The safest place for patient records is a device you control. The apps are designed so that patient data never needs to reach our servers. This page states what is in place and, just as importantly, what is not yet.
Last updated: 14 August 2026
Patient records, prescriptions and your medicine list are stored in an encrypted database (256-bit SQLCipher). The key is generated on your device and kept in the operating-system secure store — macOS Keychain, Windows, or the Android Keystore — never in a file next to the data.
We hold your account, your subscription state and, for QR verification, only the prescription number, verification code, issue date, your name and registration, and whether it is revoked. Never the patient’s name, diagnosis or medicines.
Once finalized, a prescription’s content cannot be edited, re-dated or deleted — enforced by the database itself with triggers and a tamper-evident fingerprint, not by application convention. Corrections are new records; the original stays.
The desktop app runs with a sandboxed, isolated renderer, a strict content-security policy, validated IPC messages and disabled Node integration, so a defect in the interface cannot reach your files or records.
Your plan is a cryptographically signed licence checked on your device against a public key, so the free-plan limit and subscription work offline and cannot be edited by hand.
Everything printed on a prescription is escaped, and prescription previews run in a sandbox with scripts disabled, so a pasted string cannot inject markup.
No patient names, diagnoses or medicines appear in analytics, logs, error reports, URLs or notifications.
Listed openly, because a security page that only lists strengths is not a security page: