PracticeCentredLoading page...
Loading page...
Security
Staff compliance data is sensitive — especially in healthcare. PracticeCentred is built on Australian cloud infrastructure with strict access controls and a full audit trail.
PracticeCentred is for staff compliance and operational checks only — registrations, credentials, tasks, checklists and workplace incidents involving staff. Do not enter patient names, clinical notes, Medicare numbers or any patient health information.
If patient data is accidentally uploaded, flag it immediately in the platform so it can be removed and the action recorded in the audit log.
Infrastructure
Built on AWS in Australian regions — the same foundation used by regulated industries across the country.
Customer data is stored in Australian AWS regions (ap-southeast-2). Staff compliance data is not sent offshore for processing.
Documents and backups are stored in private S3 buckets with encryption. There are no public file URLs.
Every record is scoped to your organisation. Workflows enforce organisationId on every query — not just the UI.
Automated tests verify that one practice cannot access another practice's staff, documents or audit history.
Access control
Managers use authenticated accounts. Staff can act via secure links — including team members without a work email — with OTP verification on sensitive flows.
Owner, Manager/Admin and Staff roles control who can view, approve, export or manage billing. Staff see only their own profile and documents.
Staff receive time-limited links for uploads, tasks and acknowledgements. Links are tied to a specific person and purpose.
Sensitive secure-link flows verify identity with a one-time code sent to the staff member's mobile or email.
Practice managers sign in with email and password via AWS Cognito. Sessions are required for all admin actions.
Audit & monitoring
From document approvals to incident updates — sensitive actions leave a record your practice can review.
Views and downloads of sensitive files are recorded. You can see who accessed what, and when.
Approvals, waivers, offboarding, billing changes and incident updates are logged. Entries cannot be edited or deleted.
Tools to flag and remove accidentally uploaded patient information, with a minimal audit record of the action.
Workplace incident records and attachments follow the same private storage and access rules as compliance documents.
Our commitments
PracticeCentred is an operational tool for your practice — not a data broker. Read our full policies for legal detail.
Australian-hosted staff compliance with private documents and a full audit trail.