Encryption
Information is encrypted in transit between your browser and our servers, and encrypted at rest in our database, file storage and backups.
Each clinic's data is separate
Every record belongs to one clinic, and every request is checked so that one clinic can never see another clinic's data. Within a clinic, roles and permissions decide what each person can see and do.
Signing in
Two-factor authentication is available to everyone, and we strongly recommend it for clinic owners and administrators. Repeated failed sign-in attempts are blocked, sign-up and sign-in pages are protected against bots, and users are alerted to sign-ins from new devices.
Activity log
Important actions are written to an activity log that is protected against tampering, so changes can always be traced to who made them, when and why.
Records are never erased
Patient, clinical and financial records cannot be erased by clinic staff and are never deleted automatically. Items can only be archived, and archived items stay stored.
Backups
We take regular encrypted backups and test that they can be restored.
File uploads
Uploaded files are checked for type and size before they are accepted, and are stored privately. They can only be opened through short-lived links by people with access to them.
Our staff
Only a small number of MaffeiTech staff can access the systems that hold clinic data, only to run and support the Service, with strong authentication, and their actions are recorded.
Incidents
We monitor the Service for errors and suspicious activity. If a security incident affects a clinic's data, we notify the clinic without undue delay.
Reporting a security issue
If you believe you have found a security problem, please email support@maffeitech.com. Please do not access other people's data or disrupt the Service while investigating. We thank everyone who reports issues responsibly.