Security & privacy
Clinic software security and privacy, in plain words
How Velvet Lead protects clinic and patient information, what we record, and what we don't claim.
Each clinic has its own database
Your clinic's data isn't mixed in with other clinics' data. Each clinic has its own separate database, so bookings, leads and patient details stay with your clinic.
Permissions enforced by the database
Team members sign in with a role: admin, manager, practitioner or front desk. What each person can see and change is enforced by the database itself, using row-level security in Postgres, not just by hiding buttons in the admin panel.
That means even if someone tried to request data their role doesn't allow, the database wouldn't return it. When someone leaves, you remove their access instantly. See team access.
Clinical records are need-to-know
Only practitioners and admins can read medical forms, medical summaries, consultation notes and treatment records. Front desk staff and managers see bookings and whether a form was signed, nothing clinical. A front-desk login can't read a clinical note even by going around the app.
A signed consultation note is final: it can't be edited or deleted, by the app or directly in the database, and corrections are added as dated amendments showing who wrote them. Every change to the clinical record, and every time someone opens a patient's clinical record, is logged with who and when. Only admins can read that log.
Clinical notes and treatment records can't be deleted along with a booking or a patient. A review a patient marked as private can't be published, which the database also enforces.
Consent is recorded, not assumed
When patients submit a form or book, their acceptance of the privacy notice is recorded. Marketing consent is recorded separately, with the time and the source, so you can tell who agreed to hear from you and how.
Treatment consent is stored with the exact wording the patient agreed to, their typed signature and the time. WhatsApp messages and text reminders only go to patients who opted in when they booked. Before-and-after photos in your gallery carry a record that the patient consented to their use.
We keep less, for less time
Some data is deleted or cleared automatically. Chat transcripts are deleted after 12 months. Visitors' IP addresses and browser details on inquiries and signed forms are cleared after 90 days. Message contents are cleared from the sending queue 30 days after they're sent.
Every public form is rate-limited against spam and abuse.
We watch for problems
Automatic error alerts go to the Velvet Lead team, so we usually see an issue before your clinic does. The dashboard in your admin panel shows the status of email, WhatsApp, background jobs and the assistant.
Where it runs
Velvet Lead is built with Next.js and deployed to Vercel. Data is stored in a Postgres database on Supabase. Both run on accounts in your clinic's own name, billed to you directly, so you own the infrastructure and the data on it. Emails are sent through a transactional email provider, WhatsApp messages through Meta's official WhatsApp Business Cloud API, and text reminders through Twilio. Deposits are paid on Stripe's own secure payment page, so card details never touch your website.
The AI assistant has limits built in
The assistant answers from your clinic's own information and documents. It doesn't give medical advice, it can't book on a patient's behalf, and it's protected against abuse with rate limits and a daily limit. You can switch it off at any time.
FAQ
Security questions
Do you have security certifications?
We don't currently hold independent security certifications, and we won't claim ones we don't have. This page describes how the system is actually built.
What about HIPAA?
We don't claim HIPAA compliance. Velvet Lead includes clinical notes with database-enforced access and an audit trail. US practices that must operate under HIPAA should talk to our team before storing clinical records, including about Business Associate Agreements with the hosting providers.
Do you store medical records?
Velvet Lead stores clinical records for the treatment room: medical forms, medical summaries, consultation notes and treatment records, visible only to practitioners and admins. It isn't a full EMR: there's no e-prescribing, lab results, insurance billing or telehealth.
Who owns the data?
Your clinic owns its patient and lead data, and your website runs on your own domain.
Have a security question we haven't answered? Contact us.
Book a 15-minute demo
See the patient side and the admin panel on our demo clinic. We'll tell you honestly whether Velvet Lead fits your clinic.