Security
The measures that protect the health data entrusted to Clinoly, and how to report a vulnerability to us.
This translation is provided for information. Where it differs from the French version, the French version prevails.
This document is being finalised: some of the publisher’s legal details have still to be filled in.
1.Isolation and access control
- every clinic is isolated: no request can reach another establishment’s data, and that rule is checked on the server for every access;
- every member of staff has a role; clinical data is separated from administrative data, so reception or accounting cannot read consultation notes;
- practitioners’ private notes are never visible to the patient;
- the publisher’s staff access a clinic only with explicit, time-limited and justified authorisation.
2.Authentication
- passwords stored hashed, never in clear;
- two-factor authentication available to every account;
- sessions carried by cookies that scripts cannot read, protected against request forgery, and short-lived (15 minutes, renewed);
- lockout after repeated attempts, and rate limiting;
- every session signed out on suspension or at the user’s request.
3.Data protection
- communications encrypted in transit;
- two-factor secrets encrypted at rest;
- documents stored in private storage, reachable only through signed links valid for five minutes;
- error reports stripped of personal data before being sent;
- regular backups, rotated over twelve months at most.
4.Traceability
Every view of a record, every change and every download is recorded in an audit log the clinic can consult and nobody can alter or delete. Security events — refused sign-ins, lockouts, support access — are recorded separately.
5.Continuous improvement
Security is the subject of a continuous improvement programme. An independent audit, including penetration testing, will be carried out and a summary of its findings published on this page.
6.Incident handling
In the event of a data breach, the publisher informs the clinics concerned as soon as possible and no later than forty-eight (48) hours after becoming aware of it, so that they can meet their own obligations. The detailed commitments are in the Data processing agreement.
7.Reporting a vulnerability
If you believe you have found a vulnerability, write to security@clinoly.com with enough detail to reproduce it. Please do not open a public issue.
- we acknowledge within five (5) working days and keep you informed of the fix;
- we will not pursue good-faith research that accesses only the data strictly needed to demonstrate the issue, keeps none of it and does not disrupt the Service;
- we ask you not to disclose anything before the fix, or before ninety (90) days.