Privacy-aware by design, described as it is.
Medervia is designed with Australian healthcare privacy expectations in mind. This page says how it works today, including what is not done yet, in enough detail for your own assessment to be a real one. Our privacy policy covers the same ground as obligations.
Where your information is.
Your clinic's records are stored in Sydney, and the app runs in Sydney. A few providers handle something outside Australia, and they are all here.
- Your clinic's records and documents
- Supabase (database and private file storage)
- Sydney, Australia
- The Medervia app itself
- Vercel (hosting)
- Sydney, Australia
- Emails Medervia sends for your clinic
- Resend
- Sent from Japan; the record of each send is kept in the United States
- Your subscription and invoices
- Stripe
- United States. Your clinic's billing details only, never anything about patients
- Notifications on your devices
- Apple, Google, Microsoft or Mozilla, depending on the browser
- May be outside Australia. Your clinic's name and one sentence, never a person's name
- An AI tool your clinic connects (optional)
- The AI provider your clinic chooses
- Wherever that provider is. It can reach forms, templates and procedures only, never patients or staff records
Who can see what
Each clinic sees only its own records
Which clinic a record belongs to is checked by the database itself on every request, and checked again by the app. A fault in one is caught by the other.
Inside a clinic, a role decides what a person can change: owners and admins look after settings, the team, apps and billing; members do the day's work.
A patient sees only what was sent to them
A patient has no password. Their portal shows the requests and documents addressed to their own email address, and nothing else from your clinic.
Someone who works at a clinic and is also a patient
A person who works at a clinic can be a patient at the same email address, at any clinic including their own. Opening a request from their email starts a separate patient sign-in. It shows only what was sent to that address, and the database refuses it everything that belongs to a clinic, their own clinic included.
If they are signed in to the clinic app in the same browser, they are asked to sign out first, or to use a private window. When a clinic sends a request to the address of one of its own members, or one of its members accepts at their own address, the clinic's audit trail says so.
A room's tablet
A tablet paired to one of your rooms holds no clinic account. It reaches only the forms and agreements handed out in its room that day, while the person they were handed to is still placed in the room, and lists them by first name. An owner or admin pairs it with a code that works once and lasts two minutes, and unpairing it ends its access at once.
When a practitioner and a patient fill in a form together in a room, the live connection between the tablet and the practitioner's device carries only where each of them is on the form: pointers, taps, scrolling and which question is being typed in. Answers never travel over it: each is saved to the clinic's records, and the other screen reads it back from there. Only that room's tablet, and members of the clinic placed in the room, can join it.
What Handbook records about your staff
Where a clinic uses Handbook, it records when a person was asked to read a procedure, the reminders sent, and when they acknowledged it: their name, the version they read and the time. If they are excused, who excused them and the reason. For a daily checklist, which days it applied, which steps were ticked and whether each day was finished. Nothing is scored or ranked, and time spent reading is not measured.
A person sees their own; owners and admins see everyone's; other colleagues see none, and neither do Medervia's staff. Pictures in a procedure are kept in private storage and opened through links that expire. Handbook's settings offer a one-page staff notice saying all of this in the clinic's name.
Medervia's own staff
Our support and back-office accounts cannot open your clinic's records, and anything our staff change on your account is recorded as done by Medervia.
As with any hosted service, the people who administer Medervia's database can technically reach the data in it. We say so rather than pretend otherwise.
An AI tool your clinic connects
Off until an owner or admin switches it on. A connected tool acts as the person who connected it, for one clinic, and can read forms and templates and draft forms, and, with Handbook, list, search and read procedures and draft new ones. It cannot see patients, their answers or their documents, nor who has acknowledged a procedure or ticked a checklist, and it cannot publish or send. Any member can see who has connected one, and it can be disconnected at any time.
Signing in, and links
No passwords
Everyone signs in with a six-digit code emailed to them, valid for ten minutes. There is no password to reuse, guess or leak. Two-step sign-in with a second device is not offered yet.
Signing in and signing up behave the same whether or not an address already has an account, so the pages cannot be used to find out who uses Medervia.
