Trust & data handling

How your clinic’s data is handled

How PillarClinic handles clinic and patient data: access control, hosting, retention, audit trails, sub-processors and how to raise a privacy or security request.

This page is maintained by the PillarClinic team to answer the security and privacy questions clinics ask most often. It describes the controls the product provides today — it is not an independent audit, certification or legal advice.

Access & authentication

  • Every user signs in with an individual account — email and password, with self-service password reset.
  • Roles are held separately from user profiles: clinic admin, practitioner, prescriber, receptionist and client. Permissions follow the role, not the person's own profile record.
  • Clinical records, diaries, inventory and reporting are scoped to a single clinic. A clinic account cannot read another clinic's data.
  • Clients only ever see their own appointments, consent forms, invoices and photographs.

Data protection in the platform

  • Access to every table is enforced in the database itself with row-level security, not only in the app screens.
  • Traffic between browsers and PillarClinic is encrypted in transit over HTTPS; the managed database and file storage are encrypted at rest by the hosting provider.
  • Clinical photographs and uploaded documents are held in private storage and served only through short-lived, authenticated links.
  • Shared skin-analysis reports use expiring, revocable links with a view count, rather than public URLs.

Clinical record integrity

  • Consent forms are immutable once signed; withdrawal is recorded rather than deleting the original.
  • Completed treatment sessions can be sealed with a cryptographic fingerprint covering the consent version, treatment map, products and batch numbers used.
  • Prescriptions cannot be edited after issue — changes are made by cancelling and re-issuing.
  • An append-only audit log records who changed which record, when, and which fields changed.

What data is stored

  • Clinic data: staff accounts, services, pricing, stock and batch records.
  • Client data: contact details, date of birth, medical history and allergies captured on intake forms, consent forms, treatment notes, clinical photographs, prescriptions and invoices.
  • Operational data: appointment history, notifications sent, and audit entries.
  • Data is processed on behalf of the clinic. The clinic is the data controller for its client records; PillarClinic processes it to provide the service.

Retention & deletion

  • Each clinic sets its own retention periods for records, clinical photographs and audit history in Clinic settings.
  • Removing a client archives their record rather than silently deleting it, so clinical and medico-legal obligations can be met; a full clinical record can be exported as a PDF first.
  • Permanent deletion and anonymisation are available to clinic admins from the compliance area, and are themselves recorded in the audit log.
  • A retention worklist flags records that have passed the clinic's own retention window.

Sub-processors & hosting

  • Managed application hosting, database, authentication and file storage are provided by the platform PillarClinic is built and deployed on.
  • Skin analysis and the AI clinical scribe send the relevant images or dictated text to a large-language-model provider through a managed AI gateway to produce the draft output. Drafts are always reviewed by a clinician before they are saved.
  • Email and SMS reminders are delivered through the clinic's configured messaging provider.
  • Clinics can connect their own payment gateway; card details are handled by that provider and are never stored by PillarClinic.

Shared responsibility

PillarClinic provides

The platform controls above: per-clinic isolation, role-based access, audit logging, immutable consent and prescription records, private storage and retention tooling.

Your clinic is responsible for

Who you invite and which roles you give them, your retention periods and policy wording, the lawful basis for processing client data, your own privacy notice, and keeping staff accounts secure.

Clients are responsible for

Providing accurate medical history at intake and keeping their own account credentials private.

Privacy requests & reporting

  • Subject access requests. Clients should contact their clinic directly. Clinic admins can produce a complete export of a client’s record from the compliance area in seconds.
  • Reporting a vulnerability. If you believe you have found a security issue, please report it to your clinic contact or to the PillarClinic team before disclosing it publicly, and include enough detail for us to reproduce it.
  • Data processing agreements. Clinics needing a signed DPA or a copy of our sub-processor list should ask their account contact — we will confirm the current wording rather than publish a template here.
Register your clinicBack to home