Privacy and security

The clinic controls its records. Every read is audited, every field is allowlisted, and some data never leaves.

The clinic is in control#

Each clinic controls its own patients' records. Your app sees a clinic's records because that clinic gave you a credential, and only within its scopes. The clinic can revoke it at any time.

• Nothing merges records across clinics, or across regions.
• Clinical content needs a scope and the clinic's opt-in for your app, which the clinic gives and withdraws under Apps that can read clinical content. See data classes.

Every read is audited#

Every successful read is written to the clinic's audit log before the response is sent. The entry records the credential, what was read, which records were returned, their data classes and the request_id.

If a read cannot be audited, it is not answered. You get a 500 api_error and no data.

Every field is allowlisted#

• Each resource returns a fixed list of fields. A column added to Claro's database never reaches the API until someone decides it should.
• Government identifiers are never returned: IHI, Medicare and DVA numbers, and practitioner provider and prescriber numbers.
• Free text written by or about a patient stays out until it is classified.

Your part#

• Ask for the fewest scopes that do the job.
• Keep credentials and webhook secrets on a server, in a secrets manager. Never in a browser, an app or a repository.
• Use HTTPS for your webhook endpoint and verify every request.
• Keep only what you need, for as long as you need it. You are handling health information.
• If a credential may have leaked, ask the clinic to revoke or rotate it at once.

Report a security issue#

Email security@claro.clinic. Include what you found, how to reproduce it, and any request_ids.

• Please don't access, change or keep data that isn't yours while you investigate.
• Please give us reasonable time to fix an issue before you share it.
• Never send real patient information. Describe it instead.