Legal
Security
Last updated: July 2026
This page is maintained by the ClinicToday team to describe the security controls we operate today. It is not an independent certification — for compliance discussions, please contact us.
Encryption in transit
All traffic uses TLS 1.2+ with modern ciphers.
Encryption at rest
Databases and backups are encrypted at the storage layer.
Row-level security
Every query is scoped to your clinic — cross-tenant reads are impossible.
Role-based access
Admin, doctor and receptionist roles see only what they need.
Offline-first sync
Writes are queued locally and synced when the connection returns.
Audit trail
Sensitive actions (invites, deletions, billing) are logged for review.
Authentication
We support email + password and Google sign-in. Passwords are checked against known-leak databases at signup and change time. Sessions are short-lived and refreshed silently.
Authorization
Every table in ClinicToday enforces row-level security. Requests are scoped to the clinic_id of the signed-in user, and roles (admin, doctor, receptionist) restrict which actions a user can perform.
Infrastructure
The Service runs on managed cloud infrastructure with automated backups, DDoS protection and monitored network boundaries. Only a small number of authorized engineers can access production, using unique credentials.
Data handling
Clinical data is owned by the clinic and can be exported or deleted on request. We do not sell data. Aggregated, non-identifying metrics may be used to improve the Service.
Incident response
If we detect a security incident affecting your clinic, we will notify affected admins as soon as practical with what we know, what we're doing and what you should do.
Reporting a vulnerability
Please email hello@logicnex.in with steps to reproduce. We commit to acknowledging valid reports within 3 business days. Please do not publicly disclose issues before we've had a chance to fix them.
Questions? Email hello@logicnex.in.