Security & Compliance

CareTrack handles sensitive health information on behalf of clinics. Our security programme is built around a shared-responsibility model: CareTrack secures the platform, infrastructure, and the controls available to clinics; clinics are responsible for how they configure users, roles, and patient invitations within their account.

Every change to the Service is evaluated against three questions: does this minimise the data we hold, does it preserve clinic control, and does it remain understandable to a non-technical clinic manager. When the answer to any of these is no, the change doesn't ship.

The Service is hosted on reputable cloud infrastructure with data residency within Switzerland or the European Economic Area, depending on the clinic's region. Production environments are logically isolated from development and staging, and access is restricted to a small number of authorised engineers using strong authentication.

The platform is designed for high availability with redundant components, automated health checks, and continuous monitoring. Backups are performed regularly and tested periodically. We do not silently move data between regions.

All network traffic to and from the Service is encrypted using TLS 1.2 or higher with modern cipher suites. Data is encrypted at rest using industry-standard algorithms.

Secrets — including API keys, database credentials, and signing material — are stored in dedicated secret-management systems, never in source control, and rotated on a defined schedule and on personnel change.

Customer access to the Service is governed by role-based access controls. Clinics define which staff can see which patient data, scoped by role. The principle of least privilege applies throughout.

Administrative access by CareTrack engineers is restricted to a small group, requires multi-factor authentication, is logged, and is only used to operate or support the Service in line with the DPA. Sessions expire after a defined idle period.

Access to patient data and significant administrative actions are recorded in audit logs. Logs are retained for a defined window appropriate to security and accountability needs, and are protected against tampering.

On request, clinics can be provided with information about access to their data as part of a security review or in response to a verified data-subject request.

Code changes are reviewed before they reach production. Dependencies are scanned for known vulnerabilities. Production credentials are not used outside of production. We use short-lived credentials and isolated environments wherever practicable.

We follow a defined change-management process, with rollbacks available for material changes. Security-relevant updates are prioritised.

We maintain a documented incident-response process organised around four phases:

• Detection — continuous monitoring of platform telemetry, security alerts, and customer reports.
• Containment — immediate actions to limit scope and prevent further impact.
• Investigation — root-cause analysis with preservation of relevant evidence.
• Notification — communication to affected clinics, and to supervisory authorities where required by GDPR or FADP (typically within 72 hours of becoming aware of a qualifying breach).

Post-incident reviews feed back into preventative changes. We do not minimise incidents and we do not claim to be invulnerable.

CareTrack is designed to support clinics subject to the EU General Data Protection Regulation and the Swiss Federal Act on Data Protection (FADP), and follows recognised healthcare privacy best practices.

We do not claim certifications we do not hold. Where a clinic requires a specific attestation or independent audit, please contact us to discuss; in the meantime, a Data Processing Agreement and a security overview are available on request.

The Service uses AI to draft pre-visit summaries from structured patient inputs. These summaries are assistive only: a qualified clinic user reviews and edits each summary before it is used in care.

Patient inputs and generated summaries are not used to train external AI models; contractual safeguards with AI subprocessors enforce this. Sensitive inputs are subject to additional guardrails, including transmission only to AI providers bound by appropriate confidentiality and data-protection obligations.

We rely on a small number of vetted subprocessors to deliver the Service. Each is bound by written agreements requiring confidentiality, security, and processing limited to documented instructions.

Material changes to the subprocessor list are notified in advance to clinic administrators where contractually required.

To report a security concern or suspected vulnerability, please email security@caretrack.health. We aim to acknowledge reports within five business days.

For Data Processing Agreements, security questionnaires, or a copy of our security overview for IT review, contact hello@caretrack.health.