Security & privacy
Designed with healthcare-grade security principles.
Medical information is among the most personal data there is. Cure is architected so the right person sees the right information — and every access leaves a trace.
Defence in depth
Protection at every layer.
Each request passes through several independent controls before any medical data is returned.
- Patient deviceSession-bound access
- AuthenticationCredentials + OTP readiness
- AuthorisationRole and relationship checks
- Secure APIsEncrypted, scoped requests
- Provider systemsSource of truth
Identity & access
Making sure the person signing in is who they say they are — and sees only what they should.
Secure Authentication
Strong sign-in using MRN or phone number and password.
Designed for
- Credential protection
- Protection against repeated failed attempts
- Secure account recovery
OTP / MFA readiness
Architecture ready for one-time codes and multi-factor sign-in.
Designed for
- SMS one-time codes
- Additional factors per provider policy
Role-Based Access
Permissions scoped to each role and relationship.
Designed for
- Patient, guardian and staff roles
- Least-privilege by default
Session Management
Sessions that expire and can be controlled.
Designed for
- Inactivity timeouts
- Device session control
Data protection
Protecting medical data as it moves between systems and devices.
Encryption
Data in transit is protected with modern encryption.
Designed for
- Encrypted connections end to end
- Storage protections per deployment
API Security
Authenticated, scoped integration endpoints.
Designed for
- Authenticated, token-based requests
- Request validation
Controlled Medical Document Access
Documents are released and shared only by explicit action.
Designed for
- Provider-controlled release
- Patient-initiated sharing
Privacy & accountability
Respecting patient privacy, and keeping a record of every access.
Patient Privacy
Patients see only their own data and their dependents'.
Designed for
- No data shared without action
- Guardian rules per provider
Audit Logs
Access and actions recorded for accountability.
Designed for
- Sign-in and access events
- Document views and shares
About compliance
Specific regulatory and compliance requirements are addressed per deployment, together with each healthcare provider and in line with local regulations. Cure does not claim certifications that have not been formally obtained.
Designed with healthcare-grade security principles.
Only the right person sees the right information — and every access leaves a trace.