Referral detail is encrypted
Patient fields sit in an AES-256-GCM column. List views and partner notifications never include them. Opening the note requires phi.read and a verified authenticator, and writes an append-only audit row.
Trust centre
Controls you can inspect. Advice you still need from counsel.
CareLoop is built so a US, UK or Canadian provider can keep referral growth and the referral record in one workspace. Nothing on this page is a BAA, a DPA or a completed DPIA. Those are documents a lawyer signs.
Sessions that can see PHI expire
Roles with phi.read idle out after 15 minutes. The cookie is httpOnly. Password hashes are argon2id.
Tenants are a database boundary
Postgres row-level security forces tenant_id to match the session setting. The platform owner uses a separate admin role, and entering a workspace requires a reason in the audit log.
The price does not follow the referral
Plans and the agency quote are flat. A test reads the pricing module and fails if a referral count is part of the maths. Gift logs are records with a visibility threshold, not a legal cap.
Consent is checked before a sequence
Canada (CASL) and the UK (PECR) block enrollment until a basis and a capture date are stored. Opt-out is respected in every region. Staging messages stay in a sandbox and are not sent.
Staging is synthetic
iqcareloop.atiqsoft.com is not a production region. The seeded workspace is fictional. Do not type a real patient into it.
Where a workspace is designed to live
United States
AWS us-east-2 (Ohio), HIPAA-eligible services under a BAA
HIPAA: BAA with the tenant and with sub-processors before PHI. MFA for anyone who can open a note.
United Kingdom
AWS eu-west-2 (London), UK GDPR hosting
UK GDPR and the DPA 2018. DPA, record of processing, export and erase. CQC regulates the provider; we keep the audit export.
Canada
AWS ca-central-1 (Montreal), PIPEDA / PHIPA hosting
PIPEDA, and PHIPA where Ontario health information is involved. Name a privacy contact. Keep a breach record.
Sub-processors
| Party | Role | Status in this build |
|---|---|---|
| PostgreSQL with PostGIS | System of record, including encrypted referral bytes | Running, in the region you deploy |
| Redis | Rate limits, queues, live updates | Running beside the app |
| Stripe | Subscription billing and tax | Not connected until a secret key is set. No card is charged here. |
| Transactional email | Magic links and status mail without PHI | Not connected. Links can be shown in development. |
| Map tiles | Optional street basemap | The product atlas is drawn locally. A street style is not required. |
| Object storage | Referral documents, SSE-KMS, per region | Schema is ready. Uploads are not stored on this host. |
Security target: OWASP ASVS level 2 habits now, SOC 2 Type I by the end of the Canada release, and a pen test before general availability. Status page: add one when the public host has an uptime check. DPA and BAA templates are drafts on the legal page for counsel, not signed paper.
GET /api/v1/health reports database, redis and queue lag.