How we protect your clinic’s data

The Vertowise app (app.vertowise.com) runs on Netlify, with its server code in the US East region (Ohio, us-east-2). Its database is PostgreSQL hosted by Supabase on Amazon Web Services (AWS), in the same region. Files you upload are kept in a private Supabase storage bucket in the same project.

So your clinic’s data is stored in the United States, not in Jordan. This website (vertowise.com) is also hosted on Netlify and holds no patient data.

Every connection to the app uses HTTPS (TLS), with certificates issued through Netlify. The app sends a Strict-Transport-Security header, so a browser that has visited it refuses plain HTTP for a year. The connection between the app and its database is encrypted as well.

Every record belongs to one clinic, and every request the app answers is limited to the clinic of the person signed in. That rule lives in shared code that every page and action goes through, instead of being rewritten by hand each time, and an automated check in our development process flags any database query on clinic data that is not limited to a clinic.

Each person signs in with their own account and a role: Owner, Therapist, Receptionist, or Receptionist + PT.

• Receptionists cannot open clinical records: assessments, session notes, progress and outcomes. The AI assistant leaves clinical data out of its answers for them.
• Therapists do not see billing, leads, reports or marketing.
• Only the owner can invite staff.

These limits are checked on the server for every request, not only hidden from the menu.

• Passwords are stored only as bcrypt hashes, never in readable form.
• New accounts confirm their email with a 4-digit code.
• Repeated sign-in attempts are rate-limited, per address and per network.
• A session ends after 24 hours, and changing your password signs out every other session.
• Google sign-in is optional.

Two-step sign-in (a second code at login) is not available yet.

Uploaded files are never given a public link: the app streams each one only after checking that the person asking is allowed to see clinical records.

Opening, changing, exporting and printing a patient’s records is written to the clinic’s access log: who, when and which record, without copying any patient data into the log itself.

The owner can export patients, sessions, appointments, invoices, payments and insurance claims as CSV files from Reports. Archiving a patient can be undone; erasing one permanently is a separate action. If you close your account, we delete your clinic’s data within 30 days of your written request, except where the law requires us to keep a record (see our Terms).

Dictation and AI drafting send the audio or text involved to an outside AI provider. The AI drafts and suggests; it does not diagnose, and nothing it proposes takes effect until you confirm it. The app’s privacy policy names the providers and explains what they may keep. Until it says otherwise, do not dictate patient names or identifying details into the AI features.

Vertowise does not hold an independent security certification (such as ISO 27001 or SOC 2), and we don’t claim HIPAA compliance. We don’t publish a backup schedule here until we have confirmed it with our hosting provider.

If you think you have found a security problem, email abdulkareem@vertowise.com with “Security” in the subject. Tell us what you found, the page or address involved, and how to reproduce it. We reply within one working day.

Please don’t open other clinics’ data, change or delete anything, or disrupt the service while testing. Our security.txt lists the same contact.