What protects your records.

What protects your records

1. 01

   Health data hosting

   Hosting health data on behalf of a practitioner requires a certified host under French law (Public Health Code, art. L1111-8), with storage in the EU/EEA. The current hosting of L’Ostéopathe is not HDS-certified: as long as that is the case, do not record any real patient data.

   Publisher commitment
2. 02

   Encryption in transit

   Traffic between your browser and L’Ostéopathe is encrypted (HTTPS, HSTS).

   In the product
3. 03

   Document encryption

   L’Ostéopathe encrypts each document before storing it (AES-256-GCM, one key per file, itself protected by a master key kept outside the storage and the database); an encrypted file that was tampered with is refused on download. On the current hosting, documents are written encrypted to the server’s disk; this encryption is also mandatory with an object storage service. The master key can be replaced without making older documents unreadable.

   In the product
4. 04

   Sign-in and two-factor authentication

   Verified email address, password reset by a single-use link, two-factor authentication with an authenticator app and recovery codes. The owner can require it for the whole practice. Sessions last 12 hours at most.

   In the product
5. 05

   Access control

   Each member joins the practice through an email invitation and gets a role (owner, practitioner, assistant, secretary); the secretary role sees no clinical content. A file can be restricted to named people.

   In the product
6. 06

   Access log

   Every read, creation, change, print or export of a patient file is logged (who, what, when, from where).

   In the product
7. 07

   Retention

   Nothing is purged automatically: clinical and billing data is archived, never deleted by mistake. Benchmarks: invoices are kept for 6 years (French tax procedure code, art. L102 B); no law sets a period for an independent osteopath’s patient files, and the French data protection authority’s benchmark for paramedical practices is 20 years after the last visit.

   In the product
8. 08

   Backups

   The database is backed up every day on the hosting server, and each copy is erased within 14 days at most. A backup only counts once restored: a check tool restores the latest one into a temporary database and verifies its tables and gap-free invoice numbering.

   In the product
9. 09

   Full data export

   A ZIP archive of the whole practice (CSV, JSON, documents, manifest), at any time, on every plan, never blocked; a patient file can also be exported as a PDF.

   In the product
10. 10

    GDPR and processing

    You are the data controller; L’Ostéopathe processes data only to provide the service, on your instructions, under the data processing agreement (GDPR, art. 28) that applies with the terms of use. The agreement and the list of subprocessors are published in French.

    In the product