Security & data handling
How we protect your health information
Health information deserves stronger protection than a marketing page of badges. This page describes the controls actually running in our systems today, and just as importantly, what we will never do with your data.
Our promise: what we never do
Some health platforms reserve the right to package patient data (“de-identified” or aggregated) for advertisers, sponsors, and commercial partners. We do not, and our systems are built without the tracking infrastructure that would make it possible.
- No third-party advertising trackers, analytics pixels, or social-media tags anywhere on this site, the patient portal, or the clinic console.
- We never sell personal information, and we never share it with advertisers, sponsors, or data brokers.
- We do not use your data, identified or de-identified, to build products for advertisers or other third parties.
- Your prescription is yours: we do not lock scripts to us, and we transfer your records to another provider at your request.
Who can access what
- Administrative staff sign in with multi-factor authentication in production, or through our enterprise identity provider; accounts must be provisioned by an administrator before they can sign in at all.
- Every staff member acts under a named account with a specific role; each role carries an explicit, least-privilege list of permissions, and every administrative screen checks them.
- Patients access only their own records through the patient portal, which authenticates every request.
- Signing out is deliberate: sessions cannot be destroyed or created by casual link-following, and administrative sessions expire automatically.
Every action is accountable
- Clinical and administrative actions (prescribing, approvals, releases, record changes, configuration changes) are written to an append-style audit trail attributed to the person who acted.
- Prescriptions carry their full workflow history: who prepared, clinically reviewed, approved, signed, and released each script, with timestamps.
- Audit records are minimised by design: only an explicitly allow-listed set of metadata fields may be stored, so free-form sensitive data cannot leak into logs.
Where your data lives and how it moves
- Patient files and documents are stored in Australia (Sydney region). Our deployment checks refuse an object-storage configuration outside Australian residency in production.
- All traffic is encrypted in transit with HTTPS.
- Machine-to-machine endpoints (payments, email ingestion, scheduled jobs) authenticate every call with signatures or verified identity tokens, and fail closed: an unconfigured integration refuses requests rather than accepting them.
- Secrets and cryptographic keys are kept outside the codebase; healthcare credentials such as our NASH certificate key are held under separate, offline-backed custody.
Reporting a security concern
If you believe you have found a security vulnerability in a Cipher Health service, please contact us through the details on our privacy page with enough detail to reproduce it. We will acknowledge your report, investigate, and keep you informed. Please do not access another person's data while demonstrating an issue.
Last updated 15 August 2026. This page describes controls in operation at the date shown; it is maintained alongside the systems it describes. See also our privacy and collection notice.