Security

Encryption

• All traffic between your browser and our servers is encrypted with TLS (HTTPS)
• Health data is stored in an encrypted cloud database, with separate development and production environments
• Payment details are handled by Stripe and never touch our servers

Access Controls

• Role-based access: patients, caregivers, providers, and administrators each see only what their role allows
• Provider data is scoped — a provider can only access records for their own linked patients
• Denied access attempts are recorded in the audit log

Audit Logging with PHI Masking

• Access to protected health information is written to an audit trail
• Sensitive fields are masked inside audit records, so reviewing the log does not itself expose health data
• Application logs are scrubbed to keep PHI out of server logs

Account Protection

• Strong password requirements (12+ characters with mixed character classes) and bcrypt hashing
• Automatic account lockout after repeated failed login attempts
• Sign in with Google is available as an alternative to passwords

Session Safeguards

• Sessions expire automatically after a period of inactivity
• Session cookies are secure and server-managed; signing out invalidates the session immediately

A Note on Compliance

We build with healthcare workflows and HIPAA safeguards in mind — audit trails, PHI masking, encryption, and access controls. Healthcare organizations should review their own HIPAA requirements and Business Associate Agreement terms with their compliance and legal teams before production use. Questions? Contact support@medicationcallreminder.com.