Data and security

Who decides

The practice is the controller of its patients' data. The publisher of Acquito processes it on the practice's behalf, as processor (Article 28 GDPR), under the contract concluded with it.

A patient who wants to exercise their rights contacts their practice. The publisher helps the practice answer.

The data processed

The patient's name, their invoices and certificates (numbers, dates, amounts, health insurance fund), received transfers (date, amount, message, payer's name and account), and the practice's decisions.

For each member of the practice: username, email, hashed password, second factor and, if they wish, a photo.

Acquito receives no national register number, no patient address or date of birth, no diagnosis and no prescription.

Only received transfers are read, and Acquito takes only the fields above from them, never the payer's address.

The imported bank statement is kept as it is, to show each proof on the bank's own document. It may therefore contain other details from the bank, such as the payer's address.

This is health data: knowing that someone is treated by a physiotherapist is health data.

Where

In Switzerland, at Infomaniak. The European Union recognises that Switzerland ensures an adequate level of data protection.

No practice data is ever sent to an artificial intelligence service.

Sub-processors

Silexio (Nicolas Wieckiewicz, Belgium): development, maintenance, administration and support, remotely and without copying the data.

Infomaniak Network SA (Switzerland): server hosting and storage of the encrypted backups.

Any new sub-processor is announced at least 30 days in advance. The practice may object and terminate at no cost.

Security

Two-step sign-in is mandatory, attempts are limited, passwords are hashed (Argon2).

Each practice sees only its own data. Each member sees and does only what their role allows: the accountant sees the amounts without any patient name.

Encrypted connections (HTTPS). The database is never reachable from the internet. Administration only opens from an end-to-end encrypted private network (Tailscale), after a two-step sign-in. Tailscale only connects these devices: it does not see the data that travels over this network.

Error reports and technical logs contain no personal data.

Backups

A backup every night and before every update, encrypted before it leaves the server. The key that reads it is never on the server.

Each backup goes to two separate locations in Switzerland. One of the two copies is locked against deletion for 30 days. The copies then expire on their own.

The publisher's access

The publisher opens a practice's data only at its request or for an incident, on the server, without copying it.

Each access lasts 2 hours at most, states a reason, and the practice holder sees it in their settings.

In the event of a data breach, the publisher informs the practice within 24 hours.

Retention

The retention period of each type of data is set in the data processing agreement.

At the end of the contract, the practice has 30 days to retrieve its data, or receives it on request. The data is then erased, backups included, at the latest 90 days after the end of the contract.