Medico-legal records are only useful if they are still there, unchanged, when a dispute arrives. That is the whole design.
Each hospital has its own database, its own media store and its own address. A login only ever sees the hospitals it belongs to. A doctor's private practice records are never visible to a hospital.
When a record is saved, its exact content is hashed. The recording is hashed separately. The Verify button recomputes both. If anything differs, it says so.
Personal logins with PIN, lockout after repeated failures, roles that limit who can create, print or export. Every view, print and playback is written to an audit log.
Database snapshots and all recordings are copied to a separate object store every six hours and kept for 90 days. We restore from backup on a schedule to prove it works, and keep the log.
Records are kept for 10 years by default, longer where the hospital chooses. A lapsed subscription stops new recordings, never access to old ones.
The consent text read to the patient states that the conversation is recorded and kept as part of the medical record, in the language the patient understands.
The hospital is the Data Fiduciary; MedSaakshi is its Data Processor and acts on the hospital's instructions under a written agreement. Patient data is stored in India, used only to provide the service, and never sold or shared. A named grievance officer handles requests, and a breach-notification process is in place.