Built so hospitals can trust it. Documented so procurement can approve it.
BioMedMeet handles patient identifiers, diagnoses, and clinical decisions. We treat the underlying architecture and operational practices with the seriousness that responsibility demands.
Encryption in transit
TLS 1.3 between client and server, between server and Microsoft Graph, between server and your SMTP relay. HSTS preload-ready. No plaintext credentials anywhere on the wire.
Role-based access control
Four roles — organiser, doctor, nurse, guest — gate every API call. Patient additions go through an organiser approval step. Treatment plans have a seven-day post-completion edit window with the responsible clinician on the record.
Auditable by default
Decisions, treatment plans, file uploads, patient approvals and meeting state changes capture who, what, and when. Exportable for the medical record and for clinical governance review.
Microsoft Entra app-only auth
Teams meeting creation uses a single application identity in your Microsoft tenant — no per-user OAuth handover, no consent fatigue. Permissions are scoped to OnlineMeetings.ReadWrite.All with policy-based access for a designated organiser identity.
Self-host or managed — your choice.
Self-hosted (recommended for hospitals)
- Docker Compose stack runs on your own server, on your network.
- Patient data never leaves your perimeter.
- Cloudflare Tunnel / Tailscale supported for secure remote access without exposing ports.
- Backup & restore documented; you own the MongoDB volume.
Managed cloud (for fast onboarding)
- Hosted on a regional cloud you nominate (US, EU, India).
- Encrypted at rest with provider-managed keys; customer-managed key support on the roadmap.
- Daily snapshots, point-in-time recovery, 99.9% target SLA.
- Same Docker images as self-hosted — zero lock-in.
HIPAA posture
BioMedMeet's architecture aligns with the HIPAA Security Rule's administrative, physical, and technical safeguards. We do not yet hold a formal HIPAA certification — no software product does, since HIPAA compliance is an operational state of the covered entity. We can sign a Business Associate Agreement once your hospital is on a paid plan.
GDPR posture
BioMedMeet supports lawful data processing under Article 9(2)(h) of the GDPR (necessary for medical diagnosis, the provision of health care). We provide data-processing-agreement (DPA) terms, support data subject access and deletion requests, and offer EU-region managed hosting on request.
Sub-processors.
A complete list, kept current. Self-hosted deployments avoid most of these by definition.
Responsible disclosure.
Found a security issue? Email us at [email protected]. We acknowledge within two business days, fix critical issues within seven, and credit responsible reporters in our changelog.