Built to Protect the Data Your Clinic is Trusted With

The most sensitive things in your practice - session notes, transcripts, AI-generated summaries and client notes - are scrambled before they are written to the database. Even someone with direct access to a database backup cannot read them without the separate encryption key.

• AES-256-GCM field-level encryption with a unique random IV per value
• Applied to session notes, transcriptions, AI summaries, AI prompts, and client notes
• The application refuses to start without a valid encryption key configured - it fails closed rather than silently storing plaintext

Slotizen serves many clinics on shared infrastructure, and every single database read and write is tied to your business identity. There is no path through the product that returns another clinic's records.

• businessId scoping enforced at the service layer on every operation
• Every compliance table (consents, requests, grievances, incidents, retention policies, audit logs) carries and indexes business_id
• Per-business API routing

Not everyone in your clinic needs to read therapy notes. A receptionist booking appointments gets the schedule and client contact details, but clinical notes, session transcripts and AI summaries are stripped out before the data ever reaches their browser - enforced on the server, not hidden in the interface.

• Notes, transcription and AI summary nulled out server-side for the Receptionist role
• Seven-level role hierarchy (Super Admin through Client) enforced on both the API and the screen
• Every compliance screen is role-gated (incidents: Admin+, compliance dashboard and grievances: Manager+)

When a staff member opens an individual client record or session, Slotizen writes an entry recording who, what, when, from which device, and whether access was allowed or denied. Each entry is cryptographically linked to the one before it, so if anyone alters a past entry the chain breaks and it can be detected.

• PHI access logging captures user, business, resource, action, outcome, IP and user agent for client record and session access
• HMAC-SHA256 hash chain across log rows with a verification routine that pinpoints the first altered entry
• 7-year audit log retention set as the default policy

A compromised or malicious account cannot quietly download your entire client list. Slotizen caps how fast any single user can pull client and session records, with a much tighter cap on bulk exports and reports.

• Per-user rate limiting on client, session and data-request endpoints
• 120 requests/minute normal, 20/minute for bulk exports and reports
• Returns HTTP 429 with a Retry-After header when exceeded

Accounts can be protected with an authenticator app, sessions log themselves out when left unattended on a shared clinic computer, and you can see and end any device currently signed in to your account.

• TOTP two-factor authentication (Google Authenticator / Authy compatible)
• Automatic logout after 15 minutes of inactivity
• Active-sessions panel to review and revoke signed-in devices
• Login tokens held in HttpOnly cookies; user profile kept only in memory, never written to browser storage
• Asymmetric RS256 token signing in production, 15-minute access tokens, BCrypt password hashing, account lockout

Consent in Slotizen is not a single tickbox at signup. Each client has separate, individually revocable consents for general data processing, AI processing, session recording and marketing - each stamped with who recorded it, when, and from where.

• Four independent consent types: Data Processing, AI Processing, Recording, Marketing
• Grant and revoke timestamps captured with the recording staff member
• Per-client consent manager in the client record

Slotizen does not merely ask for AI consent and trust staff to honor it - the consent check runs inside the code path. If a client has not granted AI Processing consent, summary generation is refused outright. If they have not granted Recording consent, the audio never leaves your server for transcription. Client and therapist identities are replaced with placeholders before text is sent to the AI provider. Because clinical notes are free text, we recommend avoiding names in the note body - the AI never receives your client's name from the client record itself. Every AI-generated summary is presented for a clinician to review and edit rather than being filed automatically.

• Hard consent gate in the AI summary service, both standard and focused summaries
• Hard consent gate in the transcription service, checked before the audio file is transmitted
• Client and therapist identities replaced with placeholders in AI prompts
• AI output is always human-reviewable before it's saved

DPDPA gives the people you treat the right to see their data, correct it, have it erased, and receive a copy. Slotizen gives you a workflow to log each request, track it against the statutory 30-day clock, and record how it was resolved - so the obligation doesn't live in someone's inbox.

• Data subject request register covering access, correction, erasure and portability
• Each request auto-stamped with a 30-day due date and resolution notes
• Soft-delete erasure removes a client from every view across the product in one step, while preserving records required for clinical retention
• A separate grievance register with its own 30-day clock and resolution audit trail
• Overdue counts surfaced on the compliance dashboard

If something goes wrong, the clock starts immediately - DPDPA expects reporting to the Data Protection Board within 72 hours. Slotizen gives you a place to log the incident the moment it's discovered, track severity and affected records, keep a running timeline of who did what, and see the 72-hour deadline counting down before it's missed.

• Security incident register with type, severity, affected record counts and affected systems
• Tracking of whether the authority and affected clients have been notified
• A running incident timeline of actions and notes
• Automated monitoring every 30 minutes flags incidents approaching or past the 72-hour reporting deadline, monitored and surfaced on your compliance dashboard

Both regimes expect a named human to be accountable. Slotizen lets you formally designate and publish a Data Protection Officer and a Security Officer with contact details and appointment date, so your clients and any regulator know exactly who to approach.

• DPO and Security Officer designation with name, email, phone and appointment date, recorded per business
• Designation restricted to the business owner

Different kinds of records need to be kept for different lengths of time. Slotizen ships with sensible defaults for your practice, with the legal basis recorded alongside each.

• Retention defaults per data category - 7 years for clinical records and audit logs, 5 years for attachments and booking records
• Legal basis recorded alongside each policy
• Visible read-only in Business Settings → Data & Privacy

One screen shows your live compliance position - outstanding data requests and any that are overdue, open grievances, open incidents, and anything that has passed its reporting deadline. Built so a clinic owner can tell in ten seconds whether anything needs attention.

• Aggregates data subject requests (pending/overdue), grievances (open/acknowledged) and incidents (open/unreported high-severity/past 72h)
• Restricted to Manager level and above