Clinic Pulse was built by clinic operators who've sat through security reviews. So we designed the product to sidestep the hard parts entirely, with no patient charts and no EMR hookup, and to keep every organization's data walled off from every other. This page explains how.
No PHI, by design
Clinic Pulse is an operations tool. It tracks volumes, metrics, schedules, budgets, and outreach, never patient charts. We do not intend to collect, and you agree not to enter, protected health information (PHI) as defined under HIPAA. Because there's no PHI, there's no HIPAA integration project, no EMR hookup, and no IT security review standing between you and getting started. A clinic manager can sign up and be fully running the same day.
Every organization is isolated
Your data lives in your organization and nowhere else. One clinic group can never see another's numbers, staff, schedules, or budgets. This boundary is enforced at the data layer on every request through row-level security rules, not just hidden in the interface. When your team reads or writes anything, the system checks that the record belongs to your organization before it's ever returned.
Role-based access
Within your organization, people see only what their role should show them. Owners and regional directors see across all locations, managers see their own location, and staff get just their schedule and daily tools. Administrators control roles and permissions from the admin panel, so access stays matched to responsibility as your team changes.
Audit logging
Sensitive actions such as user changes, permission updates, and data exports are recorded with who did what and when. That gives multi-site operators a clear trail and makes it easy to review changes across an organization.
Encryption and hosting
Data is encrypted in transit. The application is hosted on our platform provider (Base44), and subscription payments are processed by Stripe, which means we never see or store your full card number. No system is perfectly secure, so we ask that you use a strong, unique password and keep your login credentials private.
Your data is yours
You can import historical data from CSV to get started, and export your reports and data whenever you want. If you close your account, you may request deletion of your data at any time; we delete it within 30 days except where we must retain records for legal or billing purposes.
Reporting a concern
If you believe you've found a security issue, please email us at security@clinicpulseapp.com and we'll look into it promptly.