Clinic data security and backups in BOC

What it does

Security in BOC starts with people. Each team member signs in with their own account: when you press Add New Staff, BOC emails a login password to the address you enter, so every person has a login of their own and every line in the Activity Log carries a real name. BOC also limits how many times someone can try to sign in, request a code, or reset a password in a short time.

Accounts that can change the business get an extra step. The owner, and anyone whose role is Owner or holds Full Access, role management, or staff editing, confirms a new password with a code BOC sends to their email, in the Confirm password change box in the BOC app and on the Profile page. A new email address for these accounts needs the current password and a code sent to the new address.

When the password changes there, BOC signs that account out of the BOC app on every phone, so each phone asks for the new password. When a staff member leaves, turning their switch off in Team signs them out on the web and in the app at their next step, while their file and history stay in BOC.

Hourly backups, encrypted before they leave the server

Every hour, BOC copies the database of every clinic, compresses the copy, and encrypts it before it leaves the server. The encrypted copy goes to separate backup storage, and the key that opens it is kept offline, away from the servers. Only encrypted copies are stored.

Alongside the hourly copies, BOC keeps daily, weekly, and monthly copies. A check also runs every hour: when the newest database copy is more than two hours old, the BOC team receives an alert by email.

The files your team uploads, such as photos and documents, are copied to separate backup storage every four hours, and every four hours the newest encrypted database copy is also pulled to a second location. All of this runs on its own in the background, with nothing for your team to set up.

Your clinic's own database and private files

Each business on BOC has its own database and its own file folders, so your patients, visits, payments, and staff live apart from every other clinic. Customer photos, documents, and signatures are private files: BOC opens each one through a signed link that expires after a few minutes.

HR files are private too. Clock-in selfies are kept in private storage, and a video an employee sends to HR opens for that employee and for the HR managers of their branch.

Roles, the Activity Log, and Your data

Roles decide who sees money, customer files, and settings. In each role, the Business Setup permissions include Roles, Activity Log, and Export Data, plus the branches the role may open, so the owner chooses who manages roles, who reads the log, and who takes a copy of the business. The Team Management page explains every role and permission.

The Activity Log in Business Setup records who created, updated, or deleted a record, with the value before and after, and it also lists sign-ins and sign-outs. Next to it, Your data downloads everything that belongs to the business: Full All-Time Export builds a ZIP with a folder for each customer and the actual files, and Date Range Export gives Excel and CSV files for up to 365 days. Passwords and secret keys are left out of every export.

How it works in BOC

1. Give each person an account. Open Team and press Add New Staff. BOC emails the login password to the address you enter, and for an Owner-level role it first asks for a code sent to that address.
2. Set what each role can do. Open Roles & Permissions and edit a role. Tick only the screens, money figures, and Business Setup permissions that role needs.
3. Confirm admin changes by email. When the owner or an admin-level account changes its password or email, enter the code BOC sends by email to save the change.
4. Switch off people who leave. Turn the person's switch off in Team. BOC signs them out on the web and in the app and keeps their file and history.
5. Check the Activity Log. Open Business Setup, then Activity Log, to see sign-ins, sign-outs, and every change with its before and after values.
6. Download your data. Open Business Setup, then Your data, and choose Download All Data or a date range to keep your own copy.

Who it is for

Clinics Clinics keep patient files on their own database with hourly encrypted backups and a named login for every doctor and receptionist.

Dental clinics Dental clinics keep X-ray images and patient documents as private files that open through short-lived links.

Dermatology and laser Laser clinics keep before and after photos and signed consent forms as private files, copied to backup storage every four hours.

Beauty salons Salons give the front desk its own role and keep exports and the activity log with the owner.

Spas Spas switch off a therapist who leaves with the switch in Team and keep their history in BOC.

Sports clubs Sports clubs with several branches decide which branches each role may open and download their member data at any time.

What your team gains

• An encrypted copy of every clinic database every hour
• An email alert to the BOC team when a backup is late
• A code sent by email for admin-level password and email changes
• Phones signed out of the app after a password change
• A separate database and private files for each business
• Roles that decide who exports data and reads the log
• Your data downloads everything, whenever you want

Questions

Related features

• Team Management
• Activity Log
• Data Export