🛡️ Security, Privacy & HIPAA Compliance
Synalux v11.1 Elite is built on a "Security-First" architecture. We don't just check boxes; we harden every layer of the clinical workflow to ensure that patient data is the most protected asset in your practice.
🔒 HIPAA Technical Safeguards
Exceed the federal standards for data protection.
- Encryption at Rest: All clinical data and media are secured with AES-256-GCM encryption.
- Encryption in Transit: Every connection is protected by TLS 1.3 with high-strength cipher suites.
- Zero-Knowledge Options: For psychiatry and sensitive therapy, notes are encrypted with keys that only the provider can access.
🕵️ Immutable Clinical Audit Trails
Absolute accountability for every action taken on the platform.
- 7-Year Retention: We maintain a permanent, unalterable log of every PHI access, edit, and deletion.
- Contextual Logging: Know exactly who looked at a chart, from which IP address, and for how long.
- Administrative Oversight: HQ admins can review organization-wide security posture in real-time.
🛡️ Role-Based Access Control (RBAC)
Enforce the "Principle of Least Privilege" with granular precision.
- Clinical vs. Admin: Ensure front-desk staff can see schedules but never clinical SOAP notes.
- Employee Overrides: Overrule base roles to restrict specific high-risk features (e.g., "Export to Excel").
- Branch Isolation: Providers in one branch cannot access records in another unless explicitly authorized.
📴 Offline-First Privacy (ESAQ)
Security that follows you into the field.
- Emergency Vaulting: If a device is lost or stolen while offline, the data is cryptographically sealed and plaintext PHI is purged.
- No Cloud AI Leaks: Our WASM-powered voice dictation processes all audio locally. Your clinical conversations are never sent to external AI servers.
🤝 Business Associate Agreement (BAA)
We stand behind our security.
- Enterprise Coverage: A signed Business Associate Agreement is available to covered-entity customers on request.
- Subprocessor Transparency: Full disclosure of our secure cloud infrastructure partners (Supabase/AWS/Vercel).
- Compliance Support: Our team assists you during insurance audits or HIPAA inspections.
⚡ Break-Glass Emergency Protocol
- One-Click Access: Authorized staff can override restrictions in true clinical emergencies.
- Immediate Notification: Security officers are alerted the moment a "Break-Glass" event occurs.
- Mandatory Justification: The system requires a clinical rationale to be entered before access is granted.
🔐 Platform Hardening
- Automatic Timeouts: Sessions expire after 15 minutes of inactivity (protected by Audio-Aware idling).
- SHA-256 Hashing: Passwords and access codes are never stored in plaintext.
- Ongoing Security Review: We review and harden the platform on an ongoing basis to identify and patch vulnerabilities proactively.
🗑️ Deleting an Account
You can delete your Synalux account in the Prism AAC app (Settings → Synalux Account → Delete account) or in Synalux POS (Settings → Account → Delete Account, then type DELETE MY ACCOUNT).
Deleting the account:
- Ends sign-in: the password sign-in is removed, Sign in with Apple is revoked, and every Prism AAC sign-in ends on every device.
- Ends web billing: a Prism AAC subscription bought on the web is cancelled, and an open checkout can no longer be paid. A subscription bought in the iPhone or iPad app is billed by Apple: cancel it in your Apple Account settings.
- Removes workspace access: every workspace membership and role assignment is removed, so the account can no longer open any workspace.
- Erases personal data: the name and email are replaced with an anonymous placeholder; profile, multi-factor sign-in, and connected-app details are removed; personal Prism AAC content and sent direct messages are deleted; API tokens are revoked.
- Keeps clinical records: patient records and session notes stay with the practice, and no longer name the deleted account as their provider or creator. Team-chat messages stay without the sender's name.
Audit record. The request is written to the audit log before anything is erased. It lists the workspace memberships and role assignments the deletion removes. A second entry records when the deletion finished.
The last admin of a workspace. Deleting your account is never refused because you are a workspace's only admin, and no one else is made admin automatically, since admin access reaches patient records. If other people remain in the workspace, it is named in the audit record, so Synalux support can assign a new admin after confirming with the business. To avoid the gap, make another member an admin before you delete your account.