Platform
Security and data protection in Clic Health
Health data is sensitive personal data under Brazil's LGPD. Clic Health was designed so that what identifies patients never leaves the hospital and each hospital sees only its own data.
Data security is the first thing a hospital's IT team and data protection officer (DPO) assess in a BI tool. Under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), health-related data is sensitive personal data, and processing it requires extra care. Clic Health was designed around that premise.
What identifies the patient stays in the hospital
Management dashboards do not need to know who the patient is: they need to know how much an encounter cost, how much was billed, how many days an admission lasted. That is why patients travel to the cloud identified only by a code. Names, national ID numbers (CPF) and dates of birth never leave the hospital.
For management, nothing changes: accounts, encounters and payers can be tracked as usual. For LGPD, the risk drops considerably, because the data that circulates outside the hospital does not directly identify the patient.
Each hospital sees only its own data
- Each hospital has its own key to access its data model, stored encrypted on the server.
- A hospital's users see only that hospital. Access by the Clic Health support team is also logged.
- Data reaches the browser already summarized for analysis, not as a row-by-row copy of the hospital database.
Two-step sign-in and a log of everything
- Sign-in with password and personal code, with lockout after failed attempts.
- Access profiles: the hospital administrator decides who sees each BI.
- Temporary users, read-only and with an expiry date, for audits and external consultants.
- A log of every access, the screens opened and configuration changes, for auditing.
Read-only on Tasy
DataClic, the agent installed at the hospital, queries the Tasy database with a read-only user. It does not write, change or delete anything in the hospital system. Communication starts from DataClic and goes to the cloud over HTTPS.
Transparency
The terms of use, privacy policy and cookie policy are public, linked in the footer of every page. The public website does not use advertising cookies; analytics cookies are used only with your permission.
If your IT team or DPO would like a technical conversation about data processing, book a call with us. The most common questions are in security and data protection.