Built around HIPAA safeguards
Safeguards designed around HIPAA. We sign a BAA before you go live.
Encrypted in transit and at rest
Encrypted in transit over HTTPS with HSTS, and at rest with AES-256. Photos and files use short-lived signed links.
Audit trail
Access to patient records is logged with actor, timestamp, and what changed.
Encryption that meets the compliance review.
PHI is encrypted in transit and at rest. File uploads, from encounters to before/after photos and intake attachments, are stored encrypted and served through short-lived signed links.
All traffic encrypted in transit, with HSTS.
At-rest encryption for database and object storage.
9 roles. Enforced at the API and UI.
Permissions are scoped per role and applied at both the API and UI layers. The matrix below shows a representative subset — the full set is configurable per practice.
| Capability | Site Admin | Org Admin | Provider | Nurse | Medical Asst. | Office Manager | Front Desk | Patient | Auditor |
|---|---|---|---|---|---|---|---|---|---|
| View patient chart | ● | ● | ● | ● | ● | ◑ | ◑ | ◑ | · |
| Edit clinical notes | ◐ | ◐ | ● | ◐ | ◐ | · | · | · | · |
| Sign off on encounters | · | · | ● | · | · | · | · | · | · |
| Manage inventory | ● | ● | ◑ | ◑ | ◑ | ● | · | · | · |
| Process payments | ● | ● | · | · | · | ● | ● | ◑ | · |
| Manage users + roles | ● | ● | · | · | · | ◑ | · | · | · |
| View audit log | ● | ● | · | · | · | ◑ | · | · | ● |
| Configure billing | ● | ● | · | · | · | ◑ | · | · | · |
| Patient portal access | · | · | · | · | · | · | · | ● | · |
Audit logs that hold up under review.
Access to patient records is written to an audit log: actor, timestamp, IP, and the prior value where applicable. A dedicated audit role can review and export the log.
Written, not rewritten
Audit entries are recorded as new entries. The application does not edit past ones.
Audit role
Compliance reviewers get a role scoped to the audit log, separate from clinical access.
BAA on request
We sign a Business Associate Agreement before you go live. Standard terms; we negotiate where it matters.
Data residency
Your data is hosted in the United States.
Audit log retention
Older audit logs move to encrypted archive storage.