Practitioner Security
Last updated: [Insert date]
Newminal provides digital tools that practitioners can use to manage aspects of their independent practice. We recognise that practitioners may use the platform to handle sensitive information, including information relating to patients and consultations.
This page describes, at a high level, security measures and responsibilities relevant to practitioners using Newminal. It should be read together with the Practitioner Terms & Conditions and the Newminal Privacy Policy.
Platform infrastructure
Newminal uses Supabase for database and storage infrastructure. The relevant infrastructure is configured in Mumbai, India, as described in the Newminal Privacy Policy.
Newminal's database uses Row Level Security (RLS) policies to help restrict access to records according to configured permissions.
Newminal also uses an encrypted video consultation server hosted in India to support video consultation functionality.
These measures form part of the platform's security approach. No single control can guarantee that information is secure in every circumstance.
Access controls
Database-level access controls, including RLS, are used to help ensure that access to information is limited according to configured permissions and the relevant user's role.
Practitioners are responsible for managing access to their own accounts and ensuring that any staff or other authorised users they permit to access their practice account have an appropriate need and authority to do so.
Practitioner responsibilities
When using Newminal, practitioners should:
- Keep account credentials confidential and use strong, unique passwords.
- Restrict account access to people who are authorised to use it.
- Remove or update access when a staff member or other authorised user no longer needs it.
- Use secure, access-controlled devices and networks when handling patient information.
- Avoid sharing patient information through channels that are not intended or authorised for that purpose.
- Ensure that information entered into the platform is accurate and handled in accordance with applicable professional and legal obligations.
- Notify Newminal promptly if they suspect unauthorised access to their account or information.
Practitioners remain responsible for their professional obligations, including determining the lawful basis for processing patient information, providing required notices, obtaining any required consent, and maintaining appropriate clinical records.
Video consultations
Newminal uses an encrypted video consultation server hosted in India. Practitioners should explain the nature of remote consultations to patients and follow applicable professional requirements for consent, confidentiality, record-keeping and continuity of care.
Do not assume that consultations are recorded. Any recording should only take place where the relevant functionality, notices, permissions and applicable requirements allow it.
Third-party services and processing locations
Newminal may rely on third-party service providers to operate and support parts of the platform. Depending on the service and its configuration, information may be processed by providers or in locations outside India. Please consult the Newminal Privacy Policy for further information.
Reporting a security concern
Practitioners should report suspected security incidents involving their Newminal account or the platform as soon as reasonably possible.
Security and privacy enquiries: privacy@newminal.com
Do not send passwords, access tokens or unnecessary patient-identifiable information in an initial email.
Updates
We may revise this page as the platform and its security practices evolve. The current version will be published on this page.
This document is a draft overview. Before publication, Newminal should verify it against its implemented access controls, staff procedures, vendor contracts, incident-response process and practitioner agreements.