Security
A child's health record is not an ordinary dataset. Here is specifically how PediaSync isolates it, who can reach it, and what happens if a device or an account is ever compromised.
Isolation between practices
Every family, and every record that belongs to it, is scoped to an organization in the database itself, through row-level security — not through application code that has to remember a WHERE clause on every query. A bug in the portal cannot leak one practice's data into another's view.
Sync is one-directional, by grant
The database role the sync API runs as is only granted permission to insert and update family records — it has no DELETE or write path back onto anything a practice controls. That direction is enforced by Postgres privileges, so it holds even if the application code above it has a bug.
Per-child access, not household access
A practice sees the children a family has actually linked to it, not a household's full record by association. A family with children at two practices keeps each practice's view limited to the child they see.
Consent that starts and ends on the family's device
A family joins by entering a single-use code in their own app — there is no parent account for anyone else to create on their behalf. They can unlink from a practice at any time, and can choose to have everything they sent deleted along with it.
Verified clinician accounts
A new office account must confirm its email address before normal use, by following a single-use link. Passwords are hashed with scrypt before they are stored; the plaintext password is never written anywhere and never kept in memory longer than the request that checks it.
Session and enrollment tokens are opaque and single-use
Login sessions and device enrollment codes are random values shown once. What the database keeps afterward is a SHA-256 digest of that value, not the value itself — a copy of the database does not hand over anyone's active session or a family's enrollment code.
An audit trail that the application cannot edit
Logins, issued and redeemed codes, enrollment changes, and data-deletion requests are written to an append-only log. The database role the application runs as has no UPDATE or DELETE grant on that table, so the record of what happened cannot be quietly edited by anything running inside the app.
Encrypted in transit, and a database that is not on the public internet
Connections to the portal and to the sync API are encrypted end to end. The database behind them is not exposed to the internet at all — the only thing reachable from outside is the application, which is the only thing permitted to reach the database.
Handling pediatric health data means practices using PediaSync have their own obligations under HIPAA. See the Privacy Policy for how that responsibility is divided, or get in touch to report a security concern.