Clinics cannot see each other
Each clinic’s data is kept separate. A user of one clinic cannot open another clinic’s records.
Security
Clinic data security and KVKK: where is patient data, who can see it?
Health data is special-category personal data. Below, without technical jargon, is how Clineo protects it.
Access
Only authorized people see the data.
Roles and permissions
Physician, front desk, nurse, assistant and lab manager each work with separate permissions. Permissions are set per module as read, write or full access.
ExploreE-mail code at sign-in
After your password, a one-time code arrives by e-mail; the code is valid for 90 seconds. If you sign in with your Google account, Google's verification applies instead of the code. A session closes after 8 hours at most.
IP restriction in Enterprise
If you want the panel to be reachable only from the clinic’s network, IP restriction can be turned on.
ExploreProtection
Sensitive fields are encrypted, every action is logged.
Turkish ID number and phone are encrypted
They are stored in the database encrypted with AES-256; these fields cannot be read as plain text from the database file.
Record trail
In patient records, treatments and payments, who did what and when is recorded.
Files are not public
X-rays, photos and documents do not open from a public address; they open only after a permission check.
Video calls are not recorded
The content of the call is not stored; only the appointment record remains.
Backup
A backup every night, a second copy off the server.
The application and database run on a server in Istanbul.
Every night
The database and uploaded files are backed up automatically every night.
Three tiers
Daily backups are kept for 30 days, weekly backups for 12 weeks, monthly backups for 12 months.
Second copy
One copy of the backup is kept in a storage separate from the server; every morning we check whether the backup was taken.
KVKK
The clinic is the data controller, Clineo the processor.
The clinic is responsible for patient data; Clineo processes this data on the clinic’s behalf. You can send the privacy notice, explicit consent and consent forms to the patient from Clineo and have them signed. For a detailed roadmap see the clinic KVKK compliance guide, and for consent see consent forms.
New · 30 October
Independent proof on signed documents.
Timestamp
The hash of a signed or declined document is timestamped by an independent service. Only the hash leaves; the patient’s name and the text do not. It follows the international RFC 3161 standard and is not a qualified timestamp under Turkish Law No. 5070.
FAQ
Questions you may have
Can’t find your answer? Open the demo and try it yourself. If you get stuck, the user guide is at hand.
Open the demoIn which country is patient data kept?
The application and database run on a server in Istanbul.
How often are backups taken and how long are they kept?
An automatic backup is taken every night. Daily backups are kept for 30 days, weekly backups for 12 weeks, monthly backups for 12 months; one copy is kept off the server.
Can my staff see every patient?
No. Each user gets permissions according to their role; they cannot open a module or record they are not authorized for.
Who is the data controller under KVKK?
The clinic is responsible for patient data. Clineo is the party that processes the data on the clinic’s behalf.
See for yourself
Try the permissions screen with your own team.
Open the demo; your account opens right away, free for 14 days.