Privacy & security

Three principles

• The client is in control. The client decides who takes part in their Synapse Cura care team and what they share with each person, within clearly stated legal exceptions. Depending on their care level, a change sometimes waits for a short handover period or a guardian’s agreement; the client always sees why.
• Clinicians are accountable. Each clinician remains responsible for their own observations, decisions and professional records. Synapse Cura doesn’t replace those records — clinicians keep their own, as their profession and the law require, and keep them if the client ends the link.
• Synapse Cura keeps the rules. Who wrote what and when, who may see what, who opened what, how an entry is corrected and how long it is kept — all of it is enforced in the database itself, not just hidden in the interface.

Who sees what

• The client sees everything of their own: their record, diagnoses, routine, completions, ratings, medications, reactions, notes — and who has opened their record.
• A clinician sees data only for clients who added them to their team, and only what that client chose to share with them: in-depth parts of the record, practices, hard moments and medication are switched on separately for each person. Notes the client hasn’t chosen to share stay hidden.
• The clinicians’ room is only for clinicians on the same client’s team. The client agrees to it when inviting a clinician and can always see that it is being used.
• Loved ones see only the level the client chose (emergency profile, guide, alerts) — never notes, diary or scores. Locking the circle removes access instantly.

The record is permanent and transparent

Record entries and diagnoses can’t be edited or deleted — a correction is a new entry, and the client can add their context next to any entry. Every time a clinician or guardian opens the client's record, check-ins, medication, safety plan or other health information, it is logged and the client can see it. The client can download their whole record as a file.

Clinicians

Every clinician account is approved by hand after we check their professional register, and we record what we checked. A clinician can’t link themselves to a client or widen their own access — that happens only through the client’s invite and choices.

If something is wrong

A client can say at any time that they don’t feel safe with a clinician or guardian. That person’s access pauses immediately and a person reviews the report.

Notifications

Emails never contain personal or clinical details — only that something is waiting in Synapse Cura.

What we don’t do

We don’t sell data, show ads, or use client data for marketing. Synapse Cura doesn’t diagnose or recommend treatment — diagnoses are recorded by the client’s own clinicians.

Deletion

A client can request deletion of their account and data — or any other GDPR right — from the Me page (or at info@humanityinbusiness.com). We reply within one month and say what was deleted, what was kept and why.

Not yet in place

Plainly: there is no formal data processing agreement (DPA), data protection impact assessment (DPIA), independent security audit, or fixed retention period yet. If your practice needs these before a pilot, tell us — we’ll put them together with you.