Skip to content
MyClinicSoft

Security

Patient data,
protected by design

MyClinicSoft is built for the Philippine Data Privacy Act. Here's exactly how we keep your clinic's records safe — and what you can do to help.

Read the Privacy PolicyAsk a security question

What protects your data

Layers that work together, from sign-in to storage.

  • Encryption

    All traffic is encrypted with TLS, and the database is encrypted at rest. Sign-in secrets and integration keys get an extra layer of AES-256-GCM encryption.

  • Two-factor sign-in

    Staff can turn on authenticator-app codes, so a stolen password alone isn’t enough to get in.

  • Login protection

    Passwords are stored as bcrypt hashes, and repeated failed sign-ins are rate-limited per account and per network.

  • Role-based access

    Front desk, doctors, billing, and admins each see only what their role allows — and you can tailor permissions per staff member.

  • Clinic isolation

    Every clinic’s data is kept separate. Staff of one clinic can never see another clinic’s patients.

  • Audit trail

    Sign-ins, record access, and changes are logged with who, what, and when — ready for a compliance review.

  • Hardened web app

    Strict transport security, a content security policy, and click-jacking protection on every page.

  • Backups you control

    Clinic admins can take backups of their clinic’s data from inside the app at any time.

RA 10173

Built for the Data Privacy Act of 2012

Your clinic is responsible for its patients' personal and health information. MyClinicSoft gives you the tools to meet those obligations without extra paperwork.

  • Export a patient’s data on request (right of access and data portability)
  • Handle deletion requests from patients
  • Data retention rules that clear records you no longer need
  • An audit log of who accessed which record, and when

Your part in keeping data safe

Security is shared. These four habits close the gaps software can't.

  1. 01

    Turn on two-factor sign-in

    Ask every staff member to enable it in Settings.

  2. 02

    Give the least access needed

    Assign roles that match each person’s job, and remove leavers promptly.

  3. 03

    Review the audit log

    A quick monthly look catches unusual access early.

  4. 04

    Keep your own backups

    Take a backup regularly and before big changes.

Found a security issue?

Tell us privately and we'll investigate right away. Please don't share details publicly until it's fixed.

Report it privatelyOther questions