Data security & privacy

You handle sensitive clinical information. This page explains, in plain language, where your patient data lives, how it is encrypted, and who can access it.

Encryption

  • In transit: every connection between your browser, the application and the database uses HTTPS/TLS 1.2 or higher. No unencrypted traffic.
  • At rest: the database and file storage run on AES-256 encrypted volumes.
  • Passwords are never stored in plain text — they are hashed (bcrypt) by the authentication service.
  • Documents uploaded to a patient chart live in a private bucket. They are not reachable through a public URL: access uses short-lived signed links (10 minutes) issued only to the owning clinician.

Per-clinician isolation (Row Level Security)

  • Row Level Security is enabled on every table in the database. No table is left open.
  • Clinical tables — patients, documents, test assignments, responses, sessions, payments and treatment plans — enforce policies that scope each record to its owning clinician.
  • In practice: one clinician cannot read, edit or list another clinician's patient data, either through the app or by querying the API directly.
  • The links patients receive to complete a test use a unique token and grant access to that questionnaire only — never to the clinical record.

Server location

  • Infrastructure is hosted on Amazon Web Services (AWS), region us-east-2 (Ohio, United States).
  • Data is therefore stored and processed in the United States. We recommend your informed-consent form states this explicitly.
  • The infrastructure provider offers a Data Processing Agreement (DPA) aligned with GDPR.

Backups and continuity

  • The database is backed up automatically every day by the infrastructure provider.
  • Standard retention for those backups is 7 days.
  • You can also export the full patient chart and any result report as PDF at any time, so you can keep your own document-level archive.

Infrastructure certifications

  • The platform runs on Supabase (database, authentication and storage) on top of AWS.
  • Supabase maintains SOC 2 Type II certification and provides a GDPR-aligned DPA.
  • To be fully transparent: these certifications belong to the infrastructure we use — they are not certifications issued to PsicoTest Pro itself.

AI and third parties

  • AI-assisted reports are generated with Google Gemini models through a secure gateway over HTTPS.
  • What is sent: test responses, scores and the clinical content needed to draft the report.
  • What is not sent: full name, email, phone number, or the patient's uploaded documents.
  • The gateway operates in no-training mode: submitted data is not used to train third-party models.
  • Email: sending a test shares only the patient's name and email address with the delivery provider.
  • Payments: the billing platform processes the clinician's subscription data only. It never receives patient information.

Your professional responsibility

PsicoTest Pro acts as a data processor: you remain the controller of your patients' information. We recommend obtaining informed consent for digital record-keeping, using a strong and unique password, and never sharing your account. Instrument results support clinical decision-making and do not replace professional judgment.

Have a specific security or compliance question for your practice?

Start free trial