Patient data security in Medical Solutions

The clinic is the controller, we are the processor

For patient data, the clinic is the controller and Medical Solutions is the processor. The clinic decides what it keeps and why, holds the legal basis and collects the consents it needs. We store and process the data only on its instructions, under the data processing agreement in section 4 of the Terms of Service.

We do not use a clinic's data for any purpose of our own, not even research or statistics. When we need sample records to test the software, we use invented data. Our Privacy Policy follows Albanian Law no. 124/2024 on personal data protection, and the GDPR too in the cases the GDPR covers.

• Terms of Service
• Privacy Policy

Every clinic kept apart

Every patient record belongs to a single clinic. The software limits every request to the clinic that is signed in, so one clinic cannot find or open another clinic's records.

Attached files, such as X-rays, clinical photos and signatures, are kept in a private store, never behind a public link. They open only for someone signed in to the account of the clinic that owns them.

Signing in

Each clinic works on one shared login, not one login per person, so its password opens every record. Change it when someone leaves the staff, and on the reception computer turn off the browser's saving of form entries and sign out at the end of the day, as the Terms of Service advise. Beyond the password, the account is protected in these ways:

• The password is stored as a hash, never as readable text.
• Two-step sign-in is switched on in Settings: with a code from an authenticator app on a phone, or with a code by email when you sign in on a new device.
• After too many wrong attempts, signing in is blocked for a while, and if the account itself is locked, its owner is emailed.
• A sign-in from a new device or country is reported by email.
• The sign-in and registration forms are protected by Cloudflare's security check.

The activity log, and "Was this you?"

In Settings, the clinic can read its own activity log: each time a patient record, a file, a signature or a prescription is opened, created, changed, exported or deleted, as well as sign-ins and password changes. It also shows each time one of our maintenance scripts reads the clinic's records. Because the login is shared, the log shows the account, not the person who acted.

Several times an hour, an automatic check reads this log and asks the clinic when something looks unusual, such as many records opened in a short time or the whole patient list downloaded. The clinic answers whether it was them. If it was not, we give the clinic the dates, the accounts and how many records were touched, which it needs to report the breach.

Emails to patients

Email to patients stays off until the clinic switches it on. Even then, a message goes only to patients whose record says they agreed to be contacted, and every message carries an unsubscribe link.

Reminders say only that a visit is due, never a diagnosis, a treatment or a test result. Announcements are written by the clinic itself: some clinical words are refused automatically, but the check cannot catch everything, so the screen asks for practical matters only. We never sell personal data or share it with advertisers.

Where data is kept, and who receives it

The software and the database run in the United States: Vercel runs the software and keeps the uploaded files, and MongoDB Atlas holds the database. Every night an encrypted copy of the database is made and stored in the European Union with Cloudflare R2, under a key only we hold. Data is encrypted in transit and at rest.

Transfers outside Albania happen only under the safeguards Law no. 124/2024 accepts. The complete list of providers that receive data, and what each one receives, is in section 4 of the Privacy Policy. Clinics get at least 30 days' notice before a provider that processes patient data is added or replaced.

If we learn of a breach affecting a clinic's data, we tell the clinic immediately, and in any case within 24 hours, with the detail it needs to notify the Commissioner.

Export, and closing the account

A clinic can download all of its data itself, with one button, at any time, including after its paid period has ended. The download is a ZIP file with the patients as a spreadsheet and as JSON, every patient record, prescription and quote as a PDF, the appointments and the attached files.

When a clinic asks to close its account, the dashboard is locked and the data stays ready for export for 30 days, in case the request was a mistake. Then the account is erased with everything in it, the activity log included. Backup copies are deleted on their own schedule, and billing records, which hold no patient data, are kept for as long as tax law requires.