MedicusYour patient data. Protected by design.
Medicus keeps charts on your computer and gives you control over what is shared. Explore the safeguards built into the product, how information is handled, and the documentation available for your security review.
What is actually in place.
Each of these is something we can show you, not a policy we intend to write.
Patient data
- Charts are stored on the clinician's own computer, not on our servers
- Optional on-device tokenization of identifiers before any drafting request, with a review dialog showing the exact text to be sent
- Our relay passes drafting requests through and stores no chart content
- The account server holds logins, roles, rules and licences only
Application security
- Installer and every update are code-signed and verified before they run
- Update manifests are signed with a separate key; unsigned or altered packages are refused
- Role-based access: physician, administrator, owner
- Idle lock on installs that use a login
- Licences can be paused or revoked centrally; the app stops at next launch
Accounts and access
- Failed sign-ins are rate limited per client address
- Refusals are worded identically for a wrong password and an unknown account, so the API cannot be used to discover who has an account
- Administrative actions are written to an append-only audit log
- Server access is by SSH key only, restricted to a single approved address
Transport and network
- TLS 1.2 and 1.3 only; TLS 1.0 and 1.1 are refused
- HTTP Strict Transport Security, content-type and framing protections on every response
- The database listens on the local interface only and is not reachable from the internet
- The website carries no third-party analytics, advertising or tracking cookies
Availability
- Daily automated snapshots of the server volume. They cover account data and rules only; charts live on the clinician’s machine and are not backed up by us
- A restore point is taken before any infrastructure change
- Website releases are versioned and roll back by pointing at the previous release
Change management
- Every server configuration change is backed up before it is applied and reverted automatically if validation fails
- Application releases are versioned, signed and published through one channel
- Test builds go to a separate gated channel before public release
Where we stand today.
HIPAA
No government body certifies HIPAA compliance. What we can give you is a written description of how patient text is handled, and the Business Associate Agreement position for your counsel.
The Privacy switch in the app limits what leaves the clinician’s machine: with it on, names, MRNs, dates, phone numbers and addresses are replaced by tokens before a drafting request is sent. How it works is on the security page.
Who else touches the data.
The complete list. If it is not here, it does not receive anything.
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| Amazon Web Services | Servers, storage and content delivery | Account data and rules at rest; chart text only in transit through the relay | United States, Ohio region |
| Automated drafting and reporting service | Processes the text being drafted and returns the draft. Named in the security overview, available on request | The text being drafted: tokenized when the privacy switch is on, as typed when it is off, plus your rules for that box | United States |
| Let's Encrypt | Certificate issuance | Domain names only; no customer or patient data | United States |
What your review can ask for.
How the system is put together, where patient text goes, and what each component stores. Written for a reviewer, not a marketer.
Every destination chart text can reach, under each setting of the privacy switch, with retention for each.
Our current position, for your counsel to read before a pilot.
Or email support@medicusarc.com and you will get a reply from a person.
Found something we should fix?
Report a security issue and you will get a human reply, not a ticket number. Please do not include patient information.
Contact usLast reviewed 1 October 2026