DATA HANDLING & ACCESS

Review the safeguards that matter.

A practice needs evidence about access, encryption, record handling and operational processes. This page describes the areas to review; it does not certify a deployment or a practice.

Practice-scoped access

Core patient and booking operations use authenticated local practice membership and role checks. Review permissions for every staff role and the workflows your practice will use.

Sensitive record storage

Sensitive patient fields use the application’s encryption layer. Keys and production configuration must be set correctly; review storage, exports, backups and third-party processing together.

Audit evidence

Supported record and booking operations create audit events. Confirm event coverage, access to logs and the retention schedule required for your deployment.

Operational responsibility

Confirm hosting regions, processors, recovery arrangements, monitoring and incident contacts in writing. A regional format profile does not establish where data is stored.