Security & compliance

Built so hospitals can trust it. Documented so procurement can approve it.

BioMedMeet handles patient identifiers, diagnoses, and clinical decisions. We treat the underlying architecture and operational practices with the seriousness that responsibility demands.

Encryption in transit

TLS 1.3 between client and server, between server and Microsoft Graph, between server and your SMTP relay. HSTS preload-ready. No plaintext credentials anywhere on the wire.

Role-based access control

Four roles — organiser, doctor, nurse, guest — gate every API call. Patient additions go through an organiser approval step. Treatment plans have a seven-day post-completion edit window with the responsible clinician on the record.

Auditable by default

Decisions, treatment plans, file uploads, patient approvals and meeting state changes capture who, what, and when. Exportable for the medical record and for clinical governance review.

Microsoft Entra app-only auth

Teams meeting creation uses a single application identity in your Microsoft tenant — no per-user OAuth handover, no consent fatigue. Permissions are scoped to OnlineMeetings.ReadWrite.All with policy-based access for a designated organiser identity.

Where your data lives

Self-host or managed — your choice.

Self-hosted (recommended for hospitals)

  • Docker Compose stack runs on your own server, on your network.
  • Patient data never leaves your perimeter.
  • Cloudflare Tunnel / Tailscale supported for secure remote access without exposing ports.
  • Backup & restore documented; you own the MongoDB volume.

Managed cloud (for fast onboarding)

  • Hosted on a regional cloud you nominate (US, EU, India).
  • Encrypted at rest with provider-managed keys; customer-managed key support on the roadmap.
  • Daily snapshots, point-in-time recovery, 99.9% target SLA.
  • Same Docker images as self-hosted — zero lock-in.

HIPAA posture

BioMedMeet's architecture aligns with the HIPAA Security Rule's administrative, physical, and technical safeguards. We do not yet hold a formal HIPAA certification — no software product does, since HIPAA compliance is an operational state of the covered entity. We can sign a Business Associate Agreement once your hospital is on a paid plan.

GDPR posture

BioMedMeet supports lawful data processing under Article 9(2)(h) of the GDPR (necessary for medical diagnosis, the provision of health care). We provide data-processing-agreement (DPA) terms, support data subject access and deletion requests, and offer EU-region managed hosting on request.

Transparency

Sub-processors.

A complete list, kept current. Self-hosted deployments avoid most of these by definition.

Vendor Purpose Region
Microsoft Graph / Teams Online meeting creation Your tenant region
Your SMTP relay Outbound notification email Your choice
Cloudflare CDN / tunnel (only if you choose) Global edge
Managed cloud host App + database hosting (managed plan only) Region of your choice

Responsible disclosure.

Found a security issue? Email us at [email protected]. We acknowledge within two business days, fix critical issues within seven, and credit responsible reporters in our changelog.