A clinic trusts us with its patient records. Here is, plainly, how TinyClin keeps them separated, controlled and accountable.
Every patient, appointment, enquiry and note belongs to exactly one clinic. One clinic's team can never see another clinic's records.
Admins, doctors and staff each see only what their role needs. Staff are scoped to the doctors they are assigned to, so access follows the way your clinic actually works.
Every record created, edited or deleted is written down with who did it and when, so any change can be traced back to a person.
Passwords are stored only as salted bcrypt hashes, sessions live in HTTP-only cookies that page scripts cannot read, and password reset requests are rate-limited.
Your WhatsApp access token and Meta app secret are encrypted with AES-256-GCM before they are stored, and are never shown back in full.
Read how we collect and use data in our Privacy Policy, or ask us directly — including if you believe you have found a vulnerability.