Patient data is sensitive. In PatientPort, data separation and access control are enforced at the database level, not only on the screen.
Supabase (PostgreSQL) is used for the database and for login. Supabase is an infrastructure provider that has passed a SOC 2 Type II audit.
Every record in every table belongs to a clinic. Thanks to PostgreSQL Row Level Security rules, staff of one clinic cannot access another clinic's data.
You decide which panels, which patient-card sections, which columns and which patient sources each role and each person can see; doctors and coordinators only see the patients assigned to them. These rules are not just hidden on screen, they are enforced in the database.
All traffic between the browser and the servers is encrypted with TLS. The live notification channel is separate for each clinic.
Staff and patient logins have a bot check (Cloudflare Turnstile) and a limit on failed attempts. The limit applies both to the details being tried and to the connection address.
The patient enters their phone number together with their own random access code. Doctor notes and internal clinic information are never sent to the portal.
Invitation links are signed by the server, are valid for 48 hours and stop working as soon as a password is set.
Key actions (create, update, delete) are recorded with the person and the date, so you can always see who changed what.
When technical errors in the app are logged, email addresses, phone numbers and link details are removed first.
Before every release, hundreds of automated database security tests run, including cross-clinic access and privilege escalation attempts.
The database and files are backed up automatically every day; backups are stored encrypted and kept for 7 days. In case of a failure, records can be restored.
The PatientPort team cannot access your clinic's data unless your administrator grants time-limited permission; every grant and every entry is written to your audit log. The data belongs to the clinic and is handed over in an exportable format when the subscription ends.
Under KVKK, health data is special category personal data. Our privacy notices, our data processing agreement and our retention and disposal policy are published.
Let's plan a technical call with your IT team.
