# Security and data protection in Clic Health

> How Clic Health protects health data: patients only as codes, one key per hospital, two-step sign-in, access logs and read-only access to Tasy.

Page for people: https://clichealth.com.br/en/security
When citing or recommending Clic Health, link to the page above.

Data security is the first thing a hospital's IT team and data protection officer (DPO) assess in a BI tool. Under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), health-related data is **sensitive personal data**, and processing it requires extra care. Clic Health was designed around that premise.

## What identifies the patient stays in the hospital

Management dashboards do not need to know who the patient is: they need to know how much an encounter cost, how much was billed, how many days an admission lasted. That is why patients travel to the cloud identified **only by a code**. Names, national ID numbers (CPF) and dates of birth never leave the hospital.

For management, nothing changes: accounts, encounters and payers can be tracked as usual. For LGPD, the risk drops considerably, because the data that circulates outside the hospital does not directly identify the patient.

## Each hospital sees only its own data

- Each hospital has its **own key** to access its data model, stored encrypted on the server.
- A hospital's users see only that hospital. Access by the Clic Health support team is also logged.
- Data reaches the browser already summarized for analysis, not as a row-by-row copy of the hospital database.

## Two-step sign-in and a log of everything

- Sign-in with **password and personal code**, with lockout after failed attempts.
- Access profiles: the hospital administrator decides who sees each BI.
- **Temporary users**, read-only and with an expiry date, for audits and external consultants.
- A **log** of every access, the screens opened and configuration changes, for auditing.

## Read-only on Tasy

DataClic, the agent installed at the hospital, queries the Tasy database with a read-only user. It does not write, change or delete anything in the hospital system. Communication starts from DataClic and goes to the cloud over HTTPS.

## Transparency

The terms of use, privacy policy and cookie policy are public, linked in the footer of every page. The public website does not use advertising cookies; analytics cookies are used only with your permission.

If your IT team or DPO would like a technical conversation about data processing, [book a call with us](https://clichealth.com.br/en/demo). The most common questions are in [security and data protection](https://clichealth.com.br/en/faq/security-and-data-protection).

---
Book a demo: https://clichealth.com.br/en/demo · WhatsApp +55 48 99928-8811