Security & Data Safety

1. Why Security Matters for Clinics Using Propelence

Propelence AI is a software-as-a-service (SaaS) platform that helps clinics manage booking, reminders, missed-visit follow-up, and patient messaging.

Because clinics may use Propelence with sensitive patient and operational data, security and data protection are core to how we design, operate, and improve the platform. This page explains our general security and data safety approach. For HIPAA-specific details, please see our separate HIPAA Compliance Statement.

2. Our Security Principles

Our security and data protection program is guided by principles commonly recommended for healthcare SaaS and cloud environments:

• Defense in depth: Multiple layers of security controls across infrastructure, application, and operations.
• Least privilege: Access to systems and data is limited to what people and services need to perform their roles.
• Secure-by-design: Security considerations are built into product design, engineering, and deployment processes.
• Continuous improvement: Regular reviews of our controls, dependencies, and architecture as threats and technology evolve.

3. Infrastructure and Network Security

Propelence is hosted on reputable cloud infrastructure providers that implement physical, environmental, and baseline network safeguards for their data centers.

On top of that foundation, we implement controls such as:

• Network segmentation and security groups to limit access routes.
• Use of modern secure transport protocols (such as TLS) for data in transit.
• Configuration management and environment hardening aligned with healthcare SaaS best practices.

We aim to align our infrastructure choices with industry guidance for HIPAA-ready and healthcare-aware SaaS architectures.

4. Application Security and Development Practices

We approach Propelence’s application security with a focus on secure engineering and ongoing quality:

• Secure development lifecycle: Incorporating security checks, code review, and quality controls into development workflows.
• Input validation: Data sanitization to reduce the risk of common web application vulnerabilities.
• Authentication: Session management designed to help protect user accounts and clinic portals.
• Role-based access controls (RBAC): To limit which users can view, configure, or export sensitive information.

Where appropriate, we draw on DevSecOps and secure-by-design practices recognized in healthcare SaaS security guidance.

5. Encryption and Data Handling

We use encryption to protect data both in transit and, where applicable, at rest, following guidance for healthcare SaaS platforms and HIPAA-ready architectures:

• Encryption in transit: Data sent between browsers, apps, and our servers is protected using secure protocols (such as TLS) intended to help prevent interception or tampering.
• Encryption at rest: Where supported by our infrastructure and relevant to the type of data, we apply encryption to storage locations so information remains unreadable without appropriate keys.

We also work to maintain appropriate key management practices, including limiting key access, rotating keys where applicable, and monitoring key usage consistent with cloud and SaaS security recommendations.

6. Access Control and Account Security

Clinics and team members need secure access to their accounts and workflows. Propelence supports access control and account security in ways that align with healthcare SaaS guidance:

• Unique accounts for authorized clinic staff and administrators.
• Role-based permissions to separate duties such as configuration, scheduling, reporting, and messaging.
• Authentication controls and session management designed to reduce the risk of unauthorized account access.

Clinics remain responsible for choosing strong passwords, managing who is granted access, and reviewing user roles regularly as staffing and responsibilities change. Depending on a clinic’s needs and the capabilities of the platform, additional measures such as multi-factor authentication (MFA) may be available or recommended.

7. Monitoring, Logging, and Incident Response

We treat visibility and response as essential components of data safety:

• Logging and monitoring: Key events in the platform are logged to support troubleshooting, operational insight, and investigation of potential issues.
• Alerting: Where appropriate, automated alerts help us identify unusual activity or service issues.
• Incident response processes: Documented procedures guide how we triage, investigate, and address suspected security incidents involving the platform.

If an incident affects clinics or patient-related data, we work with impacted customers and follow the notification obligations described in our HIPAA Statement and applicable agreements.

8. Subprocessors and Third-Party Services

Propelence may use carefully selected subprocessors and third-party services to deliver parts of the platform, such as hosting, messaging, analytics, or support tools.

When those services involve handling clinic or patient-related data, we:

• Evaluate providers’ security posture and relevant certifications or frameworks.
• Put contractual commitments in place to require appropriate data protection measures.
• Limit access to the data they need to perform their services.
• Review service changes that could affect security or data flows.

An overview of subprocessors that support core Propelence functionality can be provided to clinic customers on request.

9. Data Retention and Deletion

Propelence retains data for periods that support clinic operations, reporting, and any legal or contractual obligations.

When data is no longer needed for legitimate purposes, we aim to:

• Remove, archive, or de-identify data consistent with our agreements and clinic expectations.
• Apply retention practices that consider healthcare, privacy, and operational requirements.

Clinics may also have their own retention policies (for example, medical record retention requirements) and remain responsible for aligning the way they use Propelence with those obligations.

10. Shared Responsibility With Clinics

Security and data protection in healthcare SaaS environments are a shared responsibility between the platform provider and each clinic.

Propelence focuses on safeguarding its infrastructure and application, while clinics are responsible for:

• Managing which staff and partners have access to their accounts.
• Configuring workflows, templates, and integrations in line with their policies.
• Maintaining local device and network security for staff using the platform.
• Ensuring compliance with applicable healthcare, privacy, and communications regulations.

We encourage clinics to include Propelence in their own risk assessments, vendor reviews, and ongoing security programs.

11. Compliance and Alignment With Standards

Security expectations in healthcare often reference frameworks such as HIPAA, SOC 2, ISO 27001, and national privacy laws.

Propelence’s security and data protection measures are designed to support clinics in meeting these expectations when the platform is used appropriately, although each clinic’s overall compliance posture depends on many factors beyond our control.