Privacy Policy & Security Standards

1. Clinical Data & Privacy Commitment

At P-Desk, we recognize that clinical notes, assessments, and client records are highly sensitive. We maintain strict compliance with health records regulation (including HIPAA and GDPR) to ensure that practitioner and client data remains strictly confidential and secure at all times.

2. HIPAA Compliance & BAA

For clinics, group practices, and healthcare organizations, P-Desk operates as a Business Associate under HIPAA. We sign a standard Business Associate Agreement (BAA) outlining our responsibility for protecting Protected Health Information (PHI). Under HIPAA compliance:

• All client records are isolated on a per-organization database level.
• Practitioner logs are audited to maintain traceability of records access.
• Role-based access controls restrict diagnostic information from unauthorized staff.

3. Encryption & Security Architecture

We use industry-standard security protocols to defend records from leakage:

• Encryption in Transit: All data transmitted between your browser and P-Desk servers is encrypted using TLS 1.3 (SSL).
• Encryption at Rest: Database columns storing clinical notes, client details, and diagnostics are encrypted using AES-256.
• Automated Backups: Full backups are generated daily and stored across redundant, secure cloud environments with points-in-time recovery.

4. Data Ownership & Controls

You retain full, exclusive ownership of your practice data and clinical records. P-Desk will never sell, analyze, or distribute your client logs for marketing or advertising purposes. You have the right to:

• Export complete client files and session timelines to standardized PDF reports at any time.
• Request immediate permanent deletion of client profiles and database histories.

5. Contact Privacy Officer

If you have questions about our BAA, SOC-2 readiness, database encryption, or wish to exercise data removal rights, contact our Data Protection Officer at: