Clinical data, treated like clinical data.
Postural assessments are health records. Here is exactly how PosturalPal protects them.
Australian hosting
Database in Sydney (AWS ap-southeast-2) and application servers in Sydney. Clinical data does not leave Australia in normal operation.
Encryption everywhere
TLS for every connection — clinic app, dashboard and API. Data encrypted at rest in the database.
Per-clinic isolation
Row-level security in the database means each clinic’s records are isolated at the database layer, not just in application code.
Least-privilege access
Clinician accounts see only their clinic. Admin actions are restricted to clinic owners. Our own operational access is limited and logged.
Hardened application
Strict Content-Security-Policy with per-request nonces, HTTPS enforced, modern password hashing, and magic-link sign-in that expires quickly.
Device management
Every capture device is registered to the clinic and can be removed from settings the moment it leaves the practice.
Backups
Automated database backups with rotation, hosted in the same Australian region.
Breach response
If a breach likely to cause serious harm occurs, we notify affected clinics and the OAIC under the Notifiable Data Breaches scheme.
Found a vulnerability? Email support@posturalpal.com.au — we appreciate responsible disclosure and will respond quickly.
How we handle personal information.
The Privacy Policy sets out what we collect, why, where it lives and how to reach us about it.