Skip to content
Sign inStart your clinic

Privacy

How Heabst handles information

This page describes what the Heabst platform actually does with information: what it stores, why, which services are involved, and how to reach us about it. It is written from the behaviour of the system rather than from a template, and it says so where something has not yet been settled.

Last updated 12 September 2026 · Heabst, Kathmandu, Nepal · Questions: [email protected]

Who this applies to

Heabst provides clinic management software. Two different relationships matter here, and they are not the same:

  • Clinics subscribe to Heabst and run their own workspace. The clinic decides which staff it adds, which patients it records, and what clinical information it writes down. For that information the clinic is the party in control; Heabst provides the system it is stored in.
  • Patients interact with a clinic’s own Heabst website to book and manage appointments. A patient account belongs to the clinic whose site it was created on.

If you are a patient asking what a particular clinic holds about you, contact that clinic first. We can help them, and we can be reached directly at [email protected].

What information Heabst handles

The system stores the following, because the product needs it to work:

  • Clinic account — clinic name, its Heabst address, any custom domain, the selected plan and subscription dates.
  • Staff accounts — name, email address, phone number, role, an optional profile picture, and for doctors a public profile including specialisation, licence number and experience. Passwords are never stored; only a one-way Argon2 hash is kept.
  • Patient records — name, email address, phone number, date of birth, an optional emergency contact, and whether the record was created at the front desk or by the patient online.
  • Appointments — date and time, the doctor or service, duration, price, status, and the reason for the visit where one is given.
  • Clinical records — diagnosis, prescription, clinical notes and follow-up written by clinic staff, plus files a clinic uploads against a record, such as lab or imaging reports.
  • Payments — amount, method, status and the reference returned by the payment provider. Card or wallet credentials are entered on the provider’s own checkout and are never received or stored by Heabst.
  • Verification codes — codes sent by email or to a mobile number during sign-up or password reset are stored only as a hash, with an expiry, and are consumed on use.
  • Notifications — the messages shown to clinic staff about bookings, cancellations, arrivals and payments.
  • Access records — for actions on clinical and account data the system records what was done, by which account, in which clinic, against which record, together with a request identifier, the originating IP address and the hostname used. This exists so that “who opened this patient’s record, and when” remains answerable after the fact.

Why it is handled

To operate the service a clinic has subscribed to: to authenticate people, show a clinic its own schedule and records, let patients book genuinely available slots, take and reconcile payments, send transactional messages about appointments, keep the service secure, and diagnose faults.

Heabst does not sell information, does not use clinical or patient information for advertising, and does not use it to train machine learning models.

Cookies and browser storage

The Heabst application sets two cookies, both strictly functional:

  • heabst_session — keeps you signed in. Without it the application cannot tell who you are.
  • heabst_csrf — a token used to confirm that a submitted form came from the Heabst interface.

Your browser’s local storage additionally holds display preferences, such as light or dark theme and a cached copy of a clinic’s brand colours, so a page does not flash the wrong colours before it loads. That stays on your device.

This marketing website sets no advertising or analytics cookies and loads no analytics scripts. A clinic may separately connect its own Google Tag Manager, Microsoft Clarity or Search Console verification to its own clinic website. Where a clinic has done that, those tools run on the clinic’s site under the clinic’s own accounts and configuration.

Services we rely on

Heabst runs on infrastructure and services operated by other companies. Those involved in handling information are:

  • Hosting and database — the application and its PostgreSQL database run on managed cloud infrastructure, with traffic served over HTTPS through a reverse proxy and CDN.
  • Cloudinary — stores images uploaded through the product, such as clinic logos, doctor portraits and website imagery.
  • Sentry — receives application error reports. Reports are filtered before they are sent: typed input and console output are dropped, and network breadcrumbs keep the method and status but not the request body.
  • Email delivery — transactional email is sent either through Heabst’s configured provider or, where a clinic has connected its own mail account, through that clinic’s provider.
  • eSewa and Khalti — process online payments. Payment details are entered on their systems; Heabst receives the outcome and a reference.

The precise list of providers can change as the service evolves. If you need the current list in writing for a procurement or compliance review, ask us at [email protected].

How the service is protected

These measures are implemented in the product today:

  • Passwords are stored only as Argon2 hashes, never in readable form.
  • Credentials a clinic supplies for its own mail or payment accounts are encrypted before storage using AES-256-GCM and are never returned by the API.
  • Traffic is served over HTTPS, and the database connection is TLS-verified.
  • Every request is scoped to one clinic, so one clinic’s workspace cannot read another’s.
  • Sign-in and other sensitive endpoints are rate limited.
  • Form submissions are protected by a per-session CSRF token.
  • Access to clinical and account records is written to an audit trail.

No system is completely secure, and we do not claim otherwise. If you believe you have found a vulnerability, please report it to [email protected] rather than disclosing it publicly.

Keeping and deleting information

Clinic and patient records are kept for as long as the clinic’s workspace is active, because the clinic needs its own history. Access records are deliberately kept longer than application logs, since the questions they answer are asked after an incident rather than during one.

We have not yet published fixed retention periods or an automated deletion schedule, and we would rather say so than state a number we do not enforce. If you need information deleted, or want to know what is held about a specific account, write to [email protected] and we will work through it with you and, where relevant, with the clinic that controls the record.

Your choices

You can ask what information is held about you, ask for it to be corrected, or ask for it to be deleted. Where the request concerns a patient record, the clinic that created it is involved in the decision, because it is that clinic’s clinical record.

Heabst is a young company based in Kathmandu, Nepal, and the legal framework that applies to a given request depends on where you and the clinic are. We have not made claims about specific data protection regimes on this page, and we are not going to invent them. Tell us what you need and we will be straight with you about what we can do.

Changes and contact

When this page changes materially the date at the top changes with it. For anything on this page, or any question about information Heabst handles, contact [email protected] or +977 9761745051.

See also the Terms of Service for the rules that govern use of the platform.