Security and privacy, clearly documented.

Layered safeguards protect patient and clinic information throughout the platform.

• TLS protects customer-facing production traffic
• The production database and protected object storage use encryption at rest
• Patient PINs are encrypted with a separate keyed lookup hash for verification

Access is limited to the right person, role, clinic, and patient plan.

• Owner, practitioner, admin, and staff permissions are role based
• Administrative access is protected by MFA and authenticated sessions
• Standard human care plans use a secure link, six digit PIN, and date of birth verification

Sensitive activity is recorded so clinics can understand how protected workflows are used.

• Security-relevant and PHI access events are recorded in audit trails
• Delivery activity and suppression states are logged
• Legal acceptances include a timestamp and supporting request metadata

Patients receive a secure recovery experience without creating another account.

• Patient sessions are time limited and bounded by the recovery timeline
• QR Rx does not sell patient data
• Patient-specific external clinical AI remains disabled unless the deployment policy requirement is satisfied

Production services use healthcare-ready infrastructure and defensive controls.

• Render and protected AWS storage operate under signed BAAs
• Rate limits protect login and patient verification workflows
• Selected public forms use Cloudflare Turnstile bot protection

A documented process guides identification, containment, communication, and follow-up.

• Security events follow a documented triage and response process
• Affected customers are notified under the BAA and applicable law
• Client error reports are scrubbed before storage