Security
Clear controls for clinic information.
See how Healhab limits clinic access, stores files privately, separates the public site, and controls publication.
Protected work checks the user, permission, and active clinic.
Prepared content does not become a clinical decision automatically.
Reports publish and share only through authorized actions.
Check access at every clinic action.
Every protected action requires authentication, the right permission, and an active clinic. Assigned relationships are checked when the task requires them.
Keep clinic files behind authorized access.
Durable files are stored privately. Uploads and downloads stay behind authorized product actions.
Separate public marketing from clinic work.
The marketing site runs separately from the authenticated product. Public enquiries and consent-aware analytics do not receive patient, clinical, account, or login values.
Allowed: approved non-clinical enquiry fields
Not allowed: patient information, clinical files, credentials, account identifiers, or login values
Separate: authenticated product sessions and clinical APIs
Keep AI providers inside a governed boundary.
Configured AI providers sit behind product controls. The current provider role is disclosed in the Privacy Policy; region, training use, and exact retention details are stated only after review and approval.
Keep sensitive content out of logs.
Credentials, tokens, patient concerns, clinical notes, report content, and raw audio stay out of application logs.
Make publication deliberate and versioned.
A report remains a draft until an authorized clinic user publishes it. Later corrections create a new version.
- Source
Available evidence stays identifiable.
- Proposal
Processing or AI may prepare material.
- Clinician review
A person compares, edits, rejects, or confirms.
- Publish
An authorized person makes the final action explicit.
Continue the security review.
Report a non-clinical security concern to admin@healhab.com. Healhab's founding team owns the route and aims to respond within 30 days; this is not an emergency channel.