Clinic isolation
Every signed-in request is scoped to the user's clinic membership. Integration credentials, patients, templates, reports, billing records, and team activity belong to that clinic boundary.
Account security
Use an individual account, a strong unique password, and the required second sign-in step. Recent verified sign-ins can remain valid for up to two hours of activity; inactivity and explicit sign-out end local access.
- Never share an account or verification code.
- Sign out on shared computers.
- Remove former team members instead of reusing their accounts.
- Review Team activity after an unexpected role, key, or template change.
Patient data and report handling
Orvexa AI minimizes stored patient information and keeps clinic data scoped to the clinic workflow. Uploaded source PDFs and generated reports should be handled as clinical documents even when the product does not retain the finished file.
- Use non-identifying data in templates, screenshots, and support requests.
- Verify patient identity before upload, generation, download, or chart filing.
- Store downloaded PDFs only in the clinic's approved system.
- Do not send patient content to a new vendor without clinic approval.
Audit evidence and support
Use the clinic ID, time, route, integration name, and non-sensitive error message when requesting help. Activity records can establish who changed a configuration without exposing report content or credentials.