Every practice gets its own key. Delete the key, delete the practice.
Intake, medical history, consent and uploads — encrypted separately for every practice, so one practice's records can never be read with another's credentials.
No form collects anything until the agreement is signed.
Not a warning banner. A refusal. Until the practice's agreement is countersigned, the system will not accept a submission at all. The agreements →
The database decides who sees what, not the code.
Access is enforced at the row, underneath every query. A question asked wrongly returns nothing rather than too much, which is the only way to build this that survives a mistake.
Nothing loads from anywhere else.
No web fonts. No analytics. No chat widget. No CAPTCHA. Nothing third-party runs on a page where a patient is typing their medical history, and we test for it on every release. Scan a site you have now →
Kept exactly as long as you chose.
Not a minimum — a period. When it expires the answers are destroyed and the record that a submission existed remains, because "this form was completed and destroyed on this date" is an answer and silence is not.
Built without typing.
Upload the paper form you use today and it becomes a draft in a few seconds. Every field arrives marked as patient information until somebody says otherwise, so the review is un-ticking a few rather than hunting for the ones that were missed.
Owners read across everything. Agencies read nothing.
A group that owns its locations grants access at the parent, and its central team reads across all of them, because that is the job.
An agency that manages practices it does not own builds the forms, runs the phone line, sees every number — and cannot open a single submission.
Same tables, same code. What differs is topology and membership, and every read is written to the audit log.
The controls →Start by finding out what your websites are leaking.
A free scan of any practice site tells you in ninety seconds which trackers are loading on pages that collect patient information. No account, no card.