HIPAA, GDPR & Healthcare Data Security

1. Multi-Tiered Healthcare Data Encryption

SelfClinic enforces bank-grade cryptographic standards across all software layers:

• Data at Rest: All database clusters, patient charts, attachments, and backups are encrypted using AES-256 with automated encryption key rotation.
• Data in Transit: All communication between user web browsers, mobile applications, and cloud servers is enforced over TLS 1.3 with Perfect Forward Secrecy.

2. HIPAA Compliance & Business Associate Agreements (BAA)

For United States covered entities and healthcare practices, SelfClinic operates in full alignment with the HIPAA Security, Privacy, and Breach Notification Rules. We execute formal Business Associate Agreements (BAA) guaranteeing strict administrative, physical, and technical safeguards.

3. European Union GDPR & International Data Privacy

SelfClinic is fully compliant with the European Union General Data Protection Regulation (Regulation EU 2016/679). European clients benefit from:

• Hosting within ISO 27001-certified EU data centers.
• Data Processing Agreements (DPA) containing Standard Contractual Clauses (SCCs).
• Frictionless patient data export and portability tools.

4. Role-Based Access Control (RBAC) & Audit Trails

Every staff account is assigned customized permission roles. Receptionists cannot view clinical notes, while billing teams only access financial ledgers. All system events—including record views, modifications, and downloads—are immutably logged with user IDs, IP addresses, and timestamps.

5. Business Continuity & Disaster Recovery

Automated incremental snapshots are captured continuously and replicated across geographically separated cloud availability zones, ensuring a Recovery Point Objective (RPO) of under 5 minutes and Recovery Time Objective (RTO) under 15 minutes.