A BAA with every customer
Every pharmacy accepts our Business Associate Agreement when it signs up, on every plan.
Security & HIPAA
HIPAA-ready, with a BAA for every pharmacy
Your patients’ medication data is health information. Here is how we protect it.
HIPAA-eligible AWS services
BubbleTrack runs on HIPAA-eligible Amazon Web Services in the United States, covered by our Business Associate Addendum with AWS. Patient data stays in the US.
Encryption
All traffic uses TLS. The database, file storage and backups are encrypted at rest with AWS-managed keys.
Each pharmacy is isolated
Every record belongs to one pharmacy, and the database itself enforces it with row-level security, in addition to the checks in our code. We test isolation on every change.
Access controls
Roles for owners, admins, pharmacists and technicians; strong passwords checked against known breaches; screens that lock when idle; personal PINs on shared computers. Patients open one pack link with their date of birth, and see only that pack.
Audit logs
Changes to patient and medication data are logged with who made them and when. Our own support staff’s actions are logged separately, and they can’t open patient records.
Backups
Automatic daily database backups kept for 14 days, with point-in-time recovery.
Your data, your choice
Export everything at any time. When a pharmacy leaves, its data is deleted after the retention period in our terms.
Found a security issue?
Please email security@bubbletrack.app. We reply within two business days and don’t take action against good-faith research.
Spend less time on packs and more with patients.
14-day free trial. No credit card.