Security, encryption and the audit log

Encryption

Client details, health answers, notes, photos and files are encrypted on your device (AES-256) with a long random key that nobody ever sees or types. Your team’s PINs unlock it, and your recovery key and recovery by email (Admin → Business → Security, Admins only) are the only other ways in. What’s stored online can’t be read without them, not even by Pulosa.

Recovery by email

For when every PIN is forgotten and the recovery key is lost too. Admin → Business → Security → Recovery by email (Admins only): switch it on, enter a Main email (usually your business login email) and, if you like, a Second email for someone you trust, such as a partner, manager or accountant. Half of a recovery code is emailed to both, in an email titled “Pulosa: your recovery code (half)”. Pulosa keeps the other half locked. Neither half opens anything on its own, and nobody at Pulosa ever sees the emailed half or can read your records. Keep that email and don’t forward it. Change emails or Send again make a new code (the old one stops working); switching it off throws Pulosa’s half away.

Using recovery by email

1. 1Contact Pulosa support and tell us you’re locked out. We’ll check it’s really you, for example by calling the number on your account.
2. 2We allow your recovery for 24 hours. Both recovery email addresses get an email saying so, so nobody can be let in without you knowing.
3. 3Sign in to your business login, then on the PIN screen tap Forgotten your PIN?, choose Recovery email, enter the code from your recovery email and choose a new PIN. It becomes the PIN of the business’s main admin, who is logged in. Everyone else’s PIN keeps working.
4. 4A new recovery code is emailed straight away, and the one you just used stops working. The audit log records the recovery and that Pulosa allowed it.
5. 5If the code is entered before Pulosa has allowed it, nothing opens: it says Pulosa hasn’t allowed your recovery yet.

Health information has its own lock

Medical history, health answers (including forms clients fill in online, which are encrypted in the client’s own browser before they’re sent), consent forms and signatures, clinical notes, photos and files are encrypted again with a second key, the clinical key. Only Admins and people with the See clinical records permission are given it, sealed so only their own PIN opens it. Everyone else, such as Managers and Reception, can still see who a client is, their bookings and that a consent was signed, but their device can’t decrypt the health information at all. Turn someone’s See clinical records off and the clinical records are re-locked with a new key they never had. New audit log entries never include health information either. This starts automatically the first time an Admin or practitioner logs in.

Getting access to clinical records

Someone newly allowed to see clinical records (a new practitioner, or a changed role) gets the clinical key from a colleague who already has it. It happens on its own, the next time one of them uses Pulosa after the new person has logged in once. Until then the new person sees “Your access to clinical records is being set up”, and health information shows as locked.

Auto-lock

If nobody taps, types or scrolls for a set time, Pulosa locks itself, so client records can’t be opened on a device left on the desk. Anything already saved stays saved; the next person unlocks with their own PIN. It starts at 5 minutes.

Changing auto-lock

1. 1Go to Admin → Business → Security.
2. 2Under Auto-lock, enter the minutes in Lock after (minutes): any whole number from 1 to 60.
3. 3Enter 0 to switch it off, so Pulosa stays open until someone logs out or locks it.
4. 4Tap Save. The change is recorded in the audit log.

Your business login

Also in Admin → Business → Security: change the business login email or password. A new email only takes over once you click the confirmation link.

The audit log

Who did what and when: opening a client’s record, their medical history, photos and files, consents, bookings, changes and payments. Each entry is linked to the one before, so the log can be checked at any time (Verify chain) and exported for insurers or inspections. Entries name the client by a hidden ID, never in the entry itself: the log shows their name while they’re on file, and “Deleted client” once they’re gone. Tap Export to download it. Search it, filter by action, tick Hide views, and choose how many to show. It’s in Admin → Data & compliance → Audit log. Seeing all of it needs the Audit log permission (on for Managers by default; switch it on for Practitioners or Reception in Admin → Team → Roles & permissions if you want them to see it); in the action filter, Data & compliance only narrows it to data-related entries. Anyone with See Data & compliance but not Audit log sees just those.

The server copy

Online, every entry’s fingerprint is also kept on Pulosa’s server, in a copy that can’t be changed or deleted by anyone, including Pulosa. It holds no names or descriptions, just fingerprints. Verify chain checks your log, checks the server copy, and checks they match, so nobody could quietly rewrite history on either. Under Server copy you’ll see it’s intact and matches, or the first entry where something changed. Just after a change you may see newer entries “still being sent”; that clears on its own.

Protection from spam and bots

Logging in to Pulosa, signing up, resetting your password and changing your business email can show the same check: if it says Please complete the security check, tick the box and try again. Your website’s booking page, gift card basket, contact and quote forms, chat assistant and data-request links have a check from Cloudflare that tells people from bots. Most visitors never see it; now and then it shows a small box in the corner to tick. Each connection can also only send a few of each form an hour, whatever email address it uses, so one person can’t flood your diary or inbox. If someone hits the limit, they’re asked to wait an hour or contact you directly.

In the app

Security settingsThe audit logJust given access: health information opens once a colleague with access next uses Pulosa