Security
A clinical record deserves specifics, not slogans.
This page says what actually protects your patients' records in Clinifyd — and, further down, what is on the roadmap rather than pretending it is already here. We would want the same honesty from anything holding our own clinic's records, because it does.
Where the data lives
Australian records stay in Australia
Every Australian clinic's data is hosted in Sydney and does not leave the country. When we open in other regions, those clinics' records will live in their own region the same way — separation by deployment, not by promise.
Encrypted in transit, everywhere
Every connection — browser to server, patient portal, booking page — is HTTPS with certificates renewed automatically. There is no unencrypted path to the application at all.
Nightly backups, kept and checked
The database is dumped every night and before every deployment, with a rolling window retained and a documented restore procedure — because a backup nobody has restored is a hope, not a backup.
Who can get in
Three separate front doors
Clinic staff, patients, and Clinifyd's own administrators are three separate identity systems with separate sign-ins on separate hostnames. A patient login cannot open a staff screen; a clinic login cannot open ours.
Passwords done properly, and passkeys
Passwords are stored with Argon2id — the current standard — and rate limiting slows guessing to uselessness. Staff can sign in with passkeys (face or fingerprint) instead, and two-factor codes are available to every account. For our own administrator accounts, two-factor is permanent: there is no setting to turn it off.
Permissions the server enforces
Six roles across more than fifty permissions, every one checked on the server — hiding a button is a courtesy, never the control. Clinical records can never be granted to reception, accounts or marketing roles: those switches are locked by design, and every data-reading route is verified guarded by an automated check on every release.
How the records behave
One clinic cannot see another
Every query is scoped to the practice it belongs to. A clinic's staff, patients, notes and money are invisible to every other clinic on the platform, always.
Nothing clinical is ever hard-deleted
Signed notes never change — corrections are amendments. Sent letters are archived, never erased, each carrying a fingerprint proving it has not changed since it was sent, and a stamp of who printed it and when. Australian law keeps clinical records for years; the software refuses to break that even for its owners.
Everything is on the record
An audit trail records who did what and when — sign-ins, changes, sends, prints, even actions by our own team on your practice, which are written into your log where you can read them.
What we refuse to hold
No card numbers, ever
Clinifyd does not store card numbers at all. When card payments run through the platform, a payment processor holds the card and we keep only a reference — that rule has no exceptions.
Secrets are write-only
Connected services' keys (SMS, email) can be set and replaced but never read back — not by staff, not through the API, not by us in support.
If something goes wrong, there is a plan
A written breach-response procedure sets out the first hour, the first day, and the notification obligations under the Australian Privacy Act's Notifiable Data Breaches scheme — decided in advance, not improvised on the day.
On the roadmap, said plainly
We hold ourselves to the same standards the established players advertise, and we will not claim them before they are true. In progress, in order:
- Independent penetration testing — third-party, scheduled, with findings actioned and re-tested.
- Off-site backup copies — nightly backups already exist; copies to a second location harden them against the worst day.
- Certified compliance (SOC 2 class) — the controls are being built and documented now; certification follows the audit period, not a press release.
- Verified encryption at rest — stated here only once verified end to end, because "AES-256" as a slogan protects nobody.
Questions about any of this — or a security concern to report — reach a person at the contact page, and security reports are read first.