doctor, guarantee no platform ever has a bug, or detect malice without you reporting it.
Sell your health data, run ads against it, or share it with third parties without your explicit consent.
Write to security@sanpha.ma. We acknowledge within one working day and credit you publicly once a fix is shipped, if you'd like.
Plain language. No dark patterns. No selling, ever.
