Clinic Pulse is designed to keep security reviews short, with no patient charts and no EMR hookup, and to keep every organization's data walled off from every other. This page explains how.
No PHI, by design
Clinic Pulse is an operations tool. It tracks volumes, metrics, schedules, budgets, and outreach, never patient charts. We do not intend to collect, and you agree not to enter, protected health information (PHI) as defined under HIPAA. Because there's no PHI, there's no HIPAA integration project and no EMR hookup, and most groups don't need a long IT review before getting started. A clinic manager can sign up and be running the same day.
Every organization is isolated
Your data lives in your organization and nowhere else. One clinic group can never see another's numbers, staff, schedules, or budgets. This boundary is enforced on the server on every request, through access rules checked on each record, not just hidden in the interface. When your team reads or writes anything, the system checks that the record belongs to your organization before it's ever returned.
Role-based access
Within your organization, people see only what their role should show them. Owners and regional directors see across all locations, managers see their own location, and staff get just their schedule and daily tools. Administrators control roles and permissions from the admin panel, so access stays matched to responsibility as your team changes.
Audit logging
Sensitive actions such as user changes, permission updates, and data exports are recorded with who did what and when. That gives multi-site operators a clear trail and makes it easy to review changes across an organization.
Encryption and hosting
Data is encrypted in transit. The application runs on a managed cloud platform, and subscription payments are processed by Stripe, which means we never see or store your full card number. No system is perfectly secure, so we ask that you use a strong, unique password and keep your login credentials private. We share more detail about our setup with customers on request.
Account protection
Beyond organization isolation and role-based access, Clinic Pulse protects individual accounts and devices. When someone signs in on a new device, a one-time code is emailed to confirm it is really them. On their own phone or computer they can turn on Face ID or Touch ID unlock, and an automatic idle-lock secures the screen after a period of inactivity, so an unattended session is never left open for someone else to use.
Your data is yours
You can import historical data from CSV to get started, and export your reports and data whenever you want. If you close your account, you may request deletion of your data at any time; we delete it within 30 days except where we must retain records for legal or billing purposes.
Reporting a concern
If you believe you've found a security issue, please email us at security@clinicpulseapp.com and we'll look into it promptly.