Your patients' data, protected at every layer
Smart Clinic is built with security-first architecture. Every byte of patient data is encrypted, every access is logged, and every role is scoped.
AES-256-GCM Encryption
All sensitive patient data — notes, addresses, emergency contacts, insurance info — is encrypted at the field level with AES-256-GCM before it reaches the database.
Role-Based Access Control
Granular permissions for Owners, Admins, Doctors, Assistants, and Receptionists. Every action is gated by role — no one sees more than they need.
Full Audit Trail
Every login, record view, edit, and export is logged with timestamps, IP addresses, and user agents. Complete forensic traceability.
Session Management
Automatic inactivity timeouts, secure refresh token rotation, and session revocation protect against abandoned sessions.
Multi-Factor Authentication
TOTP-based two-factor authentication with backup codes. Optional per-user, enforceable per-clinic.
Account Lockout Protection
Progressive lockout after repeated failed login attempts. Automatic unlock after configurable cooldown periods.
Database-Level Security
Managed PostgreSQL with SSL/TLS in transit, encrypted volumes at rest, and isolated network access. No shared infrastructure.
CSRF & Rate Limiting
All state-changing endpoints are CSRF-protected. API rate limiting prevents brute-force and abuse attacks.
Emergency Access Protocol
Break-glass emergency access with mandatory justification, supervisor approval, and full audit logging for every override.
Compliance & Regulations
Smart Clinic is designed and operated in alignment with major healthcare data protection frameworks.
HIPAA
Designed following HIPAA Security Rule principles — access controls, audit controls, transmission security, and integrity controls.
GDPR
Data minimization, right to erasure, consent management, and data portability aligned with EU GDPR requirements.
Israeli Privacy Protection Law
Compliant with Israeli data protection regulations governing the handling of personal and medical data.