What we can read, and what we cannot

In plain words: what is locked, who holds the key, and what happens if you lose it.

What stays private

We cannot read your session reports
What you write about a session is locked on your own computer before it is sent. We keep only the lock, not the key. Colleagues you let in can read the practice’s reports.
Your personal notes are for you alone
Not a colleague, not the owner of the practice, and not us.
What we can see
Names, contact details, administrative notes and the diary itself. We need them to show your diary and send reminders. No other practice ever sees them.

If you forget your password

You can always sign in again
Ask for a new password on the sign-in page. We send a link to your e-mail address.
A new password does not open your old notes
They are locked with your old password. If it comes back to you, everything opens again.
If it does not, you can start over, and your personal notes are deleted for good. Nobody can bring them back, us included.
The practice’s reports are not lost
A colleague lets you back in, or the owner uses the practice’s recovery key: a code shown once, when the practice is set up, to print and keep safe.
If that code is lost too, and nobody else can open the files, the reports cannot be recovered. We cannot reset what we cannot read.

Who gets in

One practice never sees another
Your patients and your diary are visible inside your own practice, never in another one.
A code from your phone, if you want one
Add an authenticator app, and signing in also asks for the 6-digit code it shows.
Everything is written down
Who signed in, who booked and who cancelled. Nobody can change that record afterwards, and you can read it.

When you leave

Take a copy with you
Your appointments as a file any calendar opens, and for each patient a copy of their file.
Deleted means deleted
When your account is closed, your details are removed from our system.
A practice that is yours alone has to be handed over or emptied first.

What is not built yet

What you delete disappears from the system at once, but not from backups made before. And a deleted note is really gone, not crossed out; whether a patient file should allow that is still to be decided.

For readers who want the technical detail
  • Reports and notes are encrypted in the browser with AES-256-GCM, under keys derived from the password with Argon2id (64 MiB, 3 passes, 4 lanes). The server stores only ciphertext and wrapped keys.
  • Each account has a P-256 key pair. The practice key is wrapped to every member let in and to the recovery key, whose private half never reaches the server.
  • Practices are kept apart by PostgreSQL row-level security, forced on every table, for an application role that owns nothing and cannot bypass it.
  • Sign-in passwords are stored as Argon2id hashes. A wrong password and an unknown address take the same work to answer.
  • Sign-in sessions change every time they are used. Presenting an old one revokes the whole chain and is logged.
  • The activity log is append-only, enforced by a database trigger. The one change allowed is forgetting a name when an account is erased.
  • A test asks the database which columns name a person, and checks each of them after an erasure.