Knowing a record's identifier gets you nothing
Every record has an identifier, and identifiers are not secrets. Nothing in Medervia is unlocked by knowing one.
An emailed link is a key, so it is treated like one
The link in a request email carries its own random token of at least 128 bits, separate from any identifier. It works once and expires after seven days. After that the patient asks for a code by email.
The one exception is deliberate. A reveal room invitation is meant to be forwarded to family, so anyone holding it can join the room and will see the result when the patient starts the reveal. Only the patient can start it, and she can remove a guest or lock the room.
How information is stored
Encrypted, and private
Information travels encrypted between your browser, Medervia and its providers, and our database provider encrypts it where it is stored.
Documents are kept in private storage and opened through links that expire after ten minutes. Nothing a patient sends is in a public location. The one public folder holds published app screenshots and similar marketing images.
A document, once issued, is never rewritten
An issued PDF is stored with a SHA-256 fingerprint and is never regenerated from changed data. A correction is a new record, not an edit to the old one.
Today the PDF of a patient's agreement or form is produced in the browser where it is completed when they accept or submit: the patient's own, or in a room, the room's tablet or the clinic's device. Its fingerprint is recorded when it is stored.
Email is only as private as the mailbox
When a patient accepts an agreement, your clinic's copy is emailed to your clinic's own mailbox with the PDF attached. The patient's copy is not attached to anything: it waits behind sign-in in their portal.
What is recorded
Every change to clinic data
Every change to your clinic's records is written to the clinic's audit trail by the database itself, so no part of the app can forget to. An entry says who, when, which record and which fields changed, without copying the values. Every member of the clinic can read it.
What happened to each request
For each request: when it was sent, whether the email provider delivered or bounced it, when the patient opened it, and when they accepted, declined or submitted.
For a form or agreement completed in a room, the room, who handed it out and who was placed in the room at the time are recorded, and printed on the document.
Viewing a sealed reveal result is recorded each time. Ordinary reading of records inside the clinic is not logged.
Your practice management software
Designed to work connected, not available yet
Medervia is designed so a clinic can choose how its records are held. Today every clinic is standalone: Medervia stores what its documents need. In connected mode, your practice management software stays the record, and Medervia keeps only the identifiers your software's vendor issues rather than patients' details.
Connected mode is not available yet. We are in negotiation with major practice management software providers, and we will list them here once agreements are in place. Using Medervia never depends on a connection.
How long it is kept
A retention date for each record
Keeping information for ever is not a safe default; under Australian privacy law it is a breach. Medervia works out a retention date for each record from its type, the patient's state and, where the law needs it, their date of birth, and shows you when records are due for review.
Destroying a record is an owner's or admin's decision, with a reason. The destruction is entered on a register that says what was destroyed and when, without keeping what was in it.
Some things are deleted on their own
A reveal's sealed result and its keepsake are deleted thirty days after the reveal. Unfinished answers to a form lapse, and patient details nobody reviews are cleared, after the number of days your clinic sets. Patients and carers are taken out of every room overnight; the audit trail keeps that they were placed there.
A staff member's acknowledgements of procedures are kept for the number of years the clinic sets after that person leaves, and each day of a daily checklist for the number of months it sets; then each is destroyed with an entry on the destruction register. Ticks on a checklist are not written to the audit trail one by one: one entry records each day when it closes.
Backups
Our database provider keeps backups for a limited number of days so that the service can be restored after a failure. A destroyed record can remain in a backup until that backup expires; it is not restored into your clinic.
What we do not claim.
Medervia holds no security certification, and we do not borrow one from a provider: a provider's certificate covers the provider, not what is built on it. Medervia has not yet had an independent penetration test.
No system is immune from compromise, and using Medervia does not make a practice compliant with anything. It is a tool that helps reduce unnecessary exposure of patient information, not a substitute for your practice's own policies, staff training or professional advice. Your practice remains responsible for its own obligations.
A question this page does not answer?
Ask us. We would rather explain a detail, or hear where you think we fall short, than have you guess.