Data Safety

• Users must sign in and are limited by clinic, branch, role, and feature permissions.
• Clinics can require authenticator-based two-step sign-in, grace periods, reminders, recovery, and audited resets.
• Sensitive administrative and monitoring screens are restricted to authorised administrators.

Database access rules scope records to the permitted organisation and branches. Owners may receive consolidated access where configured, while branch staff see only authorised locations. Application controls do not replace these database-level restrictions.

HealthNext uses encrypted network connections. Managed infrastructure safeguards stored information and private files. Integration credentials and tokens are kept away from ordinary browser access; Google Business Profile tokens are encrypted and restricted to privileged server processes.

No online service can guarantee absolute security, so clinics should maintain appropriate continuity and incident procedures.

• Important access, configuration, clinical, billing, payment, MFA, review, and cleanup events can be recorded in audit trails.
• Performance and error monitoring can capture technical context needed to investigate failures.
• Retention controls can remove older screenshots, URLs, diagnostics, errors, and performance records according to administrator settings.

• Use supported, updated Android, iOS, or browser software and a secured device lock.
• Do not bypass certificate warnings or use links from untrusted messages.
• Sign out from shared devices and do not store patient exports in personal or unsecured locations.
• Report a lost device, unexpected MFA prompt, or suspected access immediately to the clinic administrator.

HealthNext supports clinic work but does not replace professional judgement, statutory recordkeeping, clinical verification, or emergency procedures. Users must verify patient identity, prescriptions, reports, stock, totals, and public review replies before completing an action.

A clinic should promptly restrict affected accounts, preserve relevant audit evidence, follow its incident plan, and meet applicable notification duties. HealthNext administrators can use system error, monitoring, access, and audit information to investigate the affected workflow.