Security & Data Practices

MedSpaOS uses a shared application with tenant-aware routing and authorization. Access is limited by account role and, where enabled, clinic device and network controls. We use least-privilege access for operational systems and review permissions as the product evolves.

Data is transmitted over encrypted connections and stored using the protections provided by our hosting and database providers. Supabase PostgreSQL Row Level Security, tenant relationships, authentication, and audit events are used to reduce unauthorized cross-clinic access. Encryption, backup, and retention details are subject to the applicable infrastructure configuration and customer agreement.

We use code review, dependency updates, security headers, secret-management practices, logging, monitoring, and automated security checks as appropriate to the service. Access to production systems is restricted to authorized personnel and service accounts. We do not publish sensitive architecture details that could make the service easier to attack.

We maintain processes to detect, investigate, contain, and recover from security incidents. We will notify affected customers without undue delay when required by law or contract and will provide information reasonably needed for customers to meet their own notification obligations.

Customers must use strong, unique credentials, configure roles conservatively, remove departing users, protect exported records, validate integrations, and report suspected vulnerabilities or incidents promptly. Clinics remain responsible for their patient notices, consent, legal basis, retention schedule, and clinical safeguards.

Send responsible security reports to security@medspaos.com. Please include enough detail to reproduce the issue and avoid accessing, changing, or deleting data that does not belong to you. We aim to acknowledge reports promptly and coordinate a fix or mitigation.