Trust and security

Every table carrying clinic data is row-level-secured and scoped to a single clinic. There is no application query that can reach across clinics without the service role, and the places that use it are enumerated and reviewed.

Enforced by database policy, not by application code.

Isolation is asserted against a live database rather than reviewed in a diff: every table carries a clinic id, row-level security is on, and no client role holds a privilege that ignores it.

A standing check run after every schema change.

Documents are stored under a path prefixed by the clinic that owns them, with a storage policy that reads that prefix.

Covered by an automated test.

Multi-factor authentication is enforced on every account with access to patient data.

Required at sign-in; not optional per user.

Every clinical decision and every state change is recorded in an append-only audit log naming the person, the action and the time. The log holds references, never patient details.

Written in the same transaction as the change it records.

Where Lumagen staff act on a clinic's data, the action requires a stated reason and is written to the clinic's own audit log as well as ours.

The clinic sees the same entry we do.

Data is encrypted in transit and at rest.

Standard transport encryption and provider-managed encryption at rest.

Patient data is never used to train machine-learning models, on any plan.

A contractual position with our model vendor, not a setting.

A clinic can export everything it has built, at any time, in a machine-readable format. That right survives non-payment, downgrade and termination.

A term of the master services agreement, not a courtesy.

Deletion is real deletion, and produces a receipt stating what was removed. What survives is an audit record that the deletion happened.

Available on request from the clinic's own settings.

Every vendor that can access patient data is published, with what it can see and where it runs. The list is incorporated into our business associate agreement by reference, and changes carry notice.

Published at lumagen.ai/subprocessors.

A business associate agreement is available and is executed before any clinic sends patient data.

Signed as part of activating a paid plan.