This page summarizes security themes for evaluation. Specific customer commitments are controlled by signed agreements, workspace configuration, and applicable policies.
Security Philosophy
CaelaraHealth is built for healthcare workflows where privacy, access control, and trust matter. The platform is designed to keep sensitive work inside authenticated portals, separate user roles, and make important activity visible to authorized practice users.
Core Protections
- Role-based access for providers, patients, care-team users, practice admins, and platform admins.
- Extra sign-in protection for practice-side accounts where configured.
- Portal-first clinical communication with minimal sensitive detail in ordinary notifications.
- Audit-aware behavior for sensitive patient, account, document, note, messaging, billing, and AI actions.
- Encryption-focused handling for data in transit and stored platform data.
- Provider-controlled AI draft workflows that require review before use in patient-facing care or documentation.
Access Controls
Access is designed around least privilege: users should only see what their role and practice relationship allow. Practice owners and admins are responsible for inviting the right people, reviewing access, and removing access when it is no longer needed.
Ongoing Practices
Security work includes dependency review, vulnerability triage, logging designed to avoid patient detail, incident response preparation, and controlled support access. We avoid placing protected health information in public forms or marketing workflows.
Report A Security Concern
Good-faith vulnerability reports are welcome when they follow our disclosure policy and avoid patient information, disruption, or unauthorized access.
Questions about this page?
Send non-PHI questions through the private beta request path or your established CaelaraHealth contact.
Request early access