Security

You — the clinic — are the data controller. Clynalia is your processor. That distinction matters: your patients' data is yours, and we only process it to provide the service.

• We process patient data only on documented instructions from the clinic.
• We never sell data.
• We never train AI models on your patients' records.

Patient data is stored on Amazon Web Services in the eu-north-1 region (Stockholm, European Union), and does not leave the EU.

The database is not reachable from the internet: it sits on a private network, and only the application server can talk to it.

Two independent layers. If the storage layer were ever exposed, the clinical content would still be encrypted.

• In transit: TLS on every connection.
• At rest: the database that holds clinical records is encrypted at storage level.
• On top of that, clinical content is encrypted by the application itself. Each patient has their own data key, and that key is wrapped by a master key held in AWS KMS which never leaves it.
• Keys can be rotated without re-encrypting or moving your records.
• Destroying a patient's data key makes their clinical content unrecoverable — including in backups. That is what turns "we deleted your data" into something verifiable rather than a promise.

Separation between clinics is enforced by the database engine, not by application code. Every query runs under a row-level security policy tied to the clinic in the verified session token, and the account the application connects with cannot bypass it.

The practical difference: a bug in our code cannot leak another clinic's records, because the database returns nothing to begin with. There is an automated test that fails the build if any table holding clinic data is left without that protection.

• Passkeys and Sign in with Apple, so there is no password to steal or reuse.
• Where a password is used, it is stored hashed with Argon2id — the current recommendation for this, not a legacy algorithm.
• Sessions can be revoked immediately; a revoked session stops working on the next request, not when it expires.

Not everyone in a clinic needs to read clinical notes. Clynalia separates roles so that reception staff can register patients and handle invoices without access to clinical content — that is data minimisation under GDPR, not a product preference.

Every access to a patient record is logged: who opened which record and when. If a patient asks who has seen their history, the clinic can answer.

A daily storage snapshot, plus transaction logs shipped continuously every five minutes. Together they allow restoring to any second within the last 14 days, not just to the moment of a snapshot.

And we have actually restored from them. A backup policy that has never been restore-tested is not a backup policy; ours was tested before it held real records.

Clinical records are subject to legal retention periods that vary by region. We will not publish a figure until it is confirmed for each jurisdiction we operate in.

• Full export at any time: PDF for reading and printing, plus a structured format for moving to another system.
• Export stays available even if the subscription lapses. Losing access to write must never mean losing your records.
• No lock-in: leaving does not mean losing your history.
• On account closure we will state exactly what is deleted, what must legally be retained, and for how long.

A DPA will be available to every customer and signed before any patient data is processed.

Found something? Write to security@clynalia.com. We will acknowledge every report.