Security is shared responsibility
Protecting health information requires secure software, careful clinic administration, and safe local devices. The service provider operates platform controls; the clinic determines authorized users, clinical processing needs and patient-facing obligations. This page is a disclosure and educational draft—not a security certification.
Sign-in and session protection
The service uses account authentication for authorized access, including configured email/password or third-party sign-in mechanisms. Accounts should be protected with unique credentials, verified recovery channels, and available multi-factor features. A device or session suspected to be compromised should be secured and access revoked promptly.
Clinic separation and role access
Clinical information should be available only to the appropriate clinic and authorized users, with documented role limitations and server-side authorization. The clinic owner must review access regularly and revoke departing staff. Client-side hiding of a button is not an adequate authorization control.
Protecting records and file access
Patient records, X-rays, photographs, scans and clinical files require access controls appropriate to sensitivity. Network transport, stored files, temporary files, export paths and support actions should each be included in security assessment and test plans. An exported or downloaded record is no longer protected solely by the application.
Auditability, monitoring and recovery
Sensitive actions should be logged with proportionate detail so suspicious access can be investigated without unnecessarily disclosing patient information in logs. Backups and restoration procedures should be designed, monitored, and periodically tested. A backup existing does not by itself prove it can be restored.
Clinical responsibility and data minimization
Clinics must verify patient identities, chart accurately, use the minimum necessary disclosure, secure printed records, and obtain any required permission for messages and data exchange. Users should avoid pasting patient data into unapproved external tools or personal accounts.
Incident reporting
Report suspected compromise, lost devices, unintended disclosures, or security issues promptly to [email protected]. A defined internal response process should cover triage, containment, evidence preservation, communications, and regulatory escalation.
Where vendor agreements matter
Cloud hosting, payments, transactional email, and Google connections have different access to data. A vendor inventory and contract review must establish the exact role, security commitments, hosting region, breach obligations and required agreements before processing protected information.
Review and assurance
Statements such as “HIPAA certified,” “GDPR certified,” “SOC 2 audited,” “zero breach risk,” or an absolute encryption guarantee must not be published without current supporting evidence. External penetration testing, recovery drills, vendor review, and documentation should be scheduled and verified as part of release governance.
Learn more or report a concern
Read the Privacy Policy, Terms and DPA. Send legitimate security questions or concerns to [email protected]. Do not include medical records, passwords, or payment-card details in an initial report.