How Mobcly Protects Patient Data

Last updated: 10 October 2026.

Clinics trust Mobcly with their patients’ records. This page explains, in plain words, how we keep them safe, and what we are still working on. It describes the service as it is today; we update it when something changes.

Where the data lives

Servers in the EU. Our servers and database run at Hetzner in Finland. Exam images and backups are stored in the EU with Cloudflare R2.
The database is not on the internet. Only our own application can reach it; it has no public address.
Behind a protected network. All traffic to our servers passes Cloudflare. The server’s firewall accepts web traffic only from Cloudflare, and administrator access uses keys, not passwords.

Encryption

On the way: every connection uses HTTPS, from your device to Cloudflare and from Cloudflare to our servers (with a certificate check on both legs).
Exam images are kept in a private storage bucket that is never public.
Backups are encrypted before they leave the server. The key that can open them is kept offline, not on any server.
In the apps: the Android and Windows apps keep their offline copy in an encrypted database, and exam images on the device are encrypted too. The encryption keys are kept in the device’s secure key storage.

Signing in

Passwords are never stored, only a strong one-way hash (BCrypt).
Wrong passwords: after 5 wrong tries the account is locked for 15 minutes.
Sessions are short: a sign-in token lasts 45 minutes and is renewed in the background. If a stolen renewal token is ever used twice, the whole session is ended.
Changing or resetting a password signs the account out everywhere else, and we email you about it. We also email you when your account is used from a device it has never used before.
Limits and bot checks: sign-in, sign-up and the public booking pages are rate-limited, and public forms use a bot check.

Who can see what

Each clinic sees only its own data. Every request is checked against the clinic’s account on the server, never on what the app says.
Roles: only a clinic’s owner can see the access log, export full records or permanently erase them.
Access log: every view, change, export and erase of a patient record, and every sign-in, is logged with who and when. Clinics keep this log for 6 years.
Our staff access clinic data only when needed to run the service or answer a support request, and are bound to confidentiality.
No patient data in analytics or error reports. Usage statistics record which screens are used, with page addresses stripped of any ids; we never send what you type.

Backups and recovery

Every night the database is backed up, encrypted, and stored in a separate EU storage area for 30 days.
Restores are tested: we have restored a backup to check that it works.
Deleted accounts are removed for good 30 days after the owner’s request, and disappear from backups within a further 30 days.

Monitoring

Uptime checks every 5 minutes, including the database, alert us when the service is down.
Error reports (Sentry, EU) tell us about problems quickly, without patient data.

What we are still working on

We prefer to be open about this:

Two-step sign-in (a code in addition to the password).
Automatic sign-out after a period of inactivity.
Encryption of the server database at rest. Today it relies on the server being private and unreachable from the internet; images and backups are already encrypted.
HIPAA readiness for US clinics. Until then we do not sign Business Associate Agreements (Terms of Service §4).

Your part

Security is shared. Clinics keep their devices locked and up to date, use the operating system’s disk encryption, keep their own passwords private, and give staff their own logins. With an offline license, the data exists only on the clinic’s devices and in the backups it makes, so keeping those safe is the clinic’s job.

Reporting a problem

If you think you have found a security problem, write to [email protected]. Please do not test our systems without our written permission (Terms of Service §6).