How JointFit Protects Patient Data
Patient trust matters as much as clinical outcomes. Here's a plain-language overview of how JointFit keeps patient data secure and where to go for the full detail.
Where your data lives
- All patient data is hosted in Australia, on AWS's Sydney region.
- Data is encrypted both at rest and in transit.
Certifications
Beyond The Clinic is ISO 27001 certified, audited through BSI. This covers our information security management system — the processes and controls behind how we protect data day to day, not just the technology.
Who can access what
Access follows the principle of least privilege: staff and systems only get the access they need to do their job, assigned by role rather than case-by-case. Within JointFit itself:
- Patients can access their own data.
- Healthcare providers can access data for patients under their care.
- Internal Beyond The Clinic staff access is limited to what's operationally necessary.
Privileged access to production systems requires multi-factor authentication (MFA).
How long we keep data
Health records are retained for at least 7 years, or longer where required by law. De-identified data may be retained longer for research and service improvement. Patients can request deletion of their data, which we action in line with our legal and regulatory obligations.
If something goes wrong
In the event of a data breach likely to result in serious harm, Beyond The Clinic notifies affected individuals and the Office of the Australian Information Commissioner (OAIC), in accordance with the Notifiable Data Breaches scheme.
Legal basis
Beyond The Clinic complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and with the Privacy Act 2020 (NZ) for New Zealand users. Read the full Privacy Policy for details on what we collect, how it's used, and your rights to access, correct, or request erasure of your information.
Questions?
Contact support@beyondtheclinic.io.