Security and Privacy - Two-Factor Login, Encryption, GDPR

The most sensitive record in a practice management system is not yours, it is your client's: health history, measurements, session notes, contact details. The GDPR treats these as special category personal data, which means they need more protection than an ordinary customer record.

The roles split like this: you are the controller of that data, Vitena is the processor acting on your instructions. This page covers both halves separately — the measures on our side, and the ones that are yours to take. Neither replaces the other.

Whoever gets into a practice account sees every client record in it. That makes the front door the highest-value control in the whole system — not the vault behind it. On its own, a password is only as strong as the weakest place you reused it, or the most convincing phishing email you receive on a busy morning.

Vitena offers optional two-factor authentication. Once it is on, signing in takes two things: something you know (your password) and something you have (your phone). The six-digit codes come from any standard authenticator app — Google Authenticator, Microsoft Authenticator, Authy, 1Password. The code is calculated on the phone from its own clock, so it needs no internet connection and no mobile signal.

SMS is deliberately not used: SIM-swap attacks have made a texted code an unreliable second step.

Data is exposed at two moments: while it travels, and while it sits. Both have their own measures.

• Encryption in transit: all traffic between your browser or mobile app and our servers goes over HTTPS (TLS). Even on an open cafe network, nobody in between can read it.
• Passwords cannot be reversed: passwords are stored as bcrypt hashes, never in plain form. Someone reading the database cannot read your password, and when you forget it we send you a reset link, never your existing one.
• Sensitive keys get a second layer: your two-factor secret and, if you connected it, your Google Calendar access token are encrypted with AES-256-GCM before they are written to the database.
• Uploaded files: client documents, treatment photos and report attachments are stored encrypted on disk (AES-256). The storage itself is closed to the internet, and files are served only through short-lived links issued to an authorised session — once the link expires it is useless.
• Card details never reach us: subscription payments run through the payment provider with 3D Secure. Your card number never touches a Vitena server.
• Access is revoked immediately: the moment you archive or suspend a user, their session ends — no waiting for the next day or the next sign-in.

Vitena runs on Amazon Web Services inside the European Union, in the Frankfurt region (eu-central-1). Application servers, database, file storage, content delivery and outbound email all sit there. That is where your client records are kept.

• The database is closed to the internet: it lives in a private network segment with no route in from outside. Only the application itself can reach it.
• Backups: the database is backed up automatically, and the backups stay in the same EU region.
• Subprocessors: we publish every service in use and what it is used for. The full list is at vitena.care/data-protection

AI features are a separate matter, and they are opt-in. Text goes to a model provider only when you start a job yourself — a meal plan draft, a note draft, reading a document. Nothing scans your records in the background. Those providers are US-based and bound by Standard Contractual Clauses; which feature sends what is written out on the same data-protection page.

Every practice sits in its own database schema (tenant-per-schema), so two clinics' records never mingle inside the same tables. Which practice a request belongs to is established at the connection level, and if that cannot be established the request is refused — there is no "not sure, show it anyway" path.

The second layer of isolation is inside your own practice:

• Roles and permissions: each team member gets only what their job needs. A receptionist can see the appointment without seeing the session notes.
• Client portal: a client sees only their own records, their own plan and their own appointments.
• Self check-in screen: the kiosk at the door carries nothing about today's patients — not a count, not an initial. Someone who finds the address learns nothing.
• People who leave: archiving them ends their session on the spot, including the tab they left open.

The legal shape is this: you are the controller of your clients' data, Vitena processes it on your instructions. The agreement that puts this in writing — the Art. 28 GDPR data processing agreement, the AVV in Germany, the verwerkersovereenkomst in the Netherlands — is free on every plan, including the free one: vitena.care/dpa

The system also makes your clients' rights practical to honour:

• Right to information: what is processed and why is written out at vitena.care/privacy.
• Data portability: you can export a client's records in a couple of clicks.
• Right to erasure: deletion requests are handled with identity verification at vitena.care/gdpr-verify.
• Restriction and consent: informed consent records are kept exactly as they were signed. If the wording changes later, the signed line is never touched.

A system is only as strong as its weakest link, and that link is usually a daily habit rather than a line of code. This five-minute list closes most of what actually goes wrong in real practices: