Security and data protection

This page is the working summary. The security page has the same points in full.

Each clinic's records are kept apart

Every patient, note, appointment and bill in Stator belongs to one clinic. The database checks each read and each change against the clinic the person signed in to, on top of the app's own checks, so one clinic's staff can't see another clinic's patients.

Everyone signs in as themselves

Each staff member has their own login and one role, and the role decides what they see. Physios never see prices, and a home-visit address shows only to the desk, the admin (owner), the head physio and the physio booked for that visit. Roles and permissions has the full list.

Staff reset a forgotten password from the sign-in page, with a link sent to their email. The page gives the same answer whether or not an address has an account, and repeated requests are limited.

When someone leaves

The admin locks or deactivates their account under Settings → Users & access. Their access stops at once, and they're signed out on every device.

Their notes and the record of what they did stay. Resetting the password doesn't reopen a locked account.

A record of every change

Changes to patients, notes, appointments, invoices, payments, HMO claims, documents, exercise programmes, portal access, compliance incidents and messages go into an audit trail, with who made each change and when. Opening a patient's chart, printing a PDF and downloading an export are recorded too. The app can add to the trail, but it can't edit or delete anything in it.

Backups

The database is backed up every night. Each backup is encrypted before it's written, and encrypted copies are kept for 90 days.

The patient app

A patient gets into the app only when the clinic invites them, with a one-time link. A family member gets their own sign-in only with the patient's consent, which the clinic records.

By default the app shows no clinical notes. Patient portal and family access has the details.

Messages and receipts

• Emails about a patient message never carry the message itself.
• A receipt shared on WhatsApp carries the amounts paid, never the treatment.

The clinic's part

• Give each person their own login, with the role their work needs.
• Lock an account the same day someone leaves.
• Keep patient details in Stator, not in WhatsApp chats, photos or email.
• Use Stator's own records requests when a patient asks for their records.

Questions about how we handle patient records go to hello@statorhealth.com, with "Privacy" in the subject.