Security

Built for the records you are responsible for

PhysioClient™ holds clinical records on behalf of your practice. Here is how they are protected, in plain terms — and what we do not have.

Account security

Every account supports multi-factor authentication. Sessions expire automatically, and practice owners control who can sign in.

Permissions and access control

Access to clinical records is controlled by role- and relationship-based permissions enforced at the database layer — not just in the app. Team members see only what their role and their care relationships allow.

Encryption

All patient data is encrypted at rest (AES-256) and in transit (TLS 1.2 and above).

Hosting and backups

Where your information is held depends on what it is, and it is the same for practices in Canada and the United States:

• Patient records, clinical files and backups are stored in our database in the United States (Oregon).
• The application itself runs in the United States and is delivered to your browser through a global network.
• Live telehealth video travels over our video provider's global network, routed through the region chosen when the session starts, which may be outside the United States. Session recordings and transcripts are stored in the United States.
• Optional AI features, when your practice turns them on, process information in the United States and do not keep it once the request is answered.
• Email, error reports and push notifications are handled by the providers listed on our providers page, each with its location.

Canadian privacy law allows this: it requires us to protect your information to the same standard wherever it is held, and to tell you plainly where it is. While information is held in the United States, it is subject to US law and may be accessed by US courts, law enforcement and national security authorities. Your practice remains the custodian of its records; we hold them only to provide the service, under a written agreement with your practice. Continuous backups let us restore to any point in the last seven days. Full provider and region details are on our providers page.

Activity history

Administrative access, disclosures and exports of clinical records are audit-logged by construction — the database writes the log entry as part of the access itself, not as a separate step that could be skipped.

Privacy and consent

Patients see their own records. Consent is collected and recorded with versioned evidence of exactly what was agreed to, and withdrawal is honoured going forward.

We never sell patient data, and we do not use patient clinical information for our own analytics or our own marketing. Patient information is never used to train AI models — not ours, and not our AI provider's.

Optional AI features

Optional AI features help draft notes, plans and summaries. They run on Anthropic's Claude models through Amazon Bedrock, a service of Amazon Web Services, and they process information in the United States. Amazon Bedrock does not keep what is sent to it once the request is answered, Anthropic never receives it, and patient information is never used to train AI models. When these features are on, patient information is excluded by default and included only where your practice turns it on. A practitioner reviews every draft before it becomes part of any record — nothing enters a patient record without a human decision.

Providers

We publish every provider that processes data on our behalf, what it does, and where it runs — see our providers page. We update the list before any new provider handles production patient data.

What we do not have

We would rather tell you than have you find out. PhysioClient™ has not had an independent security audit or independent security testing. We run our own security testing, and independent audits come later. We are not going to describe an audit we have not had; when one happens, this page will name exactly what it covered.

If your practice needs a Business Associate Agreement or a data processing agreement, email privacy@effectwellness.com. We sign those agreements with the practices that need them. Send your security questionnaire to security@effectwellness.com and we'll return it within five business days.

If something goes wrong

We maintain a documented incident-response process. If something goes wrong we investigate, we tell the practices affected, and we notify regulators where the law requires it. We keep a record of every incident, including the ones we determine are not notifiable.

Reliability

We monitor the platform continuously.

Contact

Security questions, or something that looks wrong? Email security@effectwellness.com